Linux Analysis Report
botnet.x86.elf

Overview

General Information

Sample name: botnet.x86.elf
Analysis ID: 1542362
MD5: 146b4662b517b8fdd0c22ddea45cde9c
SHA1: 1d5cafac6fee3e8752461519a4d10b947a68a8db
SHA256: 058c473fb64af0d9306f62c11a4856e20fe349e74e2694c79b40eabfc686ec45
Tags: Boatnetelfuser-NDA0E
Infos:

Detection

Mirai, Moobot
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Mirai
Yara detected Moobot
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: botnet.x86.elf ReversingLabs: Detection: 28%

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:36194 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:36540 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:36810 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:37080 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:37426 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:37686 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:37778 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:37900 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:38050 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:38290 -> 91.208.184.54:56744
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:38566 -> 91.208.184.54:56744
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:36194 -> 91.208.184.54:56744
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 193.122.255.185:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 99.39.166.254:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 117.63.194.107:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 12.149.72.232:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 8.114.154.134:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 144.149.248.34:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 168.78.163.37:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 83.12.42.165:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 24.133.59.44:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 223.180.26.20:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 75.42.142.149:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 112.113.59.216:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 44.122.87.44:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 211.133.83.27:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 149.184.143.144:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 187.225.232.196:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 93.51.255.124:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 128.58.210.232:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 165.168.202.108:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 115.24.135.120:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 64.11.78.111:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 158.181.35.236:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 113.9.156.170:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 68.74.201.73:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 82.225.32.247:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 222.123.64.69:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 213.110.252.226:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 112.191.122.101:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 187.146.183.67:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 32.242.49.158:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 180.241.255.111:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 163.108.172.189:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 211.181.63.35:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 195.200.253.233:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 84.235.212.8:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 145.65.222.94:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 161.127.240.253:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 207.247.83.199:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 204.217.91.238:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 169.102.4.68:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 126.20.4.246:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 170.235.141.122:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 46.14.69.220:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 57.94.190.95:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 160.85.191.177:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 212.188.152.72:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 132.18.19.74:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 13.51.239.65:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 82.219.75.227:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 195.249.166.185:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 144.110.52.43:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 210.83.107.140:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 111.215.32.108:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 145.227.61.230:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 115.148.232.108:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 113.163.250.187:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 194.213.141.30:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 208.175.207.45:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 4.75.29.214:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 34.89.187.143:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 71.14.135.185:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 115.125.103.200:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 146.153.22.85:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 190.174.14.195:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 189.38.238.1:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 134.70.130.245:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 32.112.144.10:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 43.153.250.84:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 80.161.69.115:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 49.65.127.26:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 137.255.207.113:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 2.101.93.132:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 81.88.19.244:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 194.234.241.232:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 182.196.89.6:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 17.55.82.193:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 152.43.60.26:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 89.109.229.154:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 156.19.253.23:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 126.54.156.239:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 17.182.10.207:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 85.226.159.115:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 31.9.139.61:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 119.74.14.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 202.99.88.125:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 121.238.244.3:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 203.214.75.154:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 87.214.198.158:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 8.56.51.246:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 82.109.45.213:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 190.224.54.3:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 204.127.248.188:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 69.37.27.130:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 101.119.46.154:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 105.7.173.150:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 109.27.94.164:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 122.104.224.207:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 194.93.78.138:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 204.147.220.187:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 5.41.50.35:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 208.213.70.142:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 216.98.194.125:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 207.115.122.93:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 73.12.190.116:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 98.27.55.189:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 8.205.237.29:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 124.109.97.121:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 19.122.175.61:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 82.243.122.219:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 98.212.25.75:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 219.125.181.11:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 141.156.110.73:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 51.56.170.144:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 157.44.4.0:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 59.150.215.248:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 114.110.181.147:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 221.33.233.43:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 179.21.146.143:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 13.65.13.45:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 113.203.98.134:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 129.221.175.128:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 43.57.221.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 13.125.168.32:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 176.144.87.216:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 116.142.207.29:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 25.94.105.139:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 5.61.230.253:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 197.134.241.148:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 68.245.38.93:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 135.47.231.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 35.215.6.21:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 222.54.63.63:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 8.9.15.124:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 126.160.218.149:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 77.186.111.115:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 40.134.161.161:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 80.230.129.239:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 58.240.4.210:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 8.102.119.155:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 123.206.0.153:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 200.119.117.84:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 204.193.96.143:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 113.60.202.64:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 220.194.189.61:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 114.155.128.9:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 140.194.154.86:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 170.183.238.173:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 219.11.178.81:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 160.199.28.206:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 126.190.112.231:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 209.83.78.8:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 220.100.208.21:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 70.8.39.231:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 204.241.64.75:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 135.127.31.107:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 176.197.24.15:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 4.105.194.104:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 147.174.223.96:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 183.86.142.69:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 76.103.156.248:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 166.47.32.216:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 100.231.57.156:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 98.2.167.54:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 25.98.139.162:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 142.245.211.81:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 2.171.131.101:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 128.91.11.72:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 98.23.202.150:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 131.59.137.90:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 110.127.55.120:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 182.48.192.223:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 121.80.248.248:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 211.36.214.171:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 85.127.190.240:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 195.202.87.49:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 84.215.205.23:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 141.252.79.82:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 133.83.160.67:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 19.114.99.138:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 89.196.144.73:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 114.18.237.47:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 160.140.3.136:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 217.70.100.0:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 63.185.62.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 44.141.79.1:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 115.133.40.74:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 189.175.238.219:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 154.2.162.247:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 136.129.172.25:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 146.117.224.2:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 116.135.17.118:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 84.80.225.94:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 147.172.160.10:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 207.185.199.212:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 110.179.0.100:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 141.142.150.87:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 155.231.198.149:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 111.70.181.140:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 107.181.47.231:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 18.97.145.98:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 154.137.222.57:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 132.32.206.30:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 105.254.191.87:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 95.86.103.42:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 54.22.235.85:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 175.201.121.25:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 152.103.151.196:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 87.63.169.64:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 148.94.49.231:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 146.37.169.69:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 66.94.87.170:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 181.114.44.247:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 199.118.57.140:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 95.11.187.223:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 120.142.53.231:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 189.133.33.13:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 179.60.125.237:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 73.16.214.71:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 97.153.184.14:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 212.204.12.178:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 208.74.22.136:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 122.238.156.205:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 70.74.20.167:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 137.254.191.209:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 205.157.36.42:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 168.170.246.98:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 122.5.46.174:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 66.253.61.211:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 146.139.222.145:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 66.89.117.144:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 44.96.156.4:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 162.165.247.212:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 204.115.174.246:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 8.159.184.187:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 121.59.165.157:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 54.162.27.161:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 111.161.84.55:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 206.31.112.189:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 174.197.158.176:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 78.141.184.23:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 49.58.137.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 39.85.98.57:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 176.28.93.54:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 37.147.6.216:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 142.204.180.18:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 145.205.44.111:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 167.222.89.211:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 79.179.208.116:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 180.67.186.189:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 210.158.65.121:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 92.162.116.102:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 57.182.213.247:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 23.81.161.14:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 147.232.120.118:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 46.151.65.252:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 31.177.66.184:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 5.0.100.46:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 95.183.94.168:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 67.65.158.206:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 31.207.210.124:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 23.155.244.228:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 137.70.240.97:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 207.244.181.165:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 1.41.246.103:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 122.193.20.138:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 35.255.205.49:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 163.218.66.21:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 141.167.132.123:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 71.80.192.179:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 220.214.131.179:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 175.144.220.229:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 205.108.12.88:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 94.155.232.80:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 106.191.228.53:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 223.229.81.171:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 197.148.14.22:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 1.19.236.136:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 100.150.244.7:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 72.6.90.91:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 72.79.247.209:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 78.237.185.104:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 128.187.247.109:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 165.221.25.201:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 23.235.73.23:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 40.59.61.177:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 132.221.57.84:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 150.124.102.226:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 160.151.12.8:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 179.154.49.160:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 1.237.115.214:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 63.17.205.12:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 133.141.193.208:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 106.233.243.254:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 51.68.62.243:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 166.175.141.14:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 183.53.168.207:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 116.18.191.217:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 207.194.178.225:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 202.187.122.208:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 151.148.220.90:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 202.226.244.186:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 168.187.173.41:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 139.178.250.35:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 105.37.137.25:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 38.255.33.176:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 204.49.172.155:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 19.122.25.107:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 93.134.252.135:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 199.121.207.190:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 42.26.48.82:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 203.174.11.177:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 108.207.53.204:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 96.114.170.143:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 13.233.223.219:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 222.197.193.223:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 143.225.10.216:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 84.230.155.186:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 131.32.102.247:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 113.39.64.153:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 217.130.16.55:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 5.27.58.130:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 118.6.188.143:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 25.115.99.248:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 164.137.191.43:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 80.17.214.230:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 197.4.141.234:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 111.80.211.146:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 205.18.73.36:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 112.173.168.135:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 187.3.179.178:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 173.152.80.164:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 19.183.29.175:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 163.175.64.148:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 146.153.167.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 126.111.85.84:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 36.15.98.130:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 87.26.199.157:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 103.221.40.38:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 27.6.224.140:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 168.49.157.21:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 132.217.124.71:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 142.81.159.194:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 63.138.56.52:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 183.182.46.219:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 82.145.197.207:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 8.60.247.2:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 136.128.117.53:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 121.145.46.108:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 135.109.84.72:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 152.97.2.251:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 140.28.205.255:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 181.17.137.196:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 178.168.105.141:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 141.93.135.16:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 97.239.254.169:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 159.25.137.222:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 126.189.125.162:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 202.188.17.97:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 190.28.147.33:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 79.116.102.97:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 14.94.114.89:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 131.51.0.124:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 158.203.178.94:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 156.133.66.182:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 175.69.34.92:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 81.13.140.170:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 116.217.57.168:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 162.162.41.169:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 176.70.189.47:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 107.202.27.145:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 206.213.36.114:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 143.22.171.13:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 155.35.246.80:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 96.76.115.15:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 156.197.177.73:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 110.103.78.175:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 149.253.208.68:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 208.6.58.2:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 65.238.33.251:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 173.134.144.41:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 68.176.249.227:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 126.230.47.156:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 63.197.132.127:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 63.45.39.201:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 32.39.5.155:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 206.58.27.206:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 153.135.3.86:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 130.232.198.109:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 197.142.155.211:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 51.137.43.232:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 147.86.13.227:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 19.32.203.81:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 219.117.102.70:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 67.238.210.124:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 136.1.45.47:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 176.72.129.239:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 141.30.180.125:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 133.216.101.195:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 150.70.70.90:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 49.226.63.255:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 171.188.45.145:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 13.123.153.163:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 37.113.204.185:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 31.162.214.91:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 94.180.250.241:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 131.237.103.193:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 74.196.88.3:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 38.37.94.142:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 138.141.163.140:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 134.112.82.39:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 31.250.158.16:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 173.130.118.162:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 223.88.1.55:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 75.61.104.74:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 85.161.180.41:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 153.111.148.80:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 106.71.210.230:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 14.182.180.42:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 153.81.63.250:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 35.53.117.13:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 181.91.94.118:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 48.66.145.199:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 155.131.106.42:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 135.129.44.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 34.133.36.251:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 98.92.198.113:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 136.249.161.89:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 100.192.218.55:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 216.173.89.85:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 96.186.165.38:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 211.83.174.21:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 147.27.32.167:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 139.140.48.176:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 188.130.90.172:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 17.217.29.246:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 17.40.101.71:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 19.12.249.122:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 43.68.236.48:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 147.157.27.46:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 169.16.12.115:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 221.80.18.110:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 25.221.224.38:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 160.239.114.93:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 178.13.14.96:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 122.33.167.52:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 70.170.48.209:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 207.27.182.146:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 169.151.150.66:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 210.100.169.215:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 9.108.82.166:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 181.37.232.113:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 164.44.181.247:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 86.148.205.80:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 99.67.30.169:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 37.167.172.135:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 206.115.123.50:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 123.185.186.149:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 27.194.34.21:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 71.40.85.5:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 161.187.199.109:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 178.138.185.102:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 25.186.248.167:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 140.155.239.245:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 208.191.148.57:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 12.26.184.119:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 199.50.19.180:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 104.88.31.49:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 76.192.11.207:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 128.203.195.44:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 157.23.190.67:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 79.231.183.150:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 36.87.191.123:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 123.173.255.253:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 148.80.2.221:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 67.209.90.206:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 40.33.43.255:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 171.145.78.156:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 51.12.30.79:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 110.155.144.208:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 179.132.198.68:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 212.240.57.169:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 222.97.69.45:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 71.188.1.124:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 58.56.29.236:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 136.137.250.55:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 220.134.234.179:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 160.129.245.229:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 92.71.157.114:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 66.177.98.117:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 42.35.229.218:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 98.73.115.238:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 194.24.134.43:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 74.11.156.239:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 34.48.228.118:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 135.189.118.10:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 137.94.18.77:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 24.100.115.231:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 91.239.224.94:2323
Source: global traffic TCP traffic: 192.168.2.23:64083 -> 23.211.112.177:2323
Sample listens on a socket
Source: /tmp/botnet.x86.elf (PID: 6237) Socket: 0.0.0.0:1230 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.208.184.54
Source: unknown TCP traffic detected without corresponding DNS query: 193.122.255.185
Source: unknown TCP traffic detected without corresponding DNS query: 163.140.97.46
Source: unknown TCP traffic detected without corresponding DNS query: 82.22.142.207
Source: unknown TCP traffic detected without corresponding DNS query: 151.72.19.145
Source: unknown TCP traffic detected without corresponding DNS query: 191.71.179.16
Source: unknown TCP traffic detected without corresponding DNS query: 42.117.137.53
Source: unknown TCP traffic detected without corresponding DNS query: 147.148.80.151
Source: unknown TCP traffic detected without corresponding DNS query: 150.248.171.209
Source: unknown TCP traffic detected without corresponding DNS query: 59.75.15.247
Source: unknown TCP traffic detected without corresponding DNS query: 99.39.166.254
Source: unknown TCP traffic detected without corresponding DNS query: 199.106.252.152
Source: unknown TCP traffic detected without corresponding DNS query: 200.127.88.232
Source: unknown TCP traffic detected without corresponding DNS query: 117.63.194.107
Source: unknown TCP traffic detected without corresponding DNS query: 35.194.219.49
Source: unknown TCP traffic detected without corresponding DNS query: 117.131.220.155
Source: unknown TCP traffic detected without corresponding DNS query: 187.167.48.112
Source: unknown TCP traffic detected without corresponding DNS query: 105.145.148.162
Source: unknown TCP traffic detected without corresponding DNS query: 182.151.34.58
Source: unknown TCP traffic detected without corresponding DNS query: 72.225.239.180
Source: unknown TCP traffic detected without corresponding DNS query: 1.228.201.174
Source: unknown TCP traffic detected without corresponding DNS query: 203.148.55.124
Source: unknown TCP traffic detected without corresponding DNS query: 61.90.134.173
Source: unknown TCP traffic detected without corresponding DNS query: 206.60.77.202
Source: unknown TCP traffic detected without corresponding DNS query: 44.180.77.161
Source: unknown TCP traffic detected without corresponding DNS query: 42.116.102.235
Source: unknown TCP traffic detected without corresponding DNS query: 12.149.72.232
Source: unknown TCP traffic detected without corresponding DNS query: 139.242.163.102
Source: unknown TCP traffic detected without corresponding DNS query: 5.149.220.148
Source: unknown TCP traffic detected without corresponding DNS query: 52.154.144.253
Source: unknown TCP traffic detected without corresponding DNS query: 173.83.195.216
Source: unknown TCP traffic detected without corresponding DNS query: 50.104.251.173
Source: unknown TCP traffic detected without corresponding DNS query: 220.241.24.251
Source: unknown TCP traffic detected without corresponding DNS query: 126.90.104.118
Source: unknown TCP traffic detected without corresponding DNS query: 8.114.154.134
Source: unknown TCP traffic detected without corresponding DNS query: 125.235.67.3
Source: unknown TCP traffic detected without corresponding DNS query: 205.149.125.23
Source: unknown TCP traffic detected without corresponding DNS query: 48.38.206.211
Source: unknown TCP traffic detected without corresponding DNS query: 101.48.190.127
Source: unknown TCP traffic detected without corresponding DNS query: 32.211.78.239
Source: unknown TCP traffic detected without corresponding DNS query: 179.199.125.245
Source: unknown TCP traffic detected without corresponding DNS query: 129.63.177.248
Source: unknown TCP traffic detected without corresponding DNS query: 85.234.133.85
Source: unknown TCP traffic detected without corresponding DNS query: 144.149.248.34
Source: unknown TCP traffic detected without corresponding DNS query: 78.38.118.176
Source: unknown TCP traffic detected without corresponding DNS query: 97.75.7.34
Source: unknown TCP traffic detected without corresponding DNS query: 97.170.98.207
Source: unknown TCP traffic detected without corresponding DNS query: 9.106.179.247
Source: unknown TCP traffic detected without corresponding DNS query: 177.18.81.214
Source: botnet.x86.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: botnet.x86.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x400000
Yara signature match
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: botnet.x86.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 4.24 Copyright (C) 1996-2024 the UPX Team. All Rights Reserved. $
Executes commands using a shell command-line interpreter
Source: /tmp/botnet.x86.elf (PID: 6238) Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/botnet.x86.elf bin/watchdog; chmod 777 bin/watchdog" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6242) Chmod executable: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6240) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6239) Rm executable: /usr/bin/rm -> rm -rf bin/watchdog Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 6242) File: /tmp/bin/watchdog (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6242) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: botnet.x86.elf Submission file: segment LOAD with 7.8131 entropy (max. 8.0)
Source: botnet.x86.elf Submission file: segment LOAD with 7.9646 entropy (max. 8.0)

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 6237, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 6237, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Mirai
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Yara detected Mirai
Source: Yara match File source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 6237, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: 6237.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.x86.elf PID: 6237, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
86.134.73.171
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
190.78.232.214
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
17.149.83.149
 unknown United States
714 APPLE-ENGINEERINGUS false
59.2.135.96
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
138.53.95.149
 unknown United States
2611 BELNETBE false
142.202.19.72
 unknown Reserved
53831 SQUARESPACEUS false
14.99.21.127
 unknown India
45820 TTSL-MEISISPTataTeleservicesISPASIN false
77.183.61.127
 unknown Germany
6805 TDDE-ASN1DE false
116.247.15.177
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
209.158.5.196
 unknown United States
701 UUNETUS false
131.182.31.103
 unknown United States
270 AS270US false
176.202.250.41
 unknown Qatar
8781 QA-ISPQA false
205.140.253.161
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
114.114.181.10
 unknown China
134700 SINOYCLOUD-AS-APSinoycloudLimitedHK false
208.62.104.107
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
41.143.59.158
 unknown Morocco
36903 MT-MPLSMA false
81.40.169.234
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
24.97.155.254
 unknown United States
11351 TWC-11351-NORTHEASTUS false
156.1.114.135
 unknown United States
22226 SFUSDUS false
95.216.40.126
 unknown Germany
24940 HETZNER-ASDE false
158.212.204.141
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
205.55.89.43
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
124.141.42.140
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
75.48.155.227
 unknown United States
7018 ATT-INTERNET4US false
108.227.137.123
 unknown United States
7018 ATT-INTERNET4US false
188.233.227.155
 unknown Russian Federation
56420 RYAZAN-ASRU false
109.195.68.28
 unknown Russian Federation
50544 KRSK-ASRU false
5.4.205.218
 unknown Germany
6805 TDDE-ASN1DE false
164.208.97.216
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
18.191.196.88
 unknown United States
16509 AMAZON-02US false
97.194.165.223
 unknown United States
6167 CELLCO-PARTUS false
14.94.114.89
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
220.68.86.180
 unknown Korea Republic of
9970 KUT-ASKoreaUniversityofTechnologyandEducationKR false
189.110.252.175
 unknown Brazil
27699 TELEFONICABRASILSABR false
112.238.105.243
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
78.110.15.25
 unknown Saudi Arabia
50880 SEVENI-ASSA false
210.188.144.65
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
208.61.105.0
 unknown United States
7018 ATT-INTERNET4US false
206.39.242.201
 unknown United States
386 AFCONC-BLOCK1-ASUS false
170.63.219.106
 unknown United States
6527 MASSACHUSETTSUS false
153.79.128.166
 unknown United States
14962 NCR-252US false
156.64.215.197
 unknown United States
29975 VODACOM-ZA false
38.38.237.129
 unknown United States
174 COGENT-174US false
149.80.128.98
 unknown United States
188 SAIC-ASUS false
102.197.25.2
 unknown unknown
36926 CKL1-ASNKE false
5.17.148.30
 unknown Russian Federation
41733 ZTELECOM-ASRU false
107.206.41.240
 unknown United States
7018 ATT-INTERNET4US false
136.90.234.30
 unknown United States
60311 ONEFMCH false
43.14.154.113
 unknown Japan 4249 LILLY-ASUS false
64.128.147.181
 unknown United States
3549 LVLT-3549US false
158.52.60.217
 unknown United States
11757 WHIRLPOOL-ASNUS false
52.176.76.226
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
66.106.147.154
 unknown United States
2828 XO-AS15US false
42.62.141.131
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
158.209.182.140
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
13.192.103.78
 unknown United States
7018 ATT-INTERNET4US false
98.218.71.173
 unknown United States
7922 COMCAST-7922US false
142.171.104.21
 unknown Canada
7122 MTS-ASNCA false
42.116.102.235
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
31.246.217.71
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
126.0.70.33
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
135.115.50.83
 unknown United States
10455 LUCENT-CIOUS false
178.152.70.76
 unknown Qatar
42298 GCC-MPLS-PEERINGGCCMPLSpeeringQA false
89.57.6.170
 unknown Germany
5430 FREENETDEfreenetDatenkommunikationsGmbHDE false
205.104.130.208
 unknown United States
721 DNIC-ASBLK-00721-00726US false
162.121.130.203
 unknown United States
19708 UNASSIGNED false
89.18.142.24
 unknown Russian Federation
15930 WIPLINE-ASRU false
73.24.133.161
 unknown United States
7922 COMCAST-7922US false
201.89.64.120
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
152.203.166.164
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
161.111.113.136
 unknown Spain
766 REDIRISRedIRISAutonomousSystemES false
196.19.248.137
 unknown Seychelles
134451 NME-INDONESIA-AS-APNewMediaExpressPteLtdID false
69.52.228.181
 unknown United States
31747 BLACKROCK-FINANCIAL-MANAGEMENT-2US false
136.184.130.4
 unknown United States
13540 LIBERTY-MUTUALUS false
41.172.161.8
 unknown South Africa
36937 Neotel-ASZA false
196.179.94.207
 unknown Tunisia
37693 TUNISIANATN false
49.40.34.87
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
39.237.142.19
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
40.217.25.151
 unknown United States
4249 LILLY-ASUS false
220.9.15.238
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
155.242.16.113
 unknown United States
11845 Vox-TelecomZA false
32.128.22.155
 unknown United States
2686 ATGS-MMD-ASUS false
53.30.216.122
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
158.230.131.218
 unknown United Kingdom
2830 MCI-DUAL-HOMED-CUSTOMERSGB false
177.1.139.202
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
91.221.158.190
 unknown Poland
39507 IPIVISION-ASPL false
151.128.106.44
 unknown United States
45025 EDN-ASUA false
20.146.77.127
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
9.189.118.84
 unknown United States
3356 LEVEL3US false
72.165.134.213
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
104.222.175.9
 unknown United States
13886 CLOUD-SOUTHUS false
17.127.196.112
 unknown United States
714 APPLE-ENGINEERINGUS false
179.62.253.121
 unknown Argentina
27983 RedIntercableDigitalSAAR false
165.243.141.193
 unknown Korea Republic of
4668 LGNET-AS-KRLGCNSKR false
108.232.216.70
 unknown United States
7018 ATT-INTERNET4US false
147.189.131.57
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
184.169.72.99
 unknown United States
6621 HNS-DIRECPCUS false
148.135.170.155
 unknown Sweden
158 ERI-ASUS false
152.66.81.209
 unknown Hungary
2547 BMENET-ASBudapestUniversityofTechnologyandEconomicsE false
135.183.145.238
 unknown United States
10455 LUCENT-CIOUS false