Linux Analysis Report
jew.spc.elf

Overview

General Information

Sample name: jew.spc.elf
Analysis ID: 1544654
MD5: 9076db7829e44ad581ded5e4e08a2c57
SHA1: 5ff8f7a1cdfd6cae7e6a1d77fb8c42e960222215
SHA256: cb96433c5ba833eb16573ad675e8897bd323ae76194df92912fe1fb850c03dc3
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara detected Mirai

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: jew.spc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: jew.spc.elf ReversingLabs: Detection: 55%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:57414 -> 147.45.79.174:9931
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 80.87.85.122:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 40.63.120.153:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 57.78.50.41:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 92.56.98.38:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 134.124.121.245:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 132.194.13.226:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 101.158.46.206:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 17.49.146.183:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 140.58.88.213:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 65.125.29.156:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 205.184.50.196:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 207.84.155.107:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 161.98.45.198:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 200.10.74.100:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 116.145.81.147:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 212.204.45.59:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 211.69.100.91:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 162.14.127.179:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 157.245.78.29:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 95.234.151.102:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 137.44.237.36:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 5.85.148.11:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 174.61.56.239:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 129.222.218.206:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 101.202.181.12:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 195.153.140.192:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 13.44.205.175:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 151.38.138.95:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 182.154.181.44:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 5.15.55.218:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 106.227.249.249:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 115.34.7.100:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 68.2.201.225:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 32.90.129.95:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 83.110.119.217:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 92.98.19.4:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 222.178.123.191:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 17.167.114.167:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 75.139.160.109:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 58.31.20.64:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 217.163.170.94:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 63.253.189.253:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 181.57.25.64:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 139.152.31.144:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 14.131.11.222:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 34.118.168.24:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 48.3.178.0:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 108.133.125.164:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 69.211.197.191:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 103.156.159.110:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 107.34.215.40:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 89.147.1.192:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 183.171.105.228:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 160.122.18.127:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 182.108.120.46:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 111.188.254.227:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 130.209.23.89:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 144.241.1.94:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 113.215.4.250:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 83.116.35.96:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 53.146.255.112:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 45.99.68.37:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 27.240.152.130:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 191.231.195.48:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 103.98.1.140:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 19.55.50.99:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 27.3.173.77:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 109.214.253.63:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 96.218.128.71:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 213.39.239.68:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 38.144.208.228:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 160.64.12.221:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 203.157.189.33:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 211.119.80.159:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 82.247.117.82:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 123.23.170.59:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 67.128.27.22:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 95.145.84.39:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 23.28.74.108:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 108.58.134.100:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 51.89.38.147:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 162.27.4.180:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 43.75.252.122:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 65.170.150.40:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 213.119.68.170:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 86.55.247.145:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 146.19.87.186:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 138.63.219.27:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 72.201.143.223:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 73.216.147.121:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 145.223.144.193:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 111.132.224.17:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 147.216.41.215:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 107.150.67.96:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 113.147.8.211:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 145.237.204.68:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 2.48.156.8:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 4.239.88.69:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 64.191.42.220:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 86.198.199.142:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 46.152.168.255:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 25.65.18.81:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 53.12.73.134:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 50.20.90.77:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 41.76.234.227:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 141.224.164.207:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 137.76.118.93:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 221.164.207.250:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 96.252.96.93:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 37.103.7.76:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 88.156.217.20:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 50.239.106.144:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 102.54.102.128:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 51.85.75.89:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 174.212.144.132:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 116.202.184.146:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 141.71.119.125:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 156.82.216.41:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 219.124.167.189:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 169.89.44.119:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 201.80.130.19:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 60.209.62.242:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 32.214.3.181:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 70.183.244.244:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 37.248.59.77:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 151.16.49.191:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 168.55.20.153:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 62.17.59.244:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 109.7.244.43:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 49.49.10.53:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 152.130.189.116:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 183.132.66.223:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 216.74.140.175:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 85.4.96.37:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 39.135.194.62:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 58.154.165.24:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 179.104.70.126:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 25.78.64.151:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 204.193.203.127:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 62.106.201.103:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 199.123.44.7:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 130.42.209.235:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 119.103.102.138:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 41.116.3.203:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 181.166.180.252:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 180.173.204.150:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 124.201.166.23:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 203.151.16.30:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 186.71.87.243:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 151.5.9.127:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 65.145.217.89:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 205.80.2.170:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 110.229.219.205:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 75.154.124.105:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 44.240.31.124:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 129.157.244.44:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 138.211.23.0:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 183.87.2.35:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 170.147.245.75:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 171.211.252.220:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 144.152.96.128:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 126.20.185.25:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 35.212.40.115:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 82.170.244.166:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 106.78.194.126:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 104.152.6.146:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 149.173.180.223:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 82.240.231.98:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 104.209.110.133:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 174.81.110.92:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 210.38.2.24:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 51.72.59.86:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 98.165.110.67:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 71.151.191.189:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 99.4.189.170:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 69.108.75.10:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 4.3.100.17:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 177.189.61.177:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 13.191.137.178:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 31.239.132.233:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 153.94.197.180:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 216.156.143.147:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 140.245.177.97:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 44.154.210.95:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 14.196.224.109:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 13.93.152.141:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 211.71.7.121:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 73.83.173.100:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 217.123.130.8:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 110.8.77.90:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 223.248.218.89:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 128.134.118.88:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 145.163.30.177:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 171.149.237.167:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 144.142.165.101:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 18.135.62.158:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 167.102.64.177:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 102.70.186.3:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 88.55.93.251:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 70.34.82.174:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 107.63.216.143:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 103.131.252.128:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 209.177.173.18:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 57.173.183.128:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 108.142.46.181:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 157.214.102.152:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 82.100.218.143:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 59.199.76.246:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 35.163.31.142:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 219.237.212.29:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 27.255.185.132:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 173.67.218.97:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 196.169.165.236:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 91.109.207.111:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 116.125.39.125:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 60.53.30.73:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 139.148.16.7:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 116.172.21.24:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 205.239.183.73:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 126.45.217.64:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 118.187.138.251:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 71.140.172.19:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 154.40.220.243:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 205.153.188.47:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 111.79.186.70:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 126.223.129.159:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 27.48.158.186:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 202.229.164.212:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 199.5.196.103:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 115.73.173.114:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 220.85.149.135:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 120.250.233.7:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 154.98.54.200:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 111.163.84.200:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 63.133.152.126:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 23.27.52.32:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 78.92.115.250:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 104.1.89.109:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 136.154.174.162:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 14.7.13.97:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 205.242.37.118:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 129.2.154.89:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 189.167.207.151:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 213.143.239.245:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 177.11.25.239:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 157.250.155.12:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 144.61.250.128:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 98.4.53.98:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 189.21.97.76:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 150.57.37.110:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 193.99.136.91:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 131.194.31.213:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 93.8.41.50:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 59.82.125.252:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 109.66.144.202:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 72.250.58.141:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 139.117.232.11:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 200.11.38.225:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 75.205.251.35:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 194.132.202.86:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 37.124.235.88:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 57.48.99.46:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 151.137.202.83:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 204.53.123.195:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 93.52.74.190:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 178.144.150.211:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 143.206.60.86:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 193.223.231.114:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 203.89.161.63:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 222.91.13.223:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 154.43.39.149:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 121.115.76.221:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 1.59.82.131:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 62.207.82.137:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 179.162.189.187:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 76.128.66.127:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 19.76.195.172:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 19.200.140.103:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 72.18.205.237:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 153.204.35.74:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 45.123.100.170:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 168.249.195.48:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 47.43.233.69:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 182.179.118.78:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 77.88.24.222:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 2.132.226.145:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 140.12.17.108:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 202.243.93.120:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 110.212.180.104:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 216.82.152.71:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 79.1.125.249:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 152.120.87.15:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 148.153.223.250:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 181.53.177.30:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 83.20.65.91:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 177.140.166.147:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 95.138.132.198:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 70.15.0.162:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 65.56.160.244:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 209.179.84.197:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 133.255.62.70:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 113.217.245.79:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 152.133.79.57:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 213.40.77.166:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 129.70.122.59:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 180.37.78.236:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 123.26.177.38:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 167.218.150.23:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 72.47.227.232:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 20.197.242.75:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 202.57.249.235:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 66.105.97.120:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 4.191.1.38:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 86.43.46.9:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 198.161.246.89:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 213.215.229.129:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 182.183.190.148:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 175.14.77.205:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 14.195.21.114:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 163.255.16.200:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 62.243.141.134:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 159.36.80.65:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 9.108.165.50:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 51.56.36.112:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 190.74.69.68:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 170.123.166.210:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 163.173.121.35:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 182.176.11.44:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 136.110.198.146:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 157.130.213.103:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 73.172.23.78:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 37.7.232.135:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 138.101.108.41:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 133.251.215.23:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 145.124.196.139:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 45.158.229.104:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 86.156.227.109:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 105.71.208.55:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 207.12.152.139:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 108.179.1.120:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 112.35.5.47:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 60.225.172.159:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 115.116.204.46:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 183.97.198.31:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 194.191.82.1:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 135.84.245.2:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 163.209.149.99:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 87.163.5.204:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 58.139.234.149:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 14.60.171.242:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 93.69.68.132:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 135.133.249.76:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 119.98.39.31:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 221.163.244.119:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 59.38.76.134:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 45.165.207.223:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 169.244.12.178:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 49.84.148.36:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 132.99.167.43:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 207.46.112.195:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 177.113.170.221:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 66.244.53.181:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 95.204.163.116:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 79.166.251.25:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 17.166.25.138:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 17.133.124.48:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 128.163.181.126:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 121.40.110.166:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 194.113.77.218:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 198.89.46.73:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 158.138.167.182:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 201.241.29.149:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 46.56.13.59:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 115.169.145.221:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 88.183.158.231:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 43.168.87.214:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 139.193.169.62:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 93.38.152.4:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 190.39.93.108:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 94.128.240.152:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 170.214.68.125:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 116.228.182.135:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 79.158.34.84:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 110.88.62.249:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 63.175.171.66:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 169.226.200.43:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 1.206.216.172:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 62.203.200.161:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 46.1.123.135:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 49.169.207.82:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 133.108.108.163:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 220.82.116.176:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 107.251.61.202:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 159.15.35.253:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 154.224.63.249:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 206.154.88.25:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 72.183.123.8:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 65.194.12.148:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 193.214.136.151:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 78.74.122.17:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 99.24.148.64:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 62.233.28.243:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 101.111.248.63:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 89.29.38.54:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 146.62.185.24:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 68.40.225.38:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 115.87.86.242:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 183.36.232.61:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 41.12.252.72:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 125.178.87.149:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 198.25.231.17:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 184.55.91.164:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 70.132.2.123:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 198.118.104.24:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 59.253.133.27:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 161.254.131.156:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 1.30.202.126:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 87.196.93.4:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 93.246.160.99:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 80.111.249.227:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 222.97.122.171:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 156.48.89.183:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 137.157.232.251:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 58.245.18.94:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 135.202.14.224:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 75.69.133.5:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 99.182.53.254:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 115.196.25.230:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 77.66.216.67:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 25.50.41.41:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 92.98.234.103:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 38.88.64.202:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 31.173.249.222:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 45.31.62.109:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 44.2.251.42:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 59.102.105.21:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 14.162.62.103:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 170.39.57.217:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 212.75.213.46:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 13.171.207.146:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 45.62.45.52:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 2.2.244.13:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 121.3.243.39:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 144.8.59.127:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 203.121.190.143:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 38.64.128.106:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 39.159.69.195:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 210.244.109.249:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 195.114.97.92:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 159.223.63.231:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 4.183.150.59:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 207.55.120.200:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 52.165.56.159:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 83.84.82.227:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 200.204.188.249:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 131.47.185.61:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 183.78.72.87:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 118.191.25.104:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 153.172.235.23:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 81.128.117.71:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 99.115.74.109:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 74.160.153.9:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 195.189.210.126:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 184.154.73.126:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 177.110.200.144:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 189.194.97.55:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 137.216.66.77:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 62.177.136.113:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 94.178.143.38:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 129.114.12.21:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 157.135.247.250:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 59.107.169.252:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 89.84.34.132:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 156.219.103.78:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 163.41.22.253:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 34.142.154.237:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 181.151.188.175:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 218.173.51.203:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 67.247.135.52:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 182.144.44.51:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 147.236.38.25:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 8.164.216.178:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 137.76.208.240:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 78.225.83.37:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 43.173.160.225:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 150.223.184.19:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 104.251.147.49:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 198.154.171.130:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 144.42.171.135:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 86.74.33.202:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 131.197.205.73:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 147.118.164.195:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 13.236.45.231:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 129.129.233.186:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 38.46.170.82:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 45.191.172.222:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 87.84.169.18:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 115.76.158.91:2323
Source: global traffic TCP traffic: 192.168.2.15:18435 -> 209.138.67.203:2323
Sample listens on a socket
Source: /tmp/jew.spc.elf (PID: 5522) Socket: 127.0.0.1:1926 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 80.87.85.122
Source: unknown TCP traffic detected without corresponding DNS query: 106.63.58.122
Source: unknown TCP traffic detected without corresponding DNS query: 170.253.231.121
Source: unknown TCP traffic detected without corresponding DNS query: 32.165.108.174
Source: unknown TCP traffic detected without corresponding DNS query: 142.255.213.203
Source: unknown TCP traffic detected without corresponding DNS query: 9.85.161.58
Source: unknown TCP traffic detected without corresponding DNS query: 41.220.106.232
Source: unknown TCP traffic detected without corresponding DNS query: 152.208.180.134
Source: unknown TCP traffic detected without corresponding DNS query: 43.185.158.143
Source: unknown TCP traffic detected without corresponding DNS query: 40.63.120.153
Source: unknown TCP traffic detected without corresponding DNS query: 61.212.25.64
Source: unknown TCP traffic detected without corresponding DNS query: 5.66.61.215
Source: unknown TCP traffic detected without corresponding DNS query: 102.30.246.11
Source: unknown TCP traffic detected without corresponding DNS query: 141.171.199.29
Source: unknown TCP traffic detected without corresponding DNS query: 173.94.199.39
Source: unknown TCP traffic detected without corresponding DNS query: 123.22.207.109
Source: unknown TCP traffic detected without corresponding DNS query: 206.51.235.177
Source: unknown TCP traffic detected without corresponding DNS query: 97.188.162.248
Source: unknown TCP traffic detected without corresponding DNS query: 119.255.7.206
Source: unknown TCP traffic detected without corresponding DNS query: 57.78.50.41
Source: unknown TCP traffic detected without corresponding DNS query: 109.20.173.58
Source: unknown TCP traffic detected without corresponding DNS query: 204.4.212.208
Source: unknown TCP traffic detected without corresponding DNS query: 102.242.99.76
Source: unknown TCP traffic detected without corresponding DNS query: 59.227.227.14
Source: unknown TCP traffic detected without corresponding DNS query: 18.57.109.178
Source: unknown TCP traffic detected without corresponding DNS query: 43.83.179.214
Source: unknown TCP traffic detected without corresponding DNS query: 107.198.156.253
Source: unknown TCP traffic detected without corresponding DNS query: 76.80.46.156
Source: unknown TCP traffic detected without corresponding DNS query: 92.56.98.38
Source: unknown TCP traffic detected without corresponding DNS query: 39.240.21.13
Source: unknown TCP traffic detected without corresponding DNS query: 1.169.213.138
Source: unknown TCP traffic detected without corresponding DNS query: 54.208.109.112
Source: unknown TCP traffic detected without corresponding DNS query: 159.7.77.6
Source: unknown TCP traffic detected without corresponding DNS query: 71.57.164.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.42.166.156
Source: unknown TCP traffic detected without corresponding DNS query: 155.126.62.106
Source: unknown TCP traffic detected without corresponding DNS query: 134.124.121.245
Source: unknown TCP traffic detected without corresponding DNS query: 182.126.139.25
Source: unknown TCP traffic detected without corresponding DNS query: 34.253.61.55
Source: unknown TCP traffic detected without corresponding DNS query: 223.109.26.101
Source: unknown TCP traffic detected without corresponding DNS query: 207.84.158.88
Source: unknown TCP traffic detected without corresponding DNS query: 136.228.179.142
Source: unknown TCP traffic detected without corresponding DNS query: 88.15.100.244
Source: unknown TCP traffic detected without corresponding DNS query: 13.199.229.204
Source: unknown TCP traffic detected without corresponding DNS query: 68.39.71.47
Source: unknown TCP traffic detected without corresponding DNS query: 126.27.108.21
Source: unknown TCP traffic detected without corresponding DNS query: 88.196.5.96

System Summary
barindex
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method.c
Source: ELF static info symbol of initial sample Name: attack_method_greeth
Source: ELF static info symbol of initial sample Name: attack_method_greip
Source: ELF static info symbol of initial sample Name: attack_method_ovh
Source: ELF static info symbol of initial sample Name: attack_method_std
Sample and/or dropped files contains symbols with suspicious names
Source: jew.spc.elf ELF static info symbol of initial sample: scanner.c
Source: jew.spc.elf ELF static info symbol of initial sample: scanner_init
Source: jew.spc.elf ELF static info symbol of initial sample: scanner_pid
Source: jew.spc.elf ELF static info symbol of initial sample: scanner_rawpkt
Source: classification engine Classification label: mal68.troj.linELF@0/0@0/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jew.spc.elf (PID: 5522) Queries kernel information via 'uname': Jump to behavior
Source: jew.spc.elf, 5522.1.000055761874e000.00005576187b3000.rw-.sdmp, jew.spc.elf, 5524.1.000055761874e000.00005576187b3000.rw-.sdmp, jew.spc.elf, 5528.1.000055761874e000.00005576187b3000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: jew.spc.elf, 5522.1.000055761874e000.00005576187b3000.rw-.sdmp, jew.spc.elf, 5524.1.000055761874e000.00005576187b3000.rw-.sdmp, jew.spc.elf, 5528.1.000055761874e000.00005576187b3000.rw-.sdmp Binary or memory string: vU!/etc/qemu-binfmt/sparc
Source: jew.spc.elf, 5522.1.00007ffddf550000.00007ffddf571000.rw-.sdmp, jew.spc.elf, 5524.1.00007ffddf550000.00007ffddf571000.rw-.sdmp, jew.spc.elf, 5528.1.00007ffddf550000.00007ffddf571000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/jew.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jew.spc.elf
Source: jew.spc.elf, 5522.1.00007ffddf550000.00007ffddf571000.rw-.sdmp, jew.spc.elf, 5524.1.00007ffddf550000.00007ffddf571000.rw-.sdmp, jew.spc.elf, 5528.1.00007ffddf550000.00007ffddf571000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Yara detected Mirai
Source: Yara match File source: jew.spc.elf, type: SAMPLE
Yara detected Mirai
Source: Yara match File source: jew.spc.elf, type: SAMPLE
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
4.246.129.170
 unknown United States
3356 LEVEL3US false
206.99.173.173
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
208.194.86.225
 unknown United States
701 UUNETUS false
69.123.181.103
 unknown United States
6128 CABLE-NET-1US false
54.176.161.41
 unknown United States
16509 AMAZON-02US false
169.203.35.185
 unknown United States
22920 BIAEDNET-INTERNETUS false
189.233.26.113
 unknown Mexico
8151 UninetSAdeCVMX false
183.5.238.228
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
77.125.152.103
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
208.144.203.122
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
141.16.126.126
 unknown Germany
8204 FTA-NETDE false
53.85.132.135
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
38.230.154.36
 unknown United States
174 COGENT-174US false
83.19.239.35
 unknown Poland
5617 TPNETPL false
89.45.44.174
 unknown Romania
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
192.195.74.52
 unknown United States
393282 UCB-1US false
156.254.70.156
 unknown Seychelles
135357 SKHT-ASShenzhenKatherineHengTechnologyInformationCo false
140.245.177.189
 unknown United States
22488 CENGAGE-NYALBUS false
17.172.63.166
 unknown United States
714 APPLE-ENGINEERINGUS false
221.145.103.227
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
115.247.172.151
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
78.46.244.4
 unknown Germany
24940 HETZNER-ASDE false
213.214.102.19
 unknown Netherlands
34762 COMBELL-ASBE false
34.41.107.148
 unknown United States
2686 ATGS-MMD-ASUS false
106.204.163.94
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
153.212.19.18
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
141.186.118.97
 unknown United States
197921 HBTFJO false
58.72.118.48
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
158.102.58.221
 unknown Italy
2594 ASN-CSIIT false
139.40.24.226
 unknown United States
9905 LINKNET-ID-APLinknetASNID false
150.135.249.231
 unknown United States
1706 UNIV-ARIZUS false
174.14.19.120
 unknown United States
6327 SHAWCA false
157.250.6.158
 unknown United States
32934 FACEBOOKUS false
184.50.112.87
 unknown United States
16625 AKAMAI-ASUS false
136.182.189.99
 unknown United States
19773 MOTOROLAUS false
157.249.142.110
 unknown Norway
224 UNINETTUNINETTTheNorwegianUniversityResearchNetwork false
154.91.253.87
 unknown Seychelles
134705 ITACE-AS-APItaceInternationalLimitedHK false
194.50.24.97
 unknown Russian Federation
198933 OOO-SEVERO-ZAPADNYE-TELEKOMMUNIKACII-ASRU false
34.241.254.68
 unknown United States
16509 AMAZON-02US false
221.110.112.163
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
184.118.230.138
 unknown United States
7922 COMCAST-7922US false
52.39.215.240
 unknown United States
16509 AMAZON-02US false
90.163.70.19
 unknown Spain
12479 UNI2-ASES false
20.148.76.19
 unknown United States
4237 CSC-IGN-FTWUS false
25.190.123.149
 unknown United Kingdom
7922 COMCAST-7922US false
112.118.236.48
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
117.12.4.140
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
121.194.15.236
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
23.72.69.171
 unknown United States
16625 AKAMAI-ASUS false
18.63.154.79
 unknown United States
3 MIT-GATEWAYSUS false
66.111.87.136
 unknown Canada
13768 COGECO-PEER1CA false
93.83.159.214
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false
62.88.243.198
 unknown Sweden
25387 ASN-GOTEBORGSE false
117.166.122.197
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
152.249.182.38
 unknown Brazil
27699 TELEFONICABRASILSABR false
88.87.107.73
 unknown Italy
34606 ASN-BBBELLIT false
32.194.234.194
 unknown United States
2686 ATGS-MMD-ASUS false
40.6.193.206
 unknown United States
4249 LILLY-ASUS false
219.39.78.6
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
176.68.84.155
 unknown Sweden
1257 TELE2EU false
34.117.135.34
 unknown United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
132.89.222.4
 unknown United States
306 DNIC-ASBLK-00306-00371US false
180.190.143.80
 unknown Philippines
132199 GLOBE-MOBILE-5TH-GEN-ASGlobeTelecomIncPH false
199.14.142.148
 unknown United States
1767 ILIGHT-NETUS false
105.79.168.17
 unknown Morocco
36884 MAROCCONNECTMA false
111.213.127.105
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
51.188.226.213
 unknown United States
2686 ATGS-MMD-ASUS false
14.245.79.86
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
156.215.189.82
 unknown Egypt
8452 TE-ASTE-ASEG false
42.30.201.178
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
46.76.118.206
 unknown Poland
8374 PLUSNETPlusnetworkoperatorinPolandPL false
50.122.165.35
 unknown United States
5650 FRONTIER-FRTRUS false
89.207.8.158
 unknown Switzerland
31662 KNSURSELVAKommunikationsNetzSurselvaCH false
23.130.172.164
 unknown Reserved
393742 CONCENTRICSKYUS false
199.102.121.244
 unknown United States
20154 AIRBITSUS false
96.190.47.247
 unknown United States
7922 COMCAST-7922US false
118.106.220.122
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
133.91.141.240
 unknown Japan 23623 CHUO-UChuoUniversityJP false
198.120.29.22
 unknown United States
297 AS297US false
182.200.111.126
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
146.4.138.94
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
205.54.133.54
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
198.6.27.53
 unknown United States
6485 UNASSIGNED false
169.122.104.46
 unknown United States
37611 AfrihostZA false
154.141.69.17
 unknown Egypt
37069 MOBINILEG false
108.9.172.22
 unknown United States
5650 FRONTIER-FRTRUS false
137.180.86.76
 unknown United States
11003 PANDGUS false
62.60.7.66
 unknown United Kingdom
6779 ICLNET-ASFujitsuASGB false
206.31.147.53
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
75.116.95.254
 unknown United States
6167 CELLCO-PARTUS false
64.206.242.123
 unknown United States
7029 WINDSTREAMUS false
123.186.139.227
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
182.224.199.62
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
88.98.151.107
 unknown United Kingdom
13037 ZEN-ASZenInternet-UKGB false
126.171.38.141
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
58.216.168.13
 unknown China
134769 CHINANET-JIANGSU-CHANGZHOU-IDCChinaNetJiangsuChangzhouID false
160.183.15.36
 unknown Gambia
37309 QCellGM false
132.214.106.172
 unknown Canada
33602 TELUQCA false
52.142.54.250
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
193.169.11.98
 unknown Germany
19229 IFOXNETODPD-ENSONO-DCCSUS false