Linux Analysis Report
jew.mips.elf

Overview

General Information

Sample name: jew.mips.elf
Analysis ID: 1544656
MD5: 9fda843c0fb54218187d68fb233e0817
SHA1: e90294f0c2746e48c0a6c8d88f8f894c2d64d703
SHA256: 3ed0aa70111973b632fda6d1481daeee52b3d6633d4ab9f3d6725f905d3fced7
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara detected Mirai

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: jew.mips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: jew.mips.elf ReversingLabs: Detection: 52%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:55354 -> 147.45.79.174:9931
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 123.101.169.110:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 113.244.226.200:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 174.47.205.206:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 94.132.152.104:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 131.184.245.70:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 166.86.60.105:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 159.232.111.155:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 9.128.124.26:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 14.234.54.86:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 68.109.43.110:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 193.49.91.203:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 134.93.223.214:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 109.236.223.234:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 82.79.186.25:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 188.178.107.14:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 147.57.14.94:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 98.51.136.113:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 94.180.14.27:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 131.133.86.1:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 32.175.119.184:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 188.211.219.231:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 195.144.31.199:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 191.222.36.198:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 34.57.38.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 67.57.229.161:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 57.118.166.156:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 9.145.188.10:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 43.125.211.76:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 203.141.147.237:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 109.109.46.106:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 146.31.152.76:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 200.64.190.86:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 51.0.152.40:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 129.118.123.196:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 53.31.90.148:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 1.236.175.27:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 12.223.197.237:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 126.62.2.220:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 156.110.122.193:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 210.116.22.153:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 107.63.76.55:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 191.72.69.40:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 218.81.19.121:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 68.248.194.198:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 131.39.168.171:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 152.14.90.225:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 62.113.21.182:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 105.237.13.156:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 208.61.121.166:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 110.126.193.181:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 196.116.4.78:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 81.35.75.108:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 119.210.84.40:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 35.16.24.62:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 196.131.18.228:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 42.164.181.50:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 142.17.16.115:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 98.202.123.146:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 194.193.48.198:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 70.237.210.97:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 223.160.73.255:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 190.97.112.127:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 163.27.110.88:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 161.103.1.23:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.44.151.196:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 64.100.6.97:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 8.43.44.3:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 221.168.65.102:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 102.184.2.159:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.39.103.121:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 74.11.116.41:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 83.69.67.83:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 108.69.24.40:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 125.156.202.55:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.100.228.24:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 121.169.139.245:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 163.129.18.16:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 101.156.253.18:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 140.62.36.59:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 75.93.99.128:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.95.70.51:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 144.219.53.15:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 159.2.204.73:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 144.197.253.17:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 175.145.107.160:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 111.131.85.211:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 48.82.115.47:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 119.225.20.108:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 103.52.215.149:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 54.85.95.233:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 186.149.31.232:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 43.76.160.154:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 141.117.73.186:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 45.34.162.104:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 74.24.16.183:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 82.174.104.157:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 35.27.196.214:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 137.66.45.116:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 121.177.104.40:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 109.225.68.237:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 184.92.85.27:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 221.231.223.189:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 191.95.203.0:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 93.63.214.208:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 35.238.194.228:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 213.207.248.200:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 124.240.149.16:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 136.226.129.138:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 18.80.170.238:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 177.108.223.104:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 24.230.119.146:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 65.68.179.16:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 153.190.77.120:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 35.215.80.224:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 48.130.217.248:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 137.70.225.49:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 79.248.244.212:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 123.148.188.65:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 128.177.177.48:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 170.6.207.252:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 82.138.178.46:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 84.94.203.164:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 128.59.207.66:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 35.213.42.194:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 40.135.230.235:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 112.24.115.200:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 91.35.141.236:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 133.176.163.143:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 188.133.229.235:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 199.250.28.30:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 44.215.197.126:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 13.23.204.190:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 126.86.167.93:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 190.45.72.72:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 185.156.244.65:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 47.150.57.35:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 148.231.107.28:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 74.199.45.74:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 139.62.215.175:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 156.26.169.208:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 13.109.87.190:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 52.231.8.148:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 116.52.39.193:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 1.157.129.97:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 94.239.231.189:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 66.33.207.252:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 4.157.124.2:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 86.59.156.100:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 73.178.111.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 173.254.76.182:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 59.184.56.51:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 153.41.222.64:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 177.163.3.48:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 137.157.142.101:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 44.48.254.237:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 169.26.117.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 77.6.203.190:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 147.175.53.57:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 156.104.247.69:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 139.198.41.78:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 13.133.197.159:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 27.168.123.205:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 170.7.101.134:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 222.249.58.0:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 123.63.238.202:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 99.75.224.35:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 72.63.61.128:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 101.255.0.203:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 103.18.192.163:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 88.40.214.204:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 136.159.87.217:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.27.78.181:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 168.52.142.195:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 164.78.162.103:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 77.145.196.63:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 142.71.183.228:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 218.171.79.96:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 105.81.97.87:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 39.56.63.130:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 198.24.3.212:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 202.16.163.74:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 136.16.119.222:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 204.219.35.126:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 91.107.225.168:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 102.167.200.156:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 89.241.130.74:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 216.91.2.228:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 157.1.104.170:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 203.63.194.143:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 163.82.135.244:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 66.224.9.87:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 178.58.94.53:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 92.223.11.103:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 40.108.98.143:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 79.113.228.84:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 142.169.117.111:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 34.66.61.98:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 45.177.205.47:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 188.19.249.99:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 106.158.199.239:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 180.203.70.15:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 179.157.252.226:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 84.242.230.233:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 139.125.114.128:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 58.85.143.198:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 130.114.74.2:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 68.60.78.248:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 64.247.97.104:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 46.51.116.68:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 81.143.21.100:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 8.208.193.109:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 133.127.132.31:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 136.121.216.122:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 97.149.174.29:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 47.224.110.131:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 32.183.241.40:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 18.34.239.24:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 152.188.206.49:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 204.97.169.220:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 182.20.199.189:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 76.121.87.170:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 149.45.184.87:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 4.203.163.229:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 159.207.198.172:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 167.56.58.153:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 218.68.38.146:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 19.53.95.35:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 204.238.75.212:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 205.137.188.92:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 145.100.42.49:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 191.96.81.180:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 19.178.81.78:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 39.0.59.244:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 162.147.8.145:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 49.187.245.211:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 183.39.223.209:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 4.214.122.168:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 114.172.37.137:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 20.234.25.169:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 12.44.223.143:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 99.125.152.99:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 23.107.85.3:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 169.159.27.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 8.70.242.89:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 93.169.120.35:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 49.155.47.6:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 72.151.93.63:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 158.178.217.97:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 72.235.65.239:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 152.115.146.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 78.216.148.31:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 70.101.153.246:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 48.226.12.239:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 144.177.100.214:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 144.251.233.193:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 58.242.51.25:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 51.46.24.69:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 134.211.229.164:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 27.214.168.77:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 40.76.205.160:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 27.80.37.62:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 122.201.154.126:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 9.154.247.152:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 95.163.115.81:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 90.228.127.194:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 190.174.72.226:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 113.168.75.206:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 186.147.65.109:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 153.142.76.66:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 181.186.211.237:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 138.46.137.217:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 96.216.204.45:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 80.152.202.127:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 12.206.126.66:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 67.219.51.217:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 79.234.174.98:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 54.41.153.149:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 207.250.132.115:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 163.165.135.153:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 4.98.20.108:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 143.62.221.19:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 164.231.203.66:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 171.69.47.239:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 128.202.192.30:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 73.175.228.139:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 42.215.189.208:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 36.52.96.67:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 160.74.123.181:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 102.245.38.209:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 72.182.182.10:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 158.112.243.49:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 159.190.233.169:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 5.125.104.253:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 31.15.254.20:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 60.251.17.24:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 188.226.202.162:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 219.78.110.231:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 118.235.86.15:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 54.43.55.255:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 151.45.210.191:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 186.54.125.197:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 88.184.6.59:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 36.102.140.30:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 160.232.96.116:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 189.31.47.45:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 109.116.51.233:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 189.124.170.166:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.70.140.138:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 182.198.153.211:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 208.3.86.170:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 63.220.227.210:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 112.153.219.132:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 72.95.185.195:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 24.86.147.106:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.73.209.222:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 122.218.196.236:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 182.210.137.184:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 185.141.42.195:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 82.238.136.181:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 66.133.9.84:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 154.32.178.135:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 57.183.144.145:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 1.43.101.38:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 199.171.205.144:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 84.59.219.5:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 82.118.180.180:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 200.212.254.222:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 81.126.102.246:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 156.197.248.220:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 67.126.66.158:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 150.14.59.160:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 45.48.193.184:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 193.76.185.204:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 96.6.17.9:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 122.169.240.111:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 39.65.176.166:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 8.165.182.237:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 174.232.59.181:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 154.107.7.139:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 198.34.152.243:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 92.229.85.144:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 96.11.185.121:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 101.96.165.243:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 9.149.215.202:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 57.120.95.213:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 60.157.116.97:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 220.12.167.178:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 102.233.246.115:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 188.200.86.77:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 1.230.126.10:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 189.115.195.76:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.182.95.133:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 201.178.46.225:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 153.49.125.22:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 186.60.210.4:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 148.75.221.65:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 53.234.249.2:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 43.221.222.247:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 195.216.82.177:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 175.54.121.178:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 42.51.181.229:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 185.181.41.199:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 116.95.74.41:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 103.215.144.35:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 138.84.154.146:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 138.146.55.120:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 200.154.182.113:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 163.118.243.112:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 97.207.12.16:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 89.152.17.25:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 94.175.51.10:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 8.137.18.83:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 220.201.115.33:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 18.230.163.234:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 150.164.235.94:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 13.36.93.68:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 201.177.64.8:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 69.187.149.28:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 69.85.163.195:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 65.224.169.224:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 136.50.15.208:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 130.159.154.26:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 20.83.128.104:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 159.80.212.9:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 136.129.66.52:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 196.178.149.174:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 211.170.245.103:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 196.18.120.0:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 41.13.209.86:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 145.226.3.150:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 195.49.180.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 202.244.35.250:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 116.155.224.151:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 4.196.116.224:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 73.128.213.55:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 142.164.86.238:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 168.83.202.147:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 79.163.197.176:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 54.117.105.186:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 81.127.42.69:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 149.151.29.84:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 32.96.110.11:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 154.55.197.154:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 176.51.32.68:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 210.51.26.135:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 58.19.49.228:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 71.111.105.186:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 174.63.140.109:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 44.40.244.118:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 179.247.236.236:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 50.245.62.24:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 125.21.73.47:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 53.9.226.174:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 187.136.107.15:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 110.197.86.55:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 41.66.9.236:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 115.199.213.109:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 170.151.1.22:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 44.118.135.33:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 17.122.211.235:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 20.218.10.60:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 89.244.40.177:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 112.45.45.33:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 149.79.162.117:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 125.45.156.225:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 49.11.23.75:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 92.192.120.104:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 198.43.178.150:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 203.140.116.128:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 31.91.85.129:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 128.194.38.189:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 48.203.167.212:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 220.5.117.21:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 70.8.10.161:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 121.91.183.16:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 93.6.215.140:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 12.9.90.0:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 111.64.240.173:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 156.60.193.24:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 162.159.145.215:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 59.250.219.155:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 87.125.58.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 148.136.76.216:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 163.34.216.145:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 197.17.222.105:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 36.13.110.115:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 147.110.164.70:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 157.84.23.66:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 151.157.190.31:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 50.224.184.229:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 221.96.113.141:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 69.170.172.20:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 174.88.52.5:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 37.244.82.18:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 135.166.200.129:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 170.9.241.142:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 57.52.20.184:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 177.46.222.250:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 128.174.126.77:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 199.212.124.138:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 9.32.147.187:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 115.203.80.29:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 34.184.71.163:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 42.107.140.73:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 139.106.130.109:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 80.115.208.28:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 131.181.0.45:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 180.228.232.47:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 115.149.62.203:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 99.94.72.192:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 94.217.135.54:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 166.212.18.3:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 108.89.189.188:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 167.55.84.19:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 128.245.110.254:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 153.152.214.173:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 165.15.133.153:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 133.59.105.165:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 77.81.14.21:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 132.29.14.77:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 147.54.177.70:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 175.147.2.110:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 221.197.206.212:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 123.243.110.87:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 66.221.244.233:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 163.56.61.113:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 34.107.38.198:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 57.5.231.29:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 122.230.85.222:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 48.248.189.57:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 155.142.147.92:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 68.87.23.9:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 194.16.79.189:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 148.124.54.204:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 188.167.42.147:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 41.125.7.140:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 205.110.82.105:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 97.8.255.84:2323
Source: global traffic TCP traffic: 192.168.2.23:13757 -> 45.27.195.112:2323
Sample listens on a socket
Source: /tmp/jew.mips.elf (PID: 6254) Socket: 127.0.0.1:1926 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 123.101.169.110
Source: unknown TCP traffic detected without corresponding DNS query: 186.13.6.111
Source: unknown TCP traffic detected without corresponding DNS query: 178.92.200.110
Source: unknown TCP traffic detected without corresponding DNS query: 40.190.127.164
Source: unknown TCP traffic detected without corresponding DNS query: 119.191.146.13
Source: unknown TCP traffic detected without corresponding DNS query: 98.205.131.80
Source: unknown TCP traffic detected without corresponding DNS query: 183.150.130.161
Source: unknown TCP traffic detected without corresponding DNS query: 58.202.184.65
Source: unknown TCP traffic detected without corresponding DNS query: 170.66.142.119
Source: unknown TCP traffic detected without corresponding DNS query: 113.244.226.200
Source: unknown TCP traffic detected without corresponding DNS query: 166.79.95.162
Source: unknown TCP traffic detected without corresponding DNS query: 106.24.139.178
Source: unknown TCP traffic detected without corresponding DNS query: 136.228.14.67
Source: unknown TCP traffic detected without corresponding DNS query: 39.69.32.211
Source: unknown TCP traffic detected without corresponding DNS query: 123.114.20.173
Source: unknown TCP traffic detected without corresponding DNS query: 133.19.56.204
Source: unknown TCP traffic detected without corresponding DNS query: 166.32.21.211
Source: unknown TCP traffic detected without corresponding DNS query: 220.3.96.193
Source: unknown TCP traffic detected without corresponding DNS query: 58.24.29.134
Source: unknown TCP traffic detected without corresponding DNS query: 174.47.205.206
Source: unknown TCP traffic detected without corresponding DNS query: 67.53.16.217
Source: unknown TCP traffic detected without corresponding DNS query: 200.107.116.228
Source: unknown TCP traffic detected without corresponding DNS query: 157.232.113.39
Source: unknown TCP traffic detected without corresponding DNS query: 217.158.127.63
Source: unknown TCP traffic detected without corresponding DNS query: 203.221.32.92
Source: unknown TCP traffic detected without corresponding DNS query: 194.129.82.16
Source: unknown TCP traffic detected without corresponding DNS query: 68.27.217.50
Source: unknown TCP traffic detected without corresponding DNS query: 82.100.113.111
Source: unknown TCP traffic detected without corresponding DNS query: 162.243.192.210
Source: unknown TCP traffic detected without corresponding DNS query: 94.132.152.104
Source: unknown TCP traffic detected without corresponding DNS query: 199.9.7.26
Source: unknown TCP traffic detected without corresponding DNS query: 2.252.61.202
Source: unknown TCP traffic detected without corresponding DNS query: 70.121.4.20
Source: unknown TCP traffic detected without corresponding DNS query: 122.143.16.166
Source: unknown TCP traffic detected without corresponding DNS query: 194.26.17.114
Source: unknown TCP traffic detected without corresponding DNS query: 32.26.159.202
Source: unknown TCP traffic detected without corresponding DNS query: 193.100.119.233
Source: unknown TCP traffic detected without corresponding DNS query: 13.190.28.130
Source: unknown TCP traffic detected without corresponding DNS query: 161.49.72.150
Source: unknown TCP traffic detected without corresponding DNS query: 131.184.245.70
Source: unknown TCP traffic detected without corresponding DNS query: 72.238.4.51
Source: unknown TCP traffic detected without corresponding DNS query: 44.132.148.13
Source: unknown TCP traffic detected without corresponding DNS query: 40.160.166.218
Source: unknown TCP traffic detected without corresponding DNS query: 165.162.70.163
Source: unknown TCP traffic detected without corresponding DNS query: 90.16.191.204
Source: unknown TCP traffic detected without corresponding DNS query: 109.213.147.158
Source: unknown TCP traffic detected without corresponding DNS query: 9.252.182.93
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39262
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39262 -> 443

System Summary
barindex
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method.c
Source: ELF static info symbol of initial sample Name: attack_method_greeth
Source: ELF static info symbol of initial sample Name: attack_method_greip
Source: ELF static info symbol of initial sample Name: attack_method_ovh
Source: ELF static info symbol of initial sample Name: attack_method_std
Sample and/or dropped files contains symbols with suspicious names
Source: jew.mips.elf ELF static info symbol of initial sample: scanner.c
Source: jew.mips.elf ELF static info symbol of initial sample: scanner_init
Source: jew.mips.elf ELF static info symbol of initial sample: scanner_pid
Source: jew.mips.elf ELF static info symbol of initial sample: scanner_rawpkt
Source: classification engine Classification label: mal68.troj.linELF@0/0@0/0
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6268) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.QuZKIsRhSr /tmp/tmp.CCEjFgzKCw /tmp/tmp.MdBbMenZ2I Jump to behavior
Source: /usr/bin/dash (PID: 6269) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.QuZKIsRhSr /tmp/tmp.CCEjFgzKCw /tmp/tmp.MdBbMenZ2I Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jew.mips.elf (PID: 6254) Queries kernel information via 'uname': Jump to behavior
Source: jew.mips.elf, 6254.1.00005592cd84f000.00005592cd8d6000.rw-.sdmp, jew.mips.elf, 6256.1.00005592cd84f000.00005592cd8d6000.rw-.sdmp, jew.mips.elf, 6260.1.00005592cd84f000.00005592cd8d6000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: jew.mips.elf, 6254.1.00005592cd84f000.00005592cd8d6000.rw-.sdmp, jew.mips.elf, 6256.1.00005592cd84f000.00005592cd8d6000.rw-.sdmp, jew.mips.elf, 6260.1.00005592cd84f000.00005592cd8d6000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: jew.mips.elf, 6254.1.00007ffd234ae000.00007ffd234cf000.rw-.sdmp, jew.mips.elf, 6256.1.00007ffd234ae000.00007ffd234cf000.rw-.sdmp, jew.mips.elf, 6260.1.00007ffd234ae000.00007ffd234cf000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: jew.mips.elf, 6254.1.00007ffd234ae000.00007ffd234cf000.rw-.sdmp, jew.mips.elf, 6256.1.00007ffd234ae000.00007ffd234cf000.rw-.sdmp, jew.mips.elf, 6260.1.00007ffd234ae000.00007ffd234cf000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/jew.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jew.mips.elf
Yara detected Mirai
Source: Yara match File source: jew.mips.elf, type: SAMPLE
Yara detected Mirai
Source: Yara match File source: jew.mips.elf, type: SAMPLE

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
113.160.104.193
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
186.76.25.4
 unknown Nicaragua
14754 TelguaGT false
186.239.78.6
 unknown Brazil
10429 TELEFONICABRASILSABR false
210.6.235.188
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK false
58.192.126.23
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
23.98.158.187
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
175.133.231.224
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
157.157.76.247
 unknown Iceland
6677 ICENET-AS1IS false
192.68.97.80
 unknown Norway
5619 EVRY-NO false
100.10.227.159
 unknown United States
701 UUNETUS false
54.84.65.224
 unknown United States
14618 AMAZON-AESUS false
198.11.206.90
 unknown United States
36351 SOFTLAYERUS false
157.84.108.137
 unknown United Kingdom
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
60.229.42.205
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
169.98.68.213
 unknown United States
37611 AfrihostZA false
100.241.230.255
 unknown United States
21928 T-MOBILE-AS21928US false
206.37.90.41
 unknown United States
1461 DNIC-AS-01461US false
86.44.199.128
 unknown Ireland
5466 EIRCOMInternetHouseIE false
43.171.228.221
 unknown Japan 4249 LILLY-ASUS false
85.48.206.161
 unknown Spain
12479 UNI2-ASES false
114.173.250.166
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
93.79.198.77
 unknown Ukraine
25229 VOLIA-ASUA false
23.166.241.136
 unknown Reserved
14618 AMAZON-AESUS false
91.122.30.202
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
134.137.111.240
 unknown United States
385 AFCONC-BLOCK1-ASUS false
175.152.13.2
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
157.242.55.136
 unknown United States
25789 LMUUS false
73.96.201.80
 unknown United States
7922 COMCAST-7922US false
139.54.19.5
 unknown France
5707 UTHSC-HUS false
80.212.29.96
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
93.201.114.252
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
108.108.33.182
 unknown United States
10507 SPCSUS false
120.121.110.140
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
196.5.215.187
 unknown South Africa
3067 DENINF-IPLANZA false
50.50.151.14
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
19.214.233.75
 unknown United States
3 MIT-GATEWAYSUS false
93.133.173.214
 unknown Germany
6805 TDDE-ASN1DE false
117.72.76.113
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
23.87.97.33
 unknown United States
395954 LEASEWEB-USA-LAX-11US false
45.229.91.228
 unknown Brazil
267106 NETFIBRATELECOMUNICACOESLTDA-MEBR false
191.77.170.44
 unknown Colombia
26611 COMCELSACO false
68.116.243.88
 unknown United States
20115 CHARTER-20115US false
110.178.251.247
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
79.75.2.108
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
182.42.184.40
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
43.148.76.244
 unknown Japan 4249 LILLY-ASUS false
112.221.66.139
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
50.76.98.129
 unknown United States
7922 COMCAST-7922US false
177.183.21.137
 unknown Brazil
28573 CLAROSABR false
19.79.51.46
 unknown United States
3 MIT-GATEWAYSUS false
58.223.219.177
 unknown China
137697 CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ false
186.245.232.5
 unknown Brazil
7738 TelemarNorteLesteSABR false
34.118.114.104
 unknown United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
141.238.20.185
 unknown United States
395015 SUNY-FREDONIAUS false
49.168.23.41
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
9.60.39.232
 unknown United States
3356 LEVEL3US false
8.189.60.244
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
169.132.160.135
 unknown United States
7270 NET2PHONEUS false
34.193.17.238
 unknown United States
14618 AMAZON-AESUS false
213.65.99.42
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
88.15.208.125
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
92.66.41.158
 unknown Netherlands
1136 KPNKPNNationalEU false
161.58.240.112
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
83.88.32.141
 unknown Denmark
3292 TDCTDCASDK false
103.100.237.233
 unknown China
139013 HTOS-AS-APHi-TechOnlineServicesBD false
5.96.222.91
 unknown Italy
3269 ASN-IBSNAZIT false
63.98.230.219
 unknown United States
394661 MNA01US false
111.92.200.170
 unknown Singapore
45814 FARIYA-PKFariyaNetworksPvtLtdPK false
219.138.199.64
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
219.205.35.61
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
212.51.16.128
 unknown Germany
25415 ADDIX-ASAS-ADDIXAutonomousSystemDE false
211.116.134.30
 unknown Korea Republic of
18302 SKG_NW-AS-KRSKTelecomKR false
20.41.6.204
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
45.238.201.115
 unknown Brazil
268360 AndersonAraujoAlmeida-MEBR false
88.55.107.4
 unknown Italy
3269 ASN-IBSNAZIT false
186.151.239.225
 unknown Guatemala
14754 TelguaGT false
65.65.79.215
 unknown United States
7018 ATT-INTERNET4US false
123.50.227.232
 unknown Japan 9614 OCTOitaCableTelecomColtdJP false
100.228.177.32
 unknown United States
21928 T-MOBILE-AS21928US false
128.139.121.131
 unknown Israel
378 MACHBA-ASILANIL false
165.230.233.90
 unknown United States
46 RUTGERSUS false
210.113.79.50
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
57.229.27.95
 unknown Belgium
2686 ATGS-MMD-ASUS false
209.152.78.221
 unknown United States
397446 MIDWESTFIBERNETWORK-ASN1US false
175.5.191.39
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
202.2.181.148
 unknown Japan 9328 DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU false
76.71.162.9
 unknown Canada
577 BACOMCA false
193.146.223.121
 unknown Spain
766 REDIRISRedIRISAutonomousSystemES false
195.217.27.34
 unknown United Kingdom
1699 ANS-1699-ASUS false
211.166.7.40
 unknown China
9389 UNSPECIFIEDBEIJINGSHENZHOUGREATWALLCOMMUNICATIONCN false
141.95.160.37
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
126.240.247.202
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
80.139.114.237
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
178.24.170.88
 unknown Germany
31334 KABELDEUTSCHLAND-ASDE false
133.225.185.64
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
167.247.161.89
 unknown United States
22808 RESOURCES-22808US false
42.140.83.93
 unknown China
4249 LILLY-ASUS false
148.51.5.213
 unknown United States
6939 HURRICANEUS false
128.134.124.125
 unknown Korea Republic of
9321 HYUNET-ASHanyangUniversityKR false
112.57.22.182
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false