Linux Analysis Report botnet.sh4.elf

Malicious sample detected (through community Yara rule)

Source: unknown	TCP traffic detected without corresponding DNS query: 139.106.191.185
Source: unknown	TCP traffic detected without corresponding DNS query: 201.84.135.184
Source: unknown	TCP traffic detected without corresponding DNS query: 106.2.231.46
Source: unknown	TCP traffic detected without corresponding DNS query: 81.200.11.185
Source: unknown	TCP traffic detected without corresponding DNS query: 123.212.226.46
Source: unknown	TCP traffic detected without corresponding DNS query: 105.151.15.181
Source: unknown	TCP traffic detected without corresponding DNS query: 200.144.80.130
Source: unknown	TCP traffic detected without corresponding DNS query: 94.144.197.60
Source: unknown	TCP traffic detected without corresponding DNS query: 39.138.48.254
Source: unknown	TCP traffic detected without corresponding DNS query: 48.30.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 45.35.31.158
Source: unknown	TCP traffic detected without corresponding DNS query: 217.151.226.201
Source: unknown	TCP traffic detected without corresponding DNS query: 205.22.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 160.231.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 126.54.142.230
Source: unknown	TCP traffic detected without corresponding DNS query: 154.107.78.66
Source: unknown	TCP traffic detected without corresponding DNS query: 105.68.16.173
Source: unknown	TCP traffic detected without corresponding DNS query: 140.133.61.33
Source: unknown	TCP traffic detected without corresponding DNS query: 131.39.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 25.184.206.142
Source: unknown	TCP traffic detected without corresponding DNS query: 52.195.22.26
Source: unknown	TCP traffic detected without corresponding DNS query: 86.135.41.116
Source: unknown	TCP traffic detected without corresponding DNS query: 164.72.179.179
Source: unknown	TCP traffic detected without corresponding DNS query: 123.122.221.37
Source: unknown	TCP traffic detected without corresponding DNS query: 57.202.85.233
Source: unknown	TCP traffic detected without corresponding DNS query: 160.123.36.73
Source: unknown	TCP traffic detected without corresponding DNS query: 168.78.36.73
Source: unknown	TCP traffic detected without corresponding DNS query: 75.233.154.74
Source: unknown	TCP traffic detected without corresponding DNS query: 67.46.65.240
Source: unknown	TCP traffic detected without corresponding DNS query: 139.144.196.112
Source: unknown	TCP traffic detected without corresponding DNS query: 40.92.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 200.133.251.94
Source: unknown	TCP traffic detected without corresponding DNS query: 95.93.223.213
Source: unknown	TCP traffic detected without corresponding DNS query: 24.31.196.186
Source: unknown	TCP traffic detected without corresponding DNS query: 105.139.227.35
Source: unknown	TCP traffic detected without corresponding DNS query: 39.199.131.33
Source: unknown	TCP traffic detected without corresponding DNS query: 108.121.93.86
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.240.70
Source: unknown	TCP traffic detected without corresponding DNS query: 131.196.131.211
Source: unknown	TCP traffic detected without corresponding DNS query: 186.3.184.183
Source: unknown	TCP traffic detected without corresponding DNS query: 103.167.38.138
Source: unknown	TCP traffic detected without corresponding DNS query: 143.144.228.190
Source: unknown	TCP traffic detected without corresponding DNS query: 167.161.27.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.203.73.145
Source: unknown	TCP traffic detected without corresponding DNS query: 202.164.129.62
Source: unknown	TCP traffic detected without corresponding DNS query: 32.127.14.48
Source: unknown	TCP traffic detected without corresponding DNS query: 86.102.207.126
Source: unknown	TCP traffic detected without corresponding DNS query: 183.20.126.25
Source: unknown	TCP traffic detected without corresponding DNS query: 77.226.7.65
Source: unknown	TCP traffic detected without corresponding DNS query: 221.84.45.254

System Summary

Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@0/0

Executes commands using a shell command-line interpreter

Source: /tmp/botnet.sh4.elf (PID: 5488)

Shell command executed: sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/botnet.sh4.elf bin/busybox; chmod 777 bin/busybox"

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 5497)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/busybox

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 5495)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5494)

Rm executable: /usr/bin/rm -> rm -rf bin/busybox

Sample tries to set the executable flag

Source: /usr/bin/chmod (PID: 5497)

File: /tmp/bin/busybox (bits: - usr: rwx grp: rwx all: rwx)

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 5497)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/busybox

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/botnet.sh4.elf (PID: 5486)

Queries kernel information via 'uname':

Source: botnet.sh4.elf, 5486.1.00007ffd9dac8000.00007ffd9dae9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: botnet.sh4.elf, 5486.1.00007ffd9dac8000.00007ffd9dae9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/botnet.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/botnet.sh4.elf
Source: botnet.sh4.elf, 5486.1.000055f8fc87c000.000055f8fc8df000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: botnet.sh4.elf, 5486.1.000055f8fc87c000.000055f8fc8df000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Source: Yara match	File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR

Source: Yara match	File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Source: Yara match	File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR

Antivirus / Scanner detection for submitted sample

Source: Yara match	File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.212.208.57	unknown	Russian Federation	39134	UNITEDNETRU	false
107.244.110.159	unknown	United States	7018	ATT-INTERNET4US	false
78.31.168.26	unknown	Germany	35292	ELXSI-ASelxsiSecurityNetworkingServicesDE	false
96.212.50.92	unknown	United States	7922	COMCAST-7922US	false
125.248.115.171	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
216.203.121.111	unknown	United States	17306	RISE-BROADBANDUS	false
76.11.253.168	unknown	United States	10796	TWC-10796-MIDWESTUS	false
138.112.32.73	unknown	United States	776	FR-INRIA-SOPHIAINRIASophia-AntipolisEU	false
81.147.140.12	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
203.76.27.221	unknown	Australia	9797	NEXONASIAPACIFIC-AS-APNexonAsiaPacificPLAU	false
9.250.155.36	unknown	United States	3356	LEVEL3US	false
35.146.139.255	unknown	United States	394141	ROCKET-FIBERUS	false
80.222.97.49	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
120.78.240.209	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
146.147.76.79	unknown	United States	197938	TRAVIANGAMESDE	false
41.9.191.230	unknown	South Africa	29975	VODACOM-ZA	false
128.252.8.151	unknown	United States	2552	WUSTL-ASNUS	false
37.218.181.144	unknown	Kyrgyzstan	12997	KTNETKG	false
203.6.121.113	unknown	Australia	9466	UUNET-JP-APUUNETJapanLimitedJP	false
100.236.185.83	unknown	United States	21928	T-MOBILE-AS21928US	false
192.161.76.10	unknown	United States	4922	SHENTELUS	false
17.249.203.182	unknown	United States	714	APPLE-ENGINEERINGUS	false
177.45.17.160	unknown	Brazil	19182	TELEFONICABRASILSABR	false
121.180.78.95	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
148.53.4.45	unknown	United States	6591	INGR-ASNUS	false
46.127.188.23	unknown	Switzerland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
218.194.100.1	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
70.218.66.129	unknown	United States	22394	CELLCOUS	false
8.65.78.248	unknown	United States	3356	LEVEL3US	false
147.34.23.135	unknown	United States	13541	MENTORGRAPHICSUS	false
65.3.68.55	unknown	United States	16509	AMAZON-02US	false
150.109.191.87	unknown	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
70.125.95.206	unknown	United States	33363	BHN-33363US	false
43.137.36.124	unknown	Japan	4249	LILLY-ASUS	false
105.66.179.121	unknown	Morocco	36884	MAROCCONNECTMA	false
169.247.137.101	unknown	United States	557	UMAINE-SYS-ASUS	false
72.51.253.243	unknown	United States	11492	CABLEONEUS	false
83.211.189.87	unknown	Italy	15589	ASN-CLOUDITALIAIT	false
212.249.205.55	unknown	Switzerland	702	UUNETUS	false
47.183.199.104	unknown	United States	5650	FRONTIER-FRTRUS	false
143.233.109.92	unknown	Greece	2546	ARIADNE-TAriadne-tNetworkEU	false
94.227.159.196	unknown	Belgium	6848	TELENET-ASBE	false
182.178.198.247	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
49.43.26.113	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
135.87.62.170	unknown	United States	10455	LUCENT-CIOUS	false
36.177.52.222	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
152.180.4.6	unknown	United States	701	UUNETUS	false
117.45.233.9	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
78.212.249.212	unknown	France	12322	PROXADFR	false
144.212.243.251	unknown	United States	11939	MATHWORKSUS	false
113.72.119.63	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
86.15.7.191	unknown	United Kingdom	5089	NTLGB	false
162.145.242.81	unknown	Australia	46606	UNIFIEDLAYER-AS-1US	false
61.210.62.100	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
77.203.28.40	unknown	France	15557	LDCOMNETFR	false
153.44.231.212	unknown	Norway	2116	ASN-CATCHCOMNO	false
23.170.62.188	unknown	Reserved	397131	EVERYTHINKCA	false
210.108.185.174	unknown	Korea Republic of	10064	SANGNOK-AS-KRGEPSCheonanSagnokresortKR	false
115.208.213.246	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
92.159.155.179	unknown	France	3215	FranceTelecom-OrangeFR	false
65.127.249.20	unknown	United States	3908	CENTURYLINK-ASIA-LEGACY-QWESTUS	false
114.120.232.137	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
86.56.41.165	unknown	Germany	20880	TELECOLUMBUSDE	false
115.107.75.34	unknown	China	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	false
46.113.39.90	unknown	Poland	39603	P4NETP4UMTSoperatorinPolandPL	false
114.40.69.255	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
198.14.9.4	unknown	United States	14126	ASN-VOICESTARUS	false
62.51.3.70	unknown	European Union	10310	YAHOO-1US	false
42.187.28.137	unknown	China	45062	NETEASE-ASGuangzhouNetEaseComputerSystemCoLtdCN	false
124.204.19.119	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
168.66.250.31	unknown	United States	265240	ULTRANETSERVICOSEMINTERNETLTDABR	false
37.207.231.62	unknown	Italy	3269	ASN-IBSNAZIT	false
72.190.162.43	unknown	United States	11427	TWC-11427-TEXASUS	false
196.187.126.96	unknown	Tunisia	5438	ATI-TN	false
209.75.197.148	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
200.33.215.38	unknown	Mexico	6503	AxtelSABdeCVMX	false
147.84.49.161	unknown	Spain	39069	CARMCARMAutonomousSystemES	false
79.73.45.127	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
95.214.117.146	unknown	Russian Federation	41864	ZELOBITRU	false
149.230.227.41	unknown	Germany	702	UUNETUS	false
152.234.121.128	unknown	Brazil	7738	TelemarNorteLesteSABR	false
204.141.81.232	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
78.73.118.13	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
220.104.50.227	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
112.25.71.133	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
194.195.203.143	unknown	Germany	6659	NEXINTO-DE	false
132.121.181.11	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
96.147.8.202	unknown	United States	7922	COMCAST-7922US	false
223.196.163.149	unknown	India	133287	APSFL-ASAndhraPradeshStateFiberNetLimitedIN	false
164.149.28.40	unknown	South Africa	37130	SITA-ASZA	false
51.146.187.19	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
32.32.129.176	unknown	United States	2686	ATGS-MMD-ASUS	false
110.19.71.215	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
189.115.120.20	unknown	Brazil	18881	TELEFONICABRASILSABR	false
208.123.248.244	unknown	United States	15129	TRICOM-ILUS	false
17.162.2.22	unknown	United States	714	APPLE-ENGINEERINGUS	false
95.85.236.154	unknown	Czech Republic	43708	METRONETCZ	false
84.189.216.125	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
102.54.126.221	unknown	Morocco	6713	IAM-ASMA	false
46.21.243.5	unknown	Russian Federation	197401	U2NET-ASRU	false

AV Detection

Source: botnet.sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: botnet.sh4.elf

ReversingLabs: Detection: 63%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:37332 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:37680 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:37938 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:37940 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:37958 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:38240 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:38492 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:38616 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:38920 -> 91.208.184.54:56744
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.14:39230 -> 91.208.184.54:56744

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 139.106.191.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 39.138.48.254:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 131.39.134.11:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 139.144.196.112:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 62.24.223.145:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 108.202.141.74:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 137.65.32.1:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 184.132.233.190:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 223.87.93.224:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 74.247.82.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 122.192.146.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 137.14.210.69:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 162.49.13.146:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 144.189.12.134:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 152.157.231.210:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 74.2.1.126:2323
Source: global traffic	TCP traffic: 192.168.2.14:37332 -> 91.208.184.54:56744
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 98.186.114.62:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 132.5.9.61:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 164.27.21.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 207.23.99.167:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 217.153.234.163:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 204.164.229.41:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 86.142.66.110:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 141.44.174.214:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 84.215.2.36:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 38.235.131.103:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 111.43.148.22:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 146.140.42.127:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 107.182.237.122:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 64.180.187.180:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 44.251.67.145:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 106.89.156.198:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 38.67.19.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 211.185.0.82:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 18.165.228.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 212.24.197.3:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 87.61.179.90:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 35.213.250.152:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 203.20.57.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 205.82.229.117:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 132.14.211.138:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 178.76.74.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 105.144.119.137:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 189.76.199.103:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 61.33.16.85:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 131.144.111.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 148.174.206.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 78.160.203.31:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 206.226.220.181:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 2.150.116.44:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 50.132.183.200:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 145.154.200.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.177.204.18:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 1.19.232.231:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 155.160.66.8:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 190.87.100.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 170.116.133.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 25.40.115.121:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 134.46.20.34:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 221.91.172.34:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 174.53.2.47:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 141.234.81.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 81.181.158.158:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 143.156.123.213:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 44.74.176.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 77.83.173.43:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 46.181.94.184:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 49.137.90.120:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 67.245.109.224:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 213.179.137.136:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 134.165.185.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.190.162.254:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 108.164.235.41:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 143.29.160.175:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 191.204.77.50:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 36.14.233.153:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 173.145.54.104:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.240.37.248:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 99.118.245.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 76.54.66.170:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 182.194.208.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 148.5.89.115:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 217.39.181.191:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 181.110.178.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 48.204.79.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 41.113.203.194:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 190.191.229.122:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 53.153.70.142:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 210.123.59.227:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 169.201.97.91:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 143.113.82.153:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 82.144.93.23:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 102.8.130.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 40.113.95.53:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 88.38.39.112:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 148.48.3.33:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 35.200.48.243:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 78.114.146.162:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 143.170.252.211:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 93.97.158.67:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 154.176.180.37:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 31.37.73.169:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 189.204.30.254:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 135.227.240.236:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 92.125.9.161:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 121.251.195.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 203.214.202.114:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 59.86.202.225:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 163.2.57.107:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 41.100.246.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 99.147.109.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 94.103.16.121:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 121.107.101.35:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 134.190.21.49:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.213.227.183:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 17.250.12.132:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 145.105.175.77:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 118.187.224.20:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 149.26.158.108:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 79.29.218.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 109.246.239.97:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 195.245.242.137:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 187.235.120.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 2.172.136.131:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 216.53.37.215:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 73.247.242.218:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 32.118.9.212:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 173.241.206.247:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 151.11.115.240:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 182.203.252.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 23.233.115.40:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 39.123.79.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 217.174.51.14:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 197.19.81.121:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 132.57.212.44:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 27.222.231.242:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 5.75.45.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 116.169.39.61:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 155.73.74.100:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.209.114.235:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 43.137.75.69:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 5.96.223.19:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 165.2.221.103:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 48.63.233.180:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 116.233.216.43:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 51.57.228.209:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 12.243.1.196:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 138.227.238.209:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 201.72.156.54:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 86.190.163.2:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 32.88.253.92:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 168.243.99.41:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 109.170.42.190:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 161.207.248.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 72.108.82.153:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 128.219.249.116:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 218.243.182.100:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 137.23.142.233:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 32.201.6.104:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 190.87.215.168:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 77.165.58.180:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 88.16.222.90:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 66.157.88.5:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 189.13.28.143:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 82.0.51.79:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 142.25.95.67:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 103.158.229.229:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 4.19.232.215:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 186.174.37.91:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 89.124.37.212:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 25.128.229.25:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 198.29.120.249:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 119.45.253.82:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 170.49.192.189:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 221.77.121.156:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 77.76.200.123:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 98.218.64.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 65.249.64.115:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 86.28.107.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 1.187.116.149:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.208.87.143:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 223.72.227.19:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 99.97.7.36:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 171.89.77.24:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 211.74.27.10:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 205.44.77.53:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 70.228.4.182:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 61.150.7.62:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 42.153.167.69:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 216.250.209.94:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 1.220.180.114:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 145.211.228.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 110.158.67.60:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 212.132.149.94:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 72.39.56.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 38.183.26.25:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 102.128.26.56:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 4.168.81.69:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 14.12.90.111:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 5.33.243.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 123.212.199.125:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 67.34.19.168:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 150.250.134.235:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 151.253.213.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 116.64.174.167:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 102.193.70.177:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 42.127.244.115:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 190.208.226.18:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 90.154.113.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 107.3.249.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 125.8.27.244:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 147.240.174.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 210.1.23.32:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 141.150.241.55:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 220.201.96.211:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 131.159.239.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 95.54.42.205:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 123.180.245.65:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 150.13.160.84:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 208.223.215.248:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 109.231.11.14:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 118.118.230.195:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 24.241.95.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 148.47.163.219:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 117.233.149.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 156.69.226.149:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 223.0.157.21:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 151.235.217.50:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 164.189.68.193:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 174.221.60.227:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 139.9.174.216:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 87.163.140.44:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 197.31.244.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 128.162.123.3:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 210.222.168.200:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 217.233.240.225:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 48.28.70.98:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 196.73.121.177:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 209.226.137.218:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 207.4.30.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 12.156.209.71:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 36.104.119.81:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 99.55.116.136:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 162.36.60.31:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 110.51.62.77:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 90.206.234.213:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 112.166.195.48:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 161.222.43.205:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 166.217.160.194:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 163.92.110.109:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 158.205.127.71:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 155.252.224.209:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 159.83.156.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 156.86.175.103:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 217.76.149.235:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 39.114.55.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 95.214.69.55:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 158.62.234.180:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 207.226.240.218:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 161.36.242.68:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 44.125.33.116:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 156.110.185.13:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 71.96.232.203:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 108.73.60.4:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 147.166.243.155:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 196.143.115.114:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 130.22.148.133:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.14.150.72:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 5.169.15.24:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 69.210.94.28:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 89.34.231.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 208.62.67.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 45.18.99.205:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 123.226.168.234:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 25.91.126.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 69.86.85.51:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 117.5.160.23:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 91.25.80.207:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 158.105.233.198:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 132.92.211.155:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 150.253.254.224:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 87.88.203.141:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 149.40.116.234:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 54.126.179.191:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 54.41.135.212:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 71.89.235.214:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 141.91.33.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 27.181.251.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 44.118.138.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 124.5.238.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.38.237.134:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 117.219.82.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.42.89.196:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 162.93.177.216:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 9.91.175.68:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 103.90.232.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 184.162.137.219:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 135.222.234.189:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 174.8.227.177:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 170.52.248.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 199.167.150.152:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 140.214.138.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 103.148.242.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 120.64.33.247:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 210.206.42.43:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 136.74.142.102:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 207.132.142.136:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 187.166.126.154:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 221.151.250.193:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 46.46.169.124:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.202.127.51:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 222.251.29.241:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 93.232.40.75:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 59.37.14.108:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 86.204.116.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 152.180.4.6:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 140.68.20.233:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 44.236.98.34:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 23.201.212.73:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 138.165.143.140:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 79.65.228.101:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 38.67.173.220:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.74.224.164:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 110.32.223.214:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 147.173.180.171:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 84.51.197.216:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 131.168.174.28:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 132.154.246.162:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 67.25.1.47:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 108.97.35.226:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 177.2.186.201:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 126.62.29.192:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 128.233.110.111:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 154.214.120.73:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 181.172.15.182:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 58.201.3.126:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 144.185.234.34:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 27.98.163.135:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 201.157.228.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 197.201.179.227:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 160.127.81.16:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 66.17.240.237:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 153.167.69.167:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 146.217.225.7:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 111.221.249.208:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 68.224.27.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 166.174.42.103:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 105.120.146.28:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 125.1.78.112:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 112.127.231.157:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 57.242.34.174:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 134.209.83.228:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 189.162.235.34:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 204.221.235.227:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 48.84.148.213:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 14.28.182.180:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 79.25.215.146:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 179.133.87.69:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 206.251.82.161:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 145.60.94.224:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 18.160.50.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 20.124.52.128:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 125.45.36.153:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 114.86.99.162:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 117.206.10.55:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 122.98.198.131:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 79.164.118.216:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 165.15.29.60:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.216.196.75:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 61.234.172.74:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 200.101.138.156:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 190.151.46.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 165.198.207.251:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 20.5.4.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 142.35.86.68:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.138.57.89:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 79.160.13.74:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 159.135.65.92:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 137.221.40.242:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 208.55.95.218:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 51.181.202.148:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 168.25.167.134:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 60.8.140.93:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 190.2.82.229:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 201.156.131.213:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 152.163.194.97:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 126.103.127.197:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 158.182.210.245:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 196.187.126.96:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 58.56.173.176:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 108.179.229.181:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 128.129.128.162:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 70.243.29.8:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 174.150.198.243:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 181.238.63.60:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 23.248.16.25:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 64.135.21.10:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 59.81.140.3:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 168.162.167.211:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 184.204.206.92:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 97.70.71.69:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 105.91.195.20:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 20.37.199.58:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 125.244.222.1:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 80.51.179.1:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 149.191.242.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 112.205.159.102:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 157.253.66.20:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 121.174.40.33:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 68.113.130.36:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 79.15.74.205:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 79.8.244.177:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 106.110.200.127:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 180.40.100.153:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 104.183.187.46:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 4.241.100.133:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 81.25.19.41:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 61.199.135.150:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 196.63.64.140:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 68.142.151.77:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 61.68.157.192:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 20.19.89.50:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 103.53.194.223:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 8.152.223.144:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 149.3.156.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 161.97.22.86:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 185.218.102.59:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 197.141.112.139:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 217.144.146.90:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 51.127.201.196:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 126.123.212.149:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 113.152.235.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 113.184.211.15:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 134.195.236.250:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 100.247.135.79:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 45.123.4.89:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 220.141.155.143:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 178.208.111.63:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 179.135.206.117:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 80.55.97.3:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 44.246.164.63:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 92.169.211.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 199.237.6.125:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.232.222.176:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 142.104.62.221:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 220.66.237.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 101.8.168.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 94.51.86.255:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 100.1.188.97:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 62.232.36.229:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 138.240.52.226:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 65.192.36.198:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 71.122.157.130:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 196.74.67.67:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 61.43.4.53:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 83.147.168.3:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 71.235.156.120:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 213.34.214.95:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 87.75.62.121:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 175.244.237.230:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 204.143.222.222:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 151.165.110.21:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 90.227.1.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 208.89.46.251:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 75.22.57.94:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 95.225.170.132:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 40.149.109.17:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 37.223.62.168:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 103.38.70.48:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 112.183.40.142:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 34.35.72.204:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 165.218.22.17:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 129.127.107.237:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 88.244.233.25:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 60.133.133.84:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 167.10.75.152:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 125.235.45.180:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 154.177.3.170:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 104.68.176.64:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 4.118.126.83:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 19.173.132.18:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 163.116.123.27:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 59.218.51.251:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 92.83.248.251:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 38.238.225.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 40.218.208.30:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 217.116.136.2:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 171.188.134.198:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 38.71.132.236:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 185.189.211.70:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 82.66.221.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 111.175.81.3:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 36.177.52.222:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 126.213.78.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 210.203.183.176:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 197.245.212.175:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 59.81.133.162:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 160.166.13.47:2323
Source: global traffic	TCP traffic: 192.168.2.14:59715 -> 161.210.31.43:2323

Sample listens on a socket

Source: /tmp/botnet.sh4.elf (PID: 5486)

Socket: 0.0.0.0:1230

Malicious sample detected (through community Yara rule)

Source: unknown	TCP traffic detected without corresponding DNS query: 139.106.191.185
Source: unknown	TCP traffic detected without corresponding DNS query: 201.84.135.184
Source: unknown	TCP traffic detected without corresponding DNS query: 106.2.231.46
Source: unknown	TCP traffic detected without corresponding DNS query: 81.200.11.185
Source: unknown	TCP traffic detected without corresponding DNS query: 123.212.226.46
Source: unknown	TCP traffic detected without corresponding DNS query: 105.151.15.181
Source: unknown	TCP traffic detected without corresponding DNS query: 200.144.80.130
Source: unknown	TCP traffic detected without corresponding DNS query: 94.144.197.60
Source: unknown	TCP traffic detected without corresponding DNS query: 39.138.48.254
Source: unknown	TCP traffic detected without corresponding DNS query: 48.30.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 45.35.31.158
Source: unknown	TCP traffic detected without corresponding DNS query: 217.151.226.201
Source: unknown	TCP traffic detected without corresponding DNS query: 205.22.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 160.231.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 126.54.142.230
Source: unknown	TCP traffic detected without corresponding DNS query: 154.107.78.66
Source: unknown	TCP traffic detected without corresponding DNS query: 105.68.16.173
Source: unknown	TCP traffic detected without corresponding DNS query: 140.133.61.33
Source: unknown	TCP traffic detected without corresponding DNS query: 131.39.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 25.184.206.142
Source: unknown	TCP traffic detected without corresponding DNS query: 52.195.22.26
Source: unknown	TCP traffic detected without corresponding DNS query: 86.135.41.116
Source: unknown	TCP traffic detected without corresponding DNS query: 164.72.179.179
Source: unknown	TCP traffic detected without corresponding DNS query: 123.122.221.37
Source: unknown	TCP traffic detected without corresponding DNS query: 57.202.85.233
Source: unknown	TCP traffic detected without corresponding DNS query: 160.123.36.73
Source: unknown	TCP traffic detected without corresponding DNS query: 168.78.36.73
Source: unknown	TCP traffic detected without corresponding DNS query: 75.233.154.74
Source: unknown	TCP traffic detected without corresponding DNS query: 67.46.65.240
Source: unknown	TCP traffic detected without corresponding DNS query: 139.144.196.112
Source: unknown	TCP traffic detected without corresponding DNS query: 40.92.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 200.133.251.94
Source: unknown	TCP traffic detected without corresponding DNS query: 95.93.223.213
Source: unknown	TCP traffic detected without corresponding DNS query: 24.31.196.186
Source: unknown	TCP traffic detected without corresponding DNS query: 105.139.227.35
Source: unknown	TCP traffic detected without corresponding DNS query: 39.199.131.33
Source: unknown	TCP traffic detected without corresponding DNS query: 108.121.93.86
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.240.70
Source: unknown	TCP traffic detected without corresponding DNS query: 131.196.131.211
Source: unknown	TCP traffic detected without corresponding DNS query: 186.3.184.183
Source: unknown	TCP traffic detected without corresponding DNS query: 103.167.38.138
Source: unknown	TCP traffic detected without corresponding DNS query: 143.144.228.190
Source: unknown	TCP traffic detected without corresponding DNS query: 167.161.27.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.203.73.145
Source: unknown	TCP traffic detected without corresponding DNS query: 202.164.129.62
Source: unknown	TCP traffic detected without corresponding DNS query: 32.127.14.48
Source: unknown	TCP traffic detected without corresponding DNS query: 86.102.207.126
Source: unknown	TCP traffic detected without corresponding DNS query: 183.20.126.25
Source: unknown	TCP traffic detected without corresponding DNS query: 77.226.7.65
Source: unknown	TCP traffic detected without corresponding DNS query: 221.84.45.254

System Summary

Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: botnet.sh4.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@0/0

Executes commands using a shell command-line interpreter

Source: /tmp/botnet.sh4.elf (PID: 5488)

Shell command executed: sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/botnet.sh4.elf bin/busybox; chmod 777 bin/busybox"

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 5497)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/busybox

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 5495)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5494)

Rm executable: /usr/bin/rm -> rm -rf bin/busybox

Sample tries to set the executable flag

Source: /usr/bin/chmod (PID: 5497)

File: /tmp/bin/busybox (bits: - usr: rwx grp: rwx all: rwx)

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 5497)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/busybox

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/botnet.sh4.elf (PID: 5486)

Queries kernel information via 'uname':

Source: botnet.sh4.elf, 5486.1.00007ffd9dac8000.00007ffd9dae9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: botnet.sh4.elf, 5486.1.00007ffd9dac8000.00007ffd9dae9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/botnet.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/botnet.sh4.elf
Source: botnet.sh4.elf, 5486.1.000055f8fc87c000.000055f8fc8df000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: botnet.sh4.elf, 5486.1.000055f8fc87c000.000055f8fc8df000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Source: Yara match	File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR

Source: Yara match	File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Source: Yara match	File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007ffb70400000.00007ffb70412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: botnet.sh4.elf PID: 5486, type: MEMORYSTR