Linux Analysis Report botnet.spc.elf

Malicious sample detected (through community Yara rule)

Source: unknown	TCP traffic detected without corresponding DNS query: 170.99.191.184
Source: unknown	TCP traffic detected without corresponding DNS query: 63.245.76.109
Source: unknown	TCP traffic detected without corresponding DNS query: 189.243.225.58
Source: unknown	TCP traffic detected without corresponding DNS query: 75.23.236.178
Source: unknown	TCP traffic detected without corresponding DNS query: 71.140.5.194
Source: unknown	TCP traffic detected without corresponding DNS query: 183.166.18.39
Source: unknown	TCP traffic detected without corresponding DNS query: 207.44.169.187
Source: unknown	TCP traffic detected without corresponding DNS query: 112.115.236.105
Source: unknown	TCP traffic detected without corresponding DNS query: 76.189.213.137
Source: unknown	TCP traffic detected without corresponding DNS query: 107.33.148.114
Source: unknown	TCP traffic detected without corresponding DNS query: 128.173.56.193
Source: unknown	TCP traffic detected without corresponding DNS query: 60.109.82.151
Source: unknown	TCP traffic detected without corresponding DNS query: 137.217.240.108
Source: unknown	TCP traffic detected without corresponding DNS query: 211.14.125.154
Source: unknown	TCP traffic detected without corresponding DNS query: 143.16.154.89
Source: unknown	TCP traffic detected without corresponding DNS query: 111.168.107.177
Source: unknown	TCP traffic detected without corresponding DNS query: 18.44.45.149
Source: unknown	TCP traffic detected without corresponding DNS query: 12.60.72.250
Source: unknown	TCP traffic detected without corresponding DNS query: 209.91.207.99
Source: unknown	TCP traffic detected without corresponding DNS query: 80.247.116.231
Source: unknown	TCP traffic detected without corresponding DNS query: 121.239.107.0
Source: unknown	TCP traffic detected without corresponding DNS query: 218.131.214.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.195.250.252
Source: unknown	TCP traffic detected without corresponding DNS query: 201.85.178.115
Source: unknown	TCP traffic detected without corresponding DNS query: 108.201.88.211
Source: unknown	TCP traffic detected without corresponding DNS query: 216.255.115.184
Source: unknown	TCP traffic detected without corresponding DNS query: 122.181.34.115
Source: unknown	TCP traffic detected without corresponding DNS query: 118.203.19.251
Source: unknown	TCP traffic detected without corresponding DNS query: 208.108.139.17
Source: unknown	TCP traffic detected without corresponding DNS query: 138.221.212.216
Source: unknown	TCP traffic detected without corresponding DNS query: 218.179.234.252
Source: unknown	TCP traffic detected without corresponding DNS query: 175.121.35.197
Source: unknown	TCP traffic detected without corresponding DNS query: 81.51.225.186
Source: unknown	TCP traffic detected without corresponding DNS query: 220.100.238.218
Source: unknown	TCP traffic detected without corresponding DNS query: 143.69.218.3
Source: unknown	TCP traffic detected without corresponding DNS query: 104.174.125.175
Source: unknown	TCP traffic detected without corresponding DNS query: 221.83.60.60
Source: unknown	TCP traffic detected without corresponding DNS query: 216.5.130.253
Source: unknown	TCP traffic detected without corresponding DNS query: 72.147.178.118
Source: unknown	TCP traffic detected without corresponding DNS query: 156.172.76.100
Source: unknown	TCP traffic detected without corresponding DNS query: 92.109.176.211
Source: unknown	TCP traffic detected without corresponding DNS query: 51.125.12.153
Source: unknown	TCP traffic detected without corresponding DNS query: 50.149.36.89
Source: unknown	TCP traffic detected without corresponding DNS query: 76.248.177.4
Source: unknown	TCP traffic detected without corresponding DNS query: 218.178.213.36
Source: unknown	TCP traffic detected without corresponding DNS query: 175.159.16.191
Source: unknown	TCP traffic detected without corresponding DNS query: 106.104.173.109
Source: unknown	TCP traffic detected without corresponding DNS query: 148.18.151.61
Source: unknown	TCP traffic detected without corresponding DNS query: 98.58.248.145
Source: unknown	TCP traffic detected without corresponding DNS query: 186.19.239.6

System Summary

Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: botnet.spc.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@0/0

Executes commands using a shell command-line interpreter

Source: /tmp/botnet.spc.elf (PID: 5434)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/botnet.spc.elf bin/systemd; chmod 777 bin/systemd"

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 5443)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 5441)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5440)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Sample tries to set the executable flag

Source: /usr/bin/chmod (PID: 5443)

File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx)

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 5443)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/botnet.spc.elf (PID: 5432)

Queries kernel information via 'uname':

Source: botnet.spc.elf, 5432.1.0000557bcd895000.0000557bcd91a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: botnet.spc.elf, 5432.1.00007ffe43221000.00007ffe43242000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/botnet.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/botnet.spc.elf
Source: botnet.spc.elf, 5432.1.0000557bcd895000.0000557bcd91a000.rw-.sdmp	Binary or memory string: {U!/etc/qemu-binfmt/sparc
Source: botnet.spc.elf, 5432.1.00007ffe43221000.00007ffe43242000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Source: Yara match	File source: botnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR

Source: Yara match	File source: botnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Source: Yara match	File source: botnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR

Antivirus / Scanner detection for submitted sample

Source: Yara match	File source: botnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
170.66.217.97	unknown	Brazil	11993	BANCODOBRASILSABR	false
62.67.141.40	unknown	United Kingdom	44521	JAGEX-ASGB	false
223.84.206.117	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
221.209.74.255	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
14.0.148.1	unknown	Hong Kong	38819	HKCSL-AS-APHKCSLGPRSNETWORKHK	false
216.64.133.168	unknown	United States	3549	LVLT-3549US	false
12.3.217.232	unknown	United States	7018	ATT-INTERNET4US	false
122.115.144.121	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
61.163.196.142	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
152.137.232.84	unknown	United States	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
156.6.251.92	unknown	United States	29975	VODACOM-ZA	false
155.15.159.184	unknown	Canada	40155	APLLIUS	false
164.242.33.99	unknown	United States	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
118.245.96.165	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
192.231.16.78	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
145.122.114.170	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
81.32.155.103	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
103.147.32.44	unknown	unknown	139944	IDNIC-GIMCLOUD-AS-IDPTGlobalIndoMultimediaID	false
172.212.78.170	unknown	United States	18747	IFX18747US	false
39.205.24.40	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
193.2.192.118	unknown	Slovenia	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false
181.206.116.200	unknown	Colombia	27831	ColombiaMovilCO	false
133.97.175.103	unknown	Japan	58652	KOCHI-U-NETKochiUniversityJP	false
142.246.223.125	unknown	Canada	395272	PCMCA	false
102.209.9.225	unknown	unknown	36926	CKL1-ASNKE	false
187.55.95.125	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
60.50.250.16	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
172.54.117.68	unknown	United States	21928	T-MOBILE-AS21928US	false
129.251.187.32	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
113.71.101.13	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
198.216.25.231	unknown	United States	3354	THENET-AS-3354US	false
198.111.4.228	unknown	United States	237	MERIT-AS-14US	false
81.174.123.124	unknown	Italy	3313	INET-ASIT	false
219.158.199.211	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
76.236.195.164	unknown	United States	7018	ATT-INTERNET4US	false
213.128.252.245	unknown	United Kingdom	5564	SOL-ASCommercialinternetserviceproviderGB	false
38.247.92.173	unknown	United States	174	COGENT-174US	false
205.198.60.210	unknown	United States	133613	MTEL-ASMTeltelecommunicationcompanyltdMO	false
143.249.63.234	unknown	United States	1781	KAIST-DAEJEON-AS-KRKoreaAdvancedInstituteofScienceand	false
117.159.133.119	unknown	China	24445	CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN	false
50.156.229.135	unknown	United States	7922	COMCAST-7922US	false
167.238.3.170	unknown	United States	36092	CENTENEUS	false
217.162.64.180	unknown	Switzerland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
49.224.212.93	unknown	New Zealand	9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
37.120.192.49	unknown	Romania	9009	M247GB	false
193.210.182.10	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
189.203.132.253	unknown	Mexico	17072	TOTALPLAYTELECOMUNICACIONESSADECVMX	false
50.163.196.130	unknown	United States	7922	COMCAST-7922US	false
47.49.169.53	unknown	United States	20115	CHARTER-20115US	false
53.111.158.23	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
75.215.63.156	unknown	United States	22394	CELLCOUS	false
200.50.65.213	unknown	Barbados	11992	CENTENNIAL-PR	false
13.192.127.228	unknown	United States	7018	ATT-INTERNET4US	false
102.171.34.243	unknown	Tunisia	37693	TUNISIANATN	false
167.236.102.184	unknown	United States	19400	SPX-FLOW-ASUS	false
205.167.189.125	unknown	United States	3549	LVLT-3549US	false
104.42.226.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
72.242.215.117	unknown	United States	7029	WINDSTREAMUS	false
31.58.72.216	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
136.112.152.1	unknown	United States	15169	GOOGLEUS	false
97.124.33.190	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
129.104.140.92	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
126.204.118.53	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
178.122.154.9	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
114.189.90.63	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
102.183.193.164	unknown	Liberia	37611	AfrihostZA	false
62.18.128.82	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
13.228.165.201	unknown	United States	16509	AMAZON-02US	false
81.17.208.38	unknown	Germany	35833	MPEXNETDE	false
135.158.112.194	unknown	United States	14962	NCR-252US	false
194.74.33.252	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
169.122.153.99	unknown	United States	37611	AfrihostZA	false
41.152.208.107	unknown	Egypt	36992	ETISALAT-MISREG	false
207.233.196.250	unknown	United States	8010	DIGICON-CORPUS	false
67.35.224.247	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
144.130.142.37	unknown	Australia	4637	ASN-TELSTRA-GLOBALTelstraGlobalHK	false
197.96.14.166	unknown	South Africa	3741	ISZA	false
148.72.164.193	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	false
177.232.254.56	unknown	Mexico	13591	MexicoReddeTelecomunicacionesSdeRLdeCVMX	false
160.233.238.60	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
157.127.157.182	unknown	United States	1906	NORTHROP-GRUMMANUS	false
75.43.169.30	unknown	United States	7018	ATT-INTERNET4US	false
223.94.206.217	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false
70.176.240.3	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
97.123.103.164	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
196.161.90.8	unknown	South Africa	328065	Vast-Networks-ASZA	false
137.229.73.73	unknown	United States	7774	ALASKAUS	false
156.10.120.140	unknown	Finland	39098	BOF-ASFI	false
68.146.122.140	unknown	Canada	6327	SHAWCA	false
157.74.76.42	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
159.131.65.11	unknown	United States	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
133.130.7.157	unknown	Japan	58791	GMOOSK-NETGMOInternetIncJP	false
142.80.170.35	unknown	Canada	5769	VIDEOTRONCA	false
203.138.252.22	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
107.216.2.7	unknown	United States	7018	ATT-INTERNET4US	false
156.87.87.235	unknown	United States	10695	WAL-MARTUS	false
193.236.12.143	unknown	Portugal	3218	COSMOS-3218-ASAS-COSMOSrootRU	false
203.143.16.200	unknown	Sri Lanka	5087	LANKA-COMLankaCommunicationServicesLK	false
159.46.232.247	unknown	Netherlands	29311	SOLVINITY-NL	false
37.159.201.170	unknown	Italy	30722	VODAFONE-IT-ASNIT	false

AV Detection

Source: botnet.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: botnet.spc.elf

ReversingLabs: Detection: 68%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44624 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44622 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44882 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44890 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44896 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44902 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44908 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44918 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44924 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44930 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44936 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44940 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44946 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:44944 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45200 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45206 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45210 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45220 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45216 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45222 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45224 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45228 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45230 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45314 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45316 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45320 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45328 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45414 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45450 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45470 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45478 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45520 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45538 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45544 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45550 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45558 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45570 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45644 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45648 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45718 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45722 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45778 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45782 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45784 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45832 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45834 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45836 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45848 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45858 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45872 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45876 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45974 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:45978 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46012 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46048 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46050 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46088 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46100 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46102 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46104 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46134 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46148 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46152 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46198 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46222 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46292 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46330 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46332 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46360 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46384 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46382 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46386 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46412 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46418 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46432 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46436 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46500 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46508 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46530 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46574 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46576 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46646 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46662 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46664 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46698 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46700 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46706 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46754 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46780 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46808 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46816 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46904 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:46906 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47080 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47082 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47144 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47146 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47154 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47152 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47156 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47150 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47158 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47148 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47160 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47166 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47278 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47286 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47292 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47298 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:47654 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48106 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48196 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48322 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48444 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48460 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48458 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48462 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48466 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48468 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48464 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48472 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48470 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48474 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48476 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48478 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48480 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48484 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48482 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48486 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48490 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48492 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48496 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48494 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48488 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48498 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48500 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48502 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48580 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48620 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:48674 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49122 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49150 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49156 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49268 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49364 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49366 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49368 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49370 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49372 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49380 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49382 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49384 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49374 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49386 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49378 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49388 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49376 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49390 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:49544 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:50804 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51104 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51558 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51726 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51754 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51752 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51756 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51760 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51758 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51778 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51780 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51782 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51836 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:51890 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:52024 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:52178 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:52624 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:52764 -> 91.208.184.54:56744

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 170.99.191.184:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 137.217.240.108:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 18.44.45.149:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 220.100.238.218:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 92.109.176.211:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 208.58.186.33:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 186.172.244.21:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 164.100.110.183:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 40.72.142.150:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 178.211.221.13:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 49.171.1.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 118.28.56.237:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 88.5.48.205:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 166.47.46.171:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 91.162.238.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 130.158.80.17:2323
Source: global traffic	TCP traffic: 192.168.2.13:44622 -> 91.208.184.54:56744
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 42.147.10.169:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 137.174.126.150:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 129.168.213.118:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 118.185.78.16:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 116.149.27.22:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 123.89.13.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 115.243.26.13:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 76.94.29.94:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 158.51.156.64:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 184.34.242.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 137.220.70.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 54.113.24.186:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 60.23.122.39:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 124.16.99.233:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 85.80.83.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 208.225.157.174:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 202.128.220.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 23.43.174.128:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 175.18.8.207:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 81.248.165.149:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 23.65.222.58:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 211.162.195.17:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 72.40.246.224:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 180.249.213.231:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 74.131.49.33:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 99.181.185.18:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 101.158.166.0:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 92.108.33.147:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 101.141.72.44:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 148.162.176.173:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 160.175.223.125:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 38.4.111.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 220.128.64.239:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 23.218.251.253:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 81.51.156.199:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 144.144.123.168:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 69.168.112.9:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 31.2.23.119:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 101.229.234.44:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 191.2.238.173:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 78.69.39.140:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 41.166.252.235:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 97.114.11.96:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 197.241.179.23:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 206.57.24.67:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 149.77.251.119:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 41.48.175.131:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 63.14.151.227:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 37.30.239.59:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 4.132.245.87:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 128.93.212.77:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 103.230.123.166:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 202.169.64.87:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 148.103.84.98:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 156.125.165.35:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 126.15.91.228:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 83.138.107.151:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 217.150.240.26:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 156.192.5.93:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 191.189.122.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 37.155.96.178:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 116.158.129.13:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 84.6.205.132:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 96.171.220.0:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 186.128.230.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 195.9.68.46:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 119.38.133.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 217.86.6.163:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 2.112.119.54:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 128.172.183.15:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 67.124.80.215:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 68.170.178.128:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 64.55.128.115:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 187.23.194.66:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 94.246.197.34:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 117.134.187.5:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 200.94.232.216:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 149.217.90.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 196.221.140.25:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 220.203.95.67:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 118.243.183.47:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 124.46.141.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 63.49.184.152:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 210.214.230.75:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 38.41.164.175:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 102.81.47.240:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 166.129.95.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 24.32.70.69:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 200.129.119.56:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 18.148.210.108:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 139.57.221.163:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 32.80.227.29:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 103.77.189.183:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 27.254.68.86:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 115.0.250.59:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 94.47.100.69:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 170.69.207.151:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 198.94.128.85:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.128.235.37:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 190.151.247.231:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 52.45.205.70:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 69.63.216.213:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 87.108.1.219:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 62.147.56.99:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 133.176.231.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 77.237.171.104:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 193.19.143.168:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 14.205.209.50:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 218.103.95.176:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 174.135.188.225:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 173.38.203.74:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 162.133.43.152:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 97.81.95.21:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 24.80.19.241:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 63.57.208.182:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 216.105.198.239:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 54.230.179.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 93.17.58.251:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 96.145.137.230:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 9.120.197.153:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 219.1.142.197:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 165.171.174.36:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 81.215.106.193:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 43.232.76.97:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 126.156.41.14:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 188.130.194.233:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 108.126.67.83:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 4.79.229.148:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 97.3.178.164:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 37.88.105.74:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 220.56.94.212:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 162.201.84.242:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 200.198.9.78:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 167.58.26.24:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 119.80.82.24:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 159.176.217.55:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 177.148.131.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 19.97.130.51:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 68.198.255.196:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 197.140.1.75:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 44.142.194.254:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 136.4.234.240:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 125.127.173.121:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.61.64.78:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 65.17.204.165:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 191.40.193.160:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 202.122.11.208:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 36.113.213.104:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 213.63.135.72:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 150.171.92.84:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 27.225.138.29:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 203.161.248.164:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 212.163.69.150:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 90.190.139.24:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 207.180.197.37:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 159.56.113.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 167.1.108.220:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 53.115.0.218:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 14.163.181.25:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 78.52.137.243:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 201.198.101.44:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 109.73.244.58:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 124.20.115.133:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 199.109.233.32:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 198.27.190.162:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 222.213.57.236:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 203.124.75.42:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 126.141.167.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 40.31.175.230:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 118.28.78.105:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 61.103.249.228:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 106.174.150.193:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.91.76.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 32.180.89.168:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 120.41.1.116:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 113.221.243.40:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 53.20.53.223:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 83.254.187.50:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.109.238.233:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 219.202.248.123:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 209.215.23.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 200.123.177.186:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 36.73.22.127:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 208.173.31.76:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 207.187.139.78:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 65.136.202.13:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 114.245.12.242:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 85.226.34.97:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 146.68.11.233:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 144.169.213.96:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 154.193.203.194:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 211.140.13.218:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 182.12.201.137:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 218.129.127.108:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 112.20.121.141:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 205.106.102.83:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 2.108.185.123:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 151.64.105.32:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 112.81.8.211:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 157.208.11.195:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 210.185.225.53:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 89.227.71.184:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 95.52.87.182:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 171.128.252.14:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 213.158.19.220:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 198.223.201.129:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 103.138.214.27:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 133.112.91.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 40.121.104.100:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 135.133.102.99:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 41.160.113.72:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 8.192.15.41:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 149.110.26.235:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 78.185.254.49:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 222.125.80.151:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 176.201.163.222:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 32.129.104.89:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 129.250.67.223:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 72.56.2.205:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 111.198.214.102:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 181.65.10.136:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 150.24.188.243:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 142.162.75.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 90.177.90.200:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 103.46.198.135:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 161.223.50.11:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 104.31.124.8:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 20.148.110.18:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 170.27.45.216:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 68.184.192.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 66.8.140.140:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 145.72.117.220:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 199.254.191.2:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 216.253.39.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 60.246.209.158:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 47.253.226.225:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 154.98.166.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 201.91.189.159:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 178.30.101.185:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 196.208.219.69:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 182.208.70.243:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 77.108.83.60:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 18.193.241.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 25.223.137.6:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 199.215.187.107:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 74.5.66.70:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 123.9.239.14:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 196.15.47.134:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 141.42.36.191:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 49.255.192.138:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 5.78.212.110:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 179.141.22.173:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 43.190.118.159:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 151.231.144.166:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 69.169.21.121:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 24.132.176.36:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 129.29.144.84:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 189.255.105.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 210.250.4.113:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 90.156.27.105:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 99.54.118.162:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 155.12.63.73:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 47.199.159.165:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 13.78.47.200:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 48.155.90.250:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 109.189.199.120:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 223.252.151.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 98.130.107.57:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 32.95.44.58:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 212.150.227.155:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 70.187.35.242:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 60.81.115.175:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 54.238.153.18:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 162.158.78.199:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 156.13.58.119:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 163.160.161.201:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 108.151.13.165:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 188.13.49.43:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 128.25.8.100:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 73.132.82.166:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 58.98.28.212:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 90.201.221.72:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 125.14.240.161:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 115.182.36.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 2.70.236.22:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 216.151.171.214:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 2.9.167.77:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 44.213.63.62:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 89.143.131.18:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 159.13.122.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 114.246.42.76:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 5.222.41.230:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 57.101.211.131:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 61.143.162.164:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 87.255.90.101:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 121.35.39.180:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 177.131.122.99:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 107.245.252.137:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 79.245.73.215:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 180.49.153.73:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 191.136.12.94:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 132.152.88.92:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 134.114.182.47:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 110.23.193.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 175.200.170.56:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 4.168.254.48:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 166.59.19.133:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 177.56.201.43:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 115.202.153.144:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 221.9.216.0:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 216.243.149.116:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 213.98.208.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 1.176.215.134:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 19.57.170.162:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 77.169.218.139:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 121.26.167.188:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 92.10.172.144:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 153.151.55.23:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 5.243.25.134:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 171.210.132.125:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 121.213.179.189:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 2.45.14.202:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 115.73.106.23:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 152.188.136.214:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 145.40.249.99:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 110.145.62.43:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 193.243.210.136:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 116.213.79.238:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 66.180.16.185:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.243.101.1:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 65.197.253.118:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 77.25.114.139:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 190.14.158.125:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 198.160.72.37:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 84.191.88.182:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 164.140.145.122:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 93.99.102.98:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 204.183.206.89:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 220.107.167.176:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 154.211.244.236:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 163.11.22.219:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 20.247.105.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 135.23.183.66:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 83.79.24.121:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 161.240.201.254:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 42.218.98.8:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 117.181.230.151:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 72.134.71.141:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 46.160.220.14:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 17.107.25.214:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 49.47.167.11:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 103.53.11.53:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 140.82.187.9:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 166.75.237.105:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 148.194.41.144:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 113.49.11.125:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 111.162.62.98:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 211.250.46.78:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 87.32.127.10:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 140.112.238.89:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 80.233.195.192:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 31.155.118.117:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 156.237.160.150:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 12.58.110.79:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 2.221.153.19:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 47.19.4.151:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 132.224.70.113:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 117.245.79.139:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 101.111.185.109:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 149.71.95.31:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 140.5.143.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 84.65.102.150:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 87.79.77.105:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 63.204.191.202:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 169.217.8.88:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 24.81.128.141:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 14.126.59.187:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 76.54.117.28:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 173.38.19.165:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 66.85.138.17:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 146.139.40.202:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 37.138.225.107:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.166.14.1:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 41.44.32.61:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 175.135.79.108:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 209.7.25.156:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 177.2.22.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 39.23.244.120:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 202.6.40.24:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 189.9.19.228:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 175.107.151.123:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 98.20.189.111:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 70.225.253.143:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 217.136.192.227:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 157.18.72.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 23.211.218.131:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 149.165.133.144:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 221.223.222.65:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 196.59.137.179:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 27.30.174.144:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 140.51.122.202:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 60.100.117.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 199.227.120.58:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 75.80.158.179:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 194.132.27.196:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 143.93.1.147:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 115.238.164.105:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 159.42.198.234:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 135.83.235.4:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 152.181.159.36:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 87.48.199.134:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 95.212.140.229:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 131.143.109.67:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 188.101.51.182:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 187.113.147.176:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 162.48.110.65:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 189.73.144.178:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 25.205.196.239:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 50.84.93.25:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 99.140.48.13:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 178.24.101.74:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 152.28.191.187:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 96.224.91.167:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 82.50.105.17:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 181.125.237.41:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 114.106.102.3:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 211.42.90.91:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 62.107.6.227:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 32.205.160.177:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.253.143.146:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 218.90.21.65:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 2.255.166.174:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 110.24.248.51:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 23.39.173.49:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 124.199.139.106:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 103.98.122.92:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 128.64.95.176:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 159.254.72.60:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 190.166.5.131:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 216.101.137.172:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 77.175.238.220:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 96.235.127.56:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 161.59.117.161:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 66.11.54.179:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 63.4.59.146:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 84.102.12.84:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 165.108.106.154:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 149.121.67.88:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 58.109.198.6:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 184.68.168.126:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 141.240.134.239:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 45.77.24.124:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 155.42.254.229:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 152.80.90.40:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 151.244.188.212:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 67.191.144.89:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 112.255.84.52:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 49.224.17.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 36.50.191.230:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 54.230.55.189:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 35.248.148.80:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 93.98.163.93:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 105.133.19.160:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 191.245.28.223:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 82.240.250.152:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 51.132.119.82:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 206.112.194.198:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 96.14.170.195:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 210.228.230.26:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 210.191.109.161:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 133.130.7.157:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 119.175.40.175:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 62.130.234.137:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 61.52.133.77:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 208.110.127.26:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 163.119.11.238:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 66.250.127.78:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 205.37.116.17:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 198.233.146.185:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 66.36.4.50:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 163.138.234.103:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 13.8.107.139:2323
Source: global traffic	TCP traffic: 192.168.2.13:19428 -> 107.23.26.57:2323

Sample listens on a socket

Source: /tmp/botnet.spc.elf (PID: 5432)

Socket: 0.0.0.0:1230

Malicious sample detected (through community Yara rule)

Source: unknown	TCP traffic detected without corresponding DNS query: 170.99.191.184
Source: unknown	TCP traffic detected without corresponding DNS query: 63.245.76.109
Source: unknown	TCP traffic detected without corresponding DNS query: 189.243.225.58
Source: unknown	TCP traffic detected without corresponding DNS query: 75.23.236.178
Source: unknown	TCP traffic detected without corresponding DNS query: 71.140.5.194
Source: unknown	TCP traffic detected without corresponding DNS query: 183.166.18.39
Source: unknown	TCP traffic detected without corresponding DNS query: 207.44.169.187
Source: unknown	TCP traffic detected without corresponding DNS query: 112.115.236.105
Source: unknown	TCP traffic detected without corresponding DNS query: 76.189.213.137
Source: unknown	TCP traffic detected without corresponding DNS query: 107.33.148.114
Source: unknown	TCP traffic detected without corresponding DNS query: 128.173.56.193
Source: unknown	TCP traffic detected without corresponding DNS query: 60.109.82.151
Source: unknown	TCP traffic detected without corresponding DNS query: 137.217.240.108
Source: unknown	TCP traffic detected without corresponding DNS query: 211.14.125.154
Source: unknown	TCP traffic detected without corresponding DNS query: 143.16.154.89
Source: unknown	TCP traffic detected without corresponding DNS query: 111.168.107.177
Source: unknown	TCP traffic detected without corresponding DNS query: 18.44.45.149
Source: unknown	TCP traffic detected without corresponding DNS query: 12.60.72.250
Source: unknown	TCP traffic detected without corresponding DNS query: 209.91.207.99
Source: unknown	TCP traffic detected without corresponding DNS query: 80.247.116.231
Source: unknown	TCP traffic detected without corresponding DNS query: 121.239.107.0
Source: unknown	TCP traffic detected without corresponding DNS query: 218.131.214.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.195.250.252
Source: unknown	TCP traffic detected without corresponding DNS query: 201.85.178.115
Source: unknown	TCP traffic detected without corresponding DNS query: 108.201.88.211
Source: unknown	TCP traffic detected without corresponding DNS query: 216.255.115.184
Source: unknown	TCP traffic detected without corresponding DNS query: 122.181.34.115
Source: unknown	TCP traffic detected without corresponding DNS query: 118.203.19.251
Source: unknown	TCP traffic detected without corresponding DNS query: 208.108.139.17
Source: unknown	TCP traffic detected without corresponding DNS query: 138.221.212.216
Source: unknown	TCP traffic detected without corresponding DNS query: 218.179.234.252
Source: unknown	TCP traffic detected without corresponding DNS query: 175.121.35.197
Source: unknown	TCP traffic detected without corresponding DNS query: 81.51.225.186
Source: unknown	TCP traffic detected without corresponding DNS query: 220.100.238.218
Source: unknown	TCP traffic detected without corresponding DNS query: 143.69.218.3
Source: unknown	TCP traffic detected without corresponding DNS query: 104.174.125.175
Source: unknown	TCP traffic detected without corresponding DNS query: 221.83.60.60
Source: unknown	TCP traffic detected without corresponding DNS query: 216.5.130.253
Source: unknown	TCP traffic detected without corresponding DNS query: 72.147.178.118
Source: unknown	TCP traffic detected without corresponding DNS query: 156.172.76.100
Source: unknown	TCP traffic detected without corresponding DNS query: 92.109.176.211
Source: unknown	TCP traffic detected without corresponding DNS query: 51.125.12.153
Source: unknown	TCP traffic detected without corresponding DNS query: 50.149.36.89
Source: unknown	TCP traffic detected without corresponding DNS query: 76.248.177.4
Source: unknown	TCP traffic detected without corresponding DNS query: 218.178.213.36
Source: unknown	TCP traffic detected without corresponding DNS query: 175.159.16.191
Source: unknown	TCP traffic detected without corresponding DNS query: 106.104.173.109
Source: unknown	TCP traffic detected without corresponding DNS query: 148.18.151.61
Source: unknown	TCP traffic detected without corresponding DNS query: 98.58.248.145
Source: unknown	TCP traffic detected without corresponding DNS query: 186.19.239.6

System Summary

Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: botnet.spc.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: botnet.spc.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@0/0

Executes commands using a shell command-line interpreter

Source: /tmp/botnet.spc.elf (PID: 5434)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/botnet.spc.elf bin/systemd; chmod 777 bin/systemd"

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 5443)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 5441)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5440)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Sample tries to set the executable flag

Source: /usr/bin/chmod (PID: 5443)

File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx)

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 5443)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/botnet.spc.elf (PID: 5432)

Queries kernel information via 'uname':

Source: botnet.spc.elf, 5432.1.0000557bcd895000.0000557bcd91a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: botnet.spc.elf, 5432.1.00007ffe43221000.00007ffe43242000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/botnet.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/botnet.spc.elf
Source: botnet.spc.elf, 5432.1.0000557bcd895000.0000557bcd91a000.rw-.sdmp	Binary or memory string: {U!/etc/qemu-binfmt/sparc
Source: botnet.spc.elf, 5432.1.00007ffe43221000.00007ffe43242000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Source: Yara match	File source: botnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR

Source: Yara match	File source: botnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Source: Yara match	File source: botnet.spc.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007fc6f0011000.00007fc6f0026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.spc.elf PID: 5432, type: MEMORYSTR