Linux Analysis Report
jew.ppc.elf

Overview

General Information

Sample name: jew.ppc.elf
Analysis ID: 1544653
MD5: 14c8a9c6e690f4fb9e0f24cbfba0d44e
SHA1: d649e68ed907fa7c7cd3e7ded5d34eaab7feab36
SHA256: f5489448aacd8369a952bd137711be1e047bb0d8cfbd56ae7132ce9aac057c94
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara detected Mirai

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: jew.ppc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: jew.ppc.elf ReversingLabs: Detection: 52%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:43622 -> 147.45.79.174:9931
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 72.7.21.122:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 211.64.83.134:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 23.81.144.211:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 179.189.80.60:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 114.68.96.249:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 204.77.190.130:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 143.167.218.16:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 44.63.84.175:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 184.33.154.36:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 64.152.248.79:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 32.84.76.232:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 204.50.82.34:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 213.13.76.57:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 61.49.89.49:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 147.87.187.95:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 195.89.203.72:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 212.67.81.120:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 85.11.69.54:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 120.71.12.252:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 93.143.73.56:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 78.65.209.237:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 173.87.178.158:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 82.63.98.15:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 151.0.12.147:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 143.183.238.100:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 31.230.175.167:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 64.122.120.167:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 157.32.101.3:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 61.185.136.155:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 204.99.62.221:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 95.55.147.56:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 115.130.208.65:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 41.232.11.183:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 100.138.17.110:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 153.106.176.55:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 181.156.138.153:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 180.31.52.210:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 100.62.43.126:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 85.224.10.163:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 75.3.238.183:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 149.103.53.206:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 222.121.159.141:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 94.155.62.57:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 96.237.98.88:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 14.247.219.16:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 186.48.148.179:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 39.240.57.53:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 97.55.114.94:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 202.86.210.118:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 62.41.114.182:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 31.97.25.39:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 135.237.12.27:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 136.135.167.8:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 52.159.41.135:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 200.57.94.159:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 112.190.29.42:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 199.238.107.77:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 185.34.198.217:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 86.149.173.145:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 189.192.54.233:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 68.175.26.167:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 191.207.193.207:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 165.153.71.60:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 178.250.244.154:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 13.10.213.222:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 104.15.32.194:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 58.74.11.27:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 59.224.89.150:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 8.147.59.98:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 57.183.30.252:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 53.4.41.239:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 37.135.86.189:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 151.174.119.98:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 211.117.180.211:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 220.1.189.162:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 180.255.102.252:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 148.165.207.199:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 217.143.208.211:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 47.48.15.253:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 201.114.250.67:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 73.139.78.67:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 119.148.5.150:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 122.146.57.46:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 107.121.131.54:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 174.5.152.177:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 58.15.42.39:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 206.23.0.232:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 149.30.51.196:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 181.198.114.40:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 68.66.197.33:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 85.164.182.45:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 62.216.175.71:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 60.86.75.143:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 72.230.73.38:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 130.82.242.234:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 18.221.146.236:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 205.156.169.193:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 112.235.124.18:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 101.130.251.100:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 13.239.85.156:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 72.195.42.151:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 174.173.124.141:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 144.134.10.254:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 136.35.90.65:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 148.38.10.47:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 119.162.147.174:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 78.174.45.229:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 105.12.199.137:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 118.205.150.58:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 135.162.180.112:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 221.216.147.6:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 140.199.107.202:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 1.193.7.119:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 174.171.230.120:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 144.198.165.231:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 80.131.134.148:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 50.176.139.240:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 129.212.188.243:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 203.68.87.95:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 218.77.240.153:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 89.47.206.182:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 4.76.236.169:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 137.27.37.169:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 82.39.50.205:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 93.219.189.43:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 125.199.253.27:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 120.238.133.239:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 193.75.169.186:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 86.160.22.176:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 74.8.90.82:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 187.207.144.31:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 49.206.210.153:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 84.47.176.100:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 63.81.122.205:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 64.196.155.71:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 181.1.85.201:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 169.241.166.16:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 211.168.234.55:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 189.227.22.220:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 20.143.144.242:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 75.68.55.141:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 69.222.13.19:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 82.31.195.44:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 54.0.93.94:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 92.51.182.88:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 59.238.20.14:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 209.151.236.88:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 57.168.219.132:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 132.96.96.141:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 110.12.16.129:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 222.106.69.69:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 198.177.130.111:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 124.200.242.132:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 174.86.24.117:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 138.196.69.2:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 203.46.182.1:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 50.159.154.142:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 9.12.186.185:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 199.44.151.123:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 32.155.172.52:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 122.158.215.114:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 100.14.7.84:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 210.164.162.40:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 199.15.106.214:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 175.23.8.133:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 211.191.125.77:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 50.219.150.71:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 75.125.89.55:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 71.151.193.224:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 98.130.12.203:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 34.27.162.90:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 222.10.188.188:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 87.25.193.78:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 96.183.7.198:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 179.165.121.210:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 130.168.111.19:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 74.227.236.245:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 81.207.169.247:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 86.33.204.232:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 89.178.205.72:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 167.51.129.29:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 77.232.3.142:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 97.49.193.202:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 43.237.231.191:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 152.252.184.168:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 43.132.122.23:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 165.100.49.38:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 60.156.164.138:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 133.124.116.72:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 182.184.90.150:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 44.70.191.223:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 47.119.68.177:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 113.160.70.158:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 140.28.122.18:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 63.84.142.191:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 174.229.238.69:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 35.19.205.77:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 67.198.173.13:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 157.163.208.202:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 35.180.38.152:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 12.197.49.149:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 65.193.128.235:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 84.34.212.183:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 83.84.74.107:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 144.134.35.47:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 105.180.43.43:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 147.65.103.5:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 206.244.183.108:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 200.125.36.61:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 68.141.30.180:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 52.123.203.68:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 138.161.75.131:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 14.179.32.193:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 79.68.9.150:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 20.14.85.188:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 176.72.54.54:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 95.151.228.70:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 208.40.211.29:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 205.86.117.119:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 190.31.45.106:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 145.159.180.31:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 80.244.79.75:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 133.218.156.239:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 61.245.76.144:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 109.242.171.129:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 40.219.176.128:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 135.220.129.236:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 13.174.157.74:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 129.78.213.227:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 80.212.144.34:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 156.240.119.188:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 4.56.91.16:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 111.155.165.229:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 46.238.19.161:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 74.113.45.196:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 53.111.144.7:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 100.193.224.66:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 81.94.151.255:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 145.118.255.160:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 193.210.234.118:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 72.136.175.235:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 164.186.43.201:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 84.8.30.244:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 104.70.48.38:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 61.43.248.6:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 40.173.168.74:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 9.18.82.202:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 218.23.138.195:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 167.97.213.218:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 205.188.52.85:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 118.49.51.152:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 53.91.24.61:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 93.211.235.151:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 83.162.246.1:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 203.255.33.83:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 176.159.142.136:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 217.75.86.148:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 149.56.80.51:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 153.58.182.66:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 85.37.231.238:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 154.180.49.138:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 223.200.34.175:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 186.198.255.224:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 137.7.229.142:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 220.115.125.77:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 147.197.85.197:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 54.179.228.12:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 173.60.100.159:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 98.72.130.168:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 1.64.47.134:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 188.29.88.50:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 193.113.253.63:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 59.99.53.222:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 73.238.251.0:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 175.30.105.173:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 213.10.45.29:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 65.133.141.64:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 210.67.107.76:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 8.18.148.8:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 88.193.118.153:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 83.104.12.205:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 43.14.94.196:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 182.32.97.189:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 34.130.84.183:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 112.3.95.146:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 197.179.76.18:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 133.192.138.143:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 84.135.181.250:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 83.39.151.194:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 199.84.23.20:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 99.24.3.119:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 216.230.245.43:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 175.192.43.51:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 136.97.125.52:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 32.145.156.37:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 153.210.114.166:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 120.66.46.231:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 187.83.159.69:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 196.12.198.38:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 190.60.96.141:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 186.123.121.45:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 90.134.132.171:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 70.20.68.255:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 166.110.60.175:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 17.38.247.102:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 164.195.173.185:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 73.163.72.41:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 89.203.134.96:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 166.181.94.149:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 149.49.116.168:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 223.197.150.57:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 196.200.54.229:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 152.22.147.193:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 69.69.172.115:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 121.122.167.250:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 144.11.141.147:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 113.5.21.49:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 82.56.107.102:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 103.53.126.97:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 156.93.113.150:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 120.124.156.96:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 124.132.182.102:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 111.196.246.144:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 135.0.246.77:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 88.9.177.71:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 65.173.40.254:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 122.187.46.186:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 165.213.66.76:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 44.203.135.0:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 164.164.247.226:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 45.21.32.175:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 151.26.52.231:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 92.232.234.176:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 54.176.195.210:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 107.156.249.176:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 94.180.0.160:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 159.197.145.98:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 128.162.75.96:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 181.122.130.66:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 200.217.210.8:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 85.178.85.80:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 5.188.111.149:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 53.244.247.81:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 110.205.31.106:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 144.24.220.116:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 219.235.40.57:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 108.241.56.85:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 115.69.49.226:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 70.190.157.103:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 36.83.228.28:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 111.159.155.18:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 106.183.44.155:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 133.109.23.108:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 18.111.13.211:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 47.201.142.116:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 185.143.136.7:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 59.181.252.73:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 139.103.20.216:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 42.206.36.101:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 42.198.38.230:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 207.96.190.104:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 82.190.183.250:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 67.2.24.243:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 171.208.97.65:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 121.150.206.12:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 149.94.26.16:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 170.76.217.136:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 124.191.253.172:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 160.240.120.42:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 166.95.58.50:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 176.49.197.201:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 75.184.64.115:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 210.160.110.73:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 141.141.27.219:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 36.131.208.212:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 98.166.19.158:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 203.217.27.222:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 145.107.32.150:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 9.22.50.236:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 157.60.14.92:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 14.141.39.225:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 107.62.198.10:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 207.149.200.112:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 209.112.103.192:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 61.210.22.192:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 148.111.66.188:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 40.229.228.92:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 85.120.92.104:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 163.127.110.52:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 95.189.165.181:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 71.81.243.204:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 208.183.97.49:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 134.2.182.183:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 40.215.19.171:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 133.251.79.105:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 104.139.120.39:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 211.99.249.141:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 170.158.211.63:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 32.36.125.76:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 79.51.134.252:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 177.113.19.115:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 204.194.93.164:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 190.73.58.190:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 115.37.89.138:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 83.224.93.157:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 60.218.214.135:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 181.105.166.251:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 133.133.161.130:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 78.57.44.190:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 212.51.70.53:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 104.122.95.204:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 103.54.198.41:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 112.237.119.47:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 167.64.245.14:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 181.233.20.198:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 111.247.223.232:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 23.200.45.248:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 202.114.77.12:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 140.66.231.133:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 79.2.41.67:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 143.58.153.8:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 24.173.126.93:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 147.52.113.59:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 65.180.102.36:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 58.174.41.205:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 87.244.250.40:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 188.242.66.129:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 132.95.51.13:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 114.146.229.168:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 116.136.78.1:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 91.151.143.155:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 39.191.177.165:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 183.165.37.3:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 89.77.199.215:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 162.2.197.105:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 102.84.34.129:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 171.95.237.150:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 82.59.99.24:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 76.99.62.250:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 180.191.61.50:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 45.54.33.222:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 203.206.113.197:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 128.137.228.186:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 159.3.1.209:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 181.71.138.57:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 131.119.216.63:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 200.194.174.119:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 153.243.121.182:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 14.127.172.218:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 179.61.80.57:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 178.238.5.95:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 187.190.176.250:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 152.154.247.73:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 160.247.15.216:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 184.49.39.51:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 209.193.96.244:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 191.190.23.242:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 102.100.242.61:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 146.196.22.61:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 65.75.91.76:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 2.55.114.124:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 90.9.253.133:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 35.187.105.66:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 144.53.161.129:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 162.218.152.223:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 17.247.178.96:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 209.4.230.201:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 62.34.131.224:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 170.93.158.16:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 1.29.32.0:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 180.138.13.80:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 185.11.175.184:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 84.188.9.128:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 37.78.114.112:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 116.75.9.30:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 223.65.58.253:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 32.193.146.14:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 151.235.87.52:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 74.25.191.205:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 97.3.192.102:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 122.224.66.109:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 185.33.225.219:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 43.222.81.20:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 124.157.240.159:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 194.253.162.227:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 45.1.219.244:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 152.64.23.78:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 94.231.142.14:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 58.139.237.253:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 44.38.190.139:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 184.35.185.132:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 58.0.226.242:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 151.174.180.17:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 152.91.243.223:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 61.0.226.27:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 18.58.38.255:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 89.115.101.225:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 1.89.85.152:2323
Source: global traffic TCP traffic: 192.168.2.14:16385 -> 155.252.253.84:2323
Sample listens on a socket
Source: /tmp/jew.ppc.elf (PID: 5493) Socket: 127.0.0.1:1926 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 72.7.21.122
Source: unknown TCP traffic detected without corresponding DNS query: 34.111.122.122
Source: unknown TCP traffic detected without corresponding DNS query: 124.228.152.66
Source: unknown TCP traffic detected without corresponding DNS query: 51.43.248.184
Source: unknown TCP traffic detected without corresponding DNS query: 46.40.242.189
Source: unknown TCP traffic detected without corresponding DNS query: 41.33.115.123
Source: unknown TCP traffic detected without corresponding DNS query: 27.221.129.107
Source: unknown TCP traffic detected without corresponding DNS query: 27.246.251.73
Source: unknown TCP traffic detected without corresponding DNS query: 196.5.160.57
Source: unknown TCP traffic detected without corresponding DNS query: 151.72.101.128
Source: unknown TCP traffic detected without corresponding DNS query: 164.207.204.251
Source: unknown TCP traffic detected without corresponding DNS query: 211.64.83.134
Source: unknown TCP traffic detected without corresponding DNS query: 186.124.150.22
Source: unknown TCP traffic detected without corresponding DNS query: 109.53.201.90
Source: unknown TCP traffic detected without corresponding DNS query: 48.122.85.171
Source: unknown TCP traffic detected without corresponding DNS query: 134.53.126.126
Source: unknown TCP traffic detected without corresponding DNS query: 101.69.186.190
Source: unknown TCP traffic detected without corresponding DNS query: 35.192.132.253
Source: unknown TCP traffic detected without corresponding DNS query: 23.81.144.211
Source: unknown TCP traffic detected without corresponding DNS query: 2.170.75.4
Source: unknown TCP traffic detected without corresponding DNS query: 123.128.227.14
Source: unknown TCP traffic detected without corresponding DNS query: 61.174.14.252
Source: unknown TCP traffic detected without corresponding DNS query: 94.169.220.87
Source: unknown TCP traffic detected without corresponding DNS query: 120.66.163.240
Source: unknown TCP traffic detected without corresponding DNS query: 138.78.237.144
Source: unknown TCP traffic detected without corresponding DNS query: 194.121.24.198
Source: unknown TCP traffic detected without corresponding DNS query: 218.72.207.7
Source: unknown TCP traffic detected without corresponding DNS query: 208.90.152.147
Source: unknown TCP traffic detected without corresponding DNS query: 19.83.41.11
Source: unknown TCP traffic detected without corresponding DNS query: 94.36.143.241
Source: unknown TCP traffic detected without corresponding DNS query: 179.189.80.60
Source: unknown TCP traffic detected without corresponding DNS query: 190.62.164.158
Source: unknown TCP traffic detected without corresponding DNS query: 212.138.86.122
Source: unknown TCP traffic detected without corresponding DNS query: 114.128.64.160
Source: unknown TCP traffic detected without corresponding DNS query: 1.57.151.177
Source: unknown TCP traffic detected without corresponding DNS query: 165.176.121.90
Source: unknown TCP traffic detected without corresponding DNS query: 140.250.142.196
Source: unknown TCP traffic detected without corresponding DNS query: 135.138.60.123
Source: unknown TCP traffic detected without corresponding DNS query: 90.235.248.155
Source: unknown TCP traffic detected without corresponding DNS query: 62.107.252.216
Source: unknown TCP traffic detected without corresponding DNS query: 114.68.96.249
Source: unknown TCP traffic detected without corresponding DNS query: 71.52.144.173
Source: unknown TCP traffic detected without corresponding DNS query: 1.202.148.146
Source: unknown TCP traffic detected without corresponding DNS query: 194.15.117.164
Source: unknown TCP traffic detected without corresponding DNS query: 172.39.163.88
Source: unknown TCP traffic detected without corresponding DNS query: 93.84.48.121
Source: unknown TCP traffic detected without corresponding DNS query: 132.90.74.16

System Summary
barindex
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method.c
Source: ELF static info symbol of initial sample Name: attack_method_greeth
Source: ELF static info symbol of initial sample Name: attack_method_greip
Source: ELF static info symbol of initial sample Name: attack_method_ovh
Source: ELF static info symbol of initial sample Name: attack_method_std
Sample and/or dropped files contains symbols with suspicious names
Source: jew.ppc.elf ELF static info symbol of initial sample: scanner.c
Source: jew.ppc.elf ELF static info symbol of initial sample: scanner_init
Source: jew.ppc.elf ELF static info symbol of initial sample: scanner_pid
Source: jew.ppc.elf ELF static info symbol of initial sample: scanner_rawpkt
Source: classification engine Classification label: mal68.troj.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jew.ppc.elf (PID: 5493) Queries kernel information via 'uname': Jump to behavior
Source: jew.ppc.elf, 5493.1.00007fff2f320000.00007fff2f341000.rw-.sdmp, jew.ppc.elf, 5495.1.00007fff2f320000.00007fff2f341000.rw-.sdmp, jew.ppc.elf, 5499.1.00007fff2f320000.00007fff2f341000.rw-.sdmp Binary or memory string: *x86_64/usr/bin/qemu-ppc/tmp/jew.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jew.ppc.elf
Source: jew.ppc.elf, 5493.1.00005588bc61a000.00005588bc6ca000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: jew.ppc.elf, 5495.1.00005588bc61a000.00005588bc6ca000.rw-.sdmp, jew.ppc.elf, 5499.1.00005588bc61a000.00005588bc6ca000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: jew.ppc.elf, 5493.1.00005588bc61a000.00005588bc6ca000.rw-.sdmp, jew.ppc.elf, 5495.1.00005588bc61a000.00005588bc6ca000.rw-.sdmp, jew.ppc.elf, 5499.1.00005588bc61a000.00005588bc6ca000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: jew.ppc.elf, 5493.1.00007fff2f320000.00007fff2f341000.rw-.sdmp, jew.ppc.elf, 5495.1.00007fff2f320000.00007fff2f341000.rw-.sdmp, jew.ppc.elf, 5499.1.00007fff2f320000.00007fff2f341000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Yara detected Mirai
Source: Yara match File source: jew.ppc.elf, type: SAMPLE
Yara detected Mirai
Source: Yara match File source: jew.ppc.elf, type: SAMPLE

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
191.170.109.180
 unknown Brazil
26615 TIMSABR false
73.86.243.196
 unknown United States
7922 COMCAST-7922US false
60.120.71.149
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
4.88.72.239
 unknown United States
3356 LEVEL3US false
219.4.119.16
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
207.231.68.62
 unknown United States
14051 SUREWESTUS false
133.113.66.185
 unknown Japan 2522 PPP-EXPJapanNetworkInformationCenterJP false
217.217.10.173
 unknown Spain
12357 COMUNITELSPAINES false
174.38.70.163
 unknown United States
22394 CELLCOUS false
126.39.23.176
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
169.194.4.236
 unknown United States
37611 AfrihostZA false
182.49.45.41
 unknown China
9371 SAKURA-CSAKURAInternetIncJP false
40.207.83.129
 unknown United States
4249 LILLY-ASUS false
103.70.118.104
 unknown India
7979 SERVERS-COMUS false
196.37.233.23
 unknown South Africa
3741 ISZA false
94.6.4.174
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
142.134.133.119
 unknown Canada
855 CANET-ASN-4CA false
76.53.39.41
 unknown United States
11426 TWC-11426-CAROLINASUS false
78.7.202.122
 unknown Italy
8968 BT-ITALIAIT false
83.185.2.165
 unknown Sweden
1257 TELE2EU false
92.113.237.57
 unknown Ukraine
6849 UKRTELNETUA false
5.113.65.145
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
67.14.104.25
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
117.2.95.175
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
103.4.200.24
 unknown Japan 36408 CDNETWORKSUS-02US false
59.97.56.222
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
103.155.227.93
 unknown unknown
134687 TWIDC-AS-APTWIDCLimitedHK false
41.25.211.106
 unknown South Africa
36994 Vodacom-VBZA false
82.223.130.245
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE false
18.153.210.97
 unknown United States
16509 AMAZON-02US false
40.253.210.249
 unknown United States
4249 LILLY-ASUS false
184.135.161.162
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
115.19.117.130
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
41.54.60.151
 unknown South Africa
37168 CELL-CZA false
34.144.225.149
 unknown United States
2686 ATGS-MMD-ASUS false
101.242.93.17
 unknown China
17429 BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCN false
196.35.230.255
 unknown South Africa
3741 ISZA false
108.178.45.166
 unknown United States
32475 SINGLEHOP-LLCUS false
9.210.181.9
 unknown United States
3356 LEVEL3US false
133.245.237.21
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
92.43.254.211
 unknown France
16128 AGARIK-NETWORKAGARIKprovideWEBServersHostinganddedic false
206.14.215.188
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
144.227.128.130
 unknown United States
1239 SPRINTLINKUS false
142.37.207.55
 unknown Canada
3633 PROVINCE-OF-BRITISH-COLUMBIACA false
145.225.99.199
 unknown Germany
25039 ASN-LINDEKlosterhofstrasse1DE false
47.155.118.94
 unknown United States
5650 FRONTIER-FRTRUS false
186.52.46.18
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
1.191.108.182
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
191.136.191.166
 unknown Brazil
26615 TIMSABR false
222.9.206.243
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
106.122.250.231
 unknown China
133774 CHINATELECOM-FUJIAN-FUZHOU-IDC1FuzhouCN false
152.163.66.86
 unknown United States
12129 123NETUS false
42.176.82.66
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
203.209.163.255
 unknown Australia
7604 ZETTAGRID-ASZETTAGRIDCLOUDAU false
65.24.137.120
 unknown United States
10796 TWC-10796-MIDWESTUS false
172.203.97.174
 unknown United States
18747 IFX18747US false
8.96.5.93
 unknown United States
3356 LEVEL3US false
71.228.151.31
 unknown United States
7922 COMCAST-7922US false
96.3.154.28
 unknown United States
11232 MIDCO-NETUS false
2.218.141.123
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
166.65.237.92
 unknown New Zealand
38495 TRANSPOWER-B-AS-APTranspowerNewZealandLtdAU false
96.129.174.123
 unknown United States
7922 COMCAST-7922US false
84.204.153.106
 unknown Russian Federation
20632 PETERSTAR-ASSaint-PetersburgRU false
105.46.19.22
 unknown Egypt
37069 MOBINILEG false
43.159.230.95
 unknown Japan 4249 LILLY-ASUS false
195.164.130.157
 unknown Poland
204679 OSEPL false
145.116.23.188
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
72.199.100.229
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
91.133.239.23
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
147.43.228.88
 unknown Korea Republic of
7564 KAERINET-ASKoreaAtomicEnergyResearchInstituteKR false
98.171.80.165
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
2.199.221.208
 unknown Italy
16232 ASN-TIMServiceProviderIT false
78.180.205.51
 unknown Turkey
9121 TTNETTR false
40.111.155.181
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
5.244.19.224
 unknown Saudi Arabia
34400 ASN-ETTIHADETISALATSA false
116.23.60.185
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
23.232.175.19
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
68.76.173.211
 unknown United States
7018 ATT-INTERNET4US false
160.76.84.100
 unknown United States
36693 ALEGENT-HEALTH-1US false
62.19.162.189
 unknown Italy
16232 ASN-TIMServiceProviderIT false
220.131.41.177
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
5.190.114.223
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
50.242.16.25
 unknown United States
7922 COMCAST-7922US false
43.225.35.44
 unknown Australia
58511 ANYCAST-GLOBAL-BACKBONEAnycastGlobalBackboneAU false
66.219.33.34
 unknown United States
27325 ZCOLO-AUS01US false
27.77.16.56
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
37.59.96.120
 unknown France
16276 OVHFR false
4.43.121.23
 unknown United States
3356 LEVEL3US false
25.94.113.175
 unknown United Kingdom
7922 COMCAST-7922US false
46.136.83.150
 unknown Spain
12430 VODAFONE_ESES false
160.20.5.95
 unknown unknown
45194 SIPL-ASSysconInfowayPvtLtdIN false
159.22.250.34
 unknown Switzerland
200544 SWISS-DEFENCE-AFCSOCH false
187.195.234.227
 unknown Mexico
8151 UninetSAdeCVMX false
138.190.191.48
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
186.125.176.152
 unknown Argentina
7303 TelecomArgentinaSAAR false
25.43.128.198
 unknown United Kingdom
7922 COMCAST-7922US false
8.232.159.229
 unknown United States
3356 LEVEL3US false
126.16.71.147
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
40.244.177.132
 unknown United States
4249 LILLY-ASUS false
191.61.206.235
 unknown Brazil
53037 NEXTELTELECOMUNICACOESLTDABR false