Linux Analysis Report
jew.mpsl.elf

Overview

General Information

Sample name: jew.mpsl.elf
Analysis ID: 1544657
MD5: 915a7020ed4f5bed5ef75e28ef51b712
SHA1: 775c8c6ad0dc46c99d8cc8952d5449191b267400
SHA256: 0508a85270025e86f3b9fe689f64753105b65370c3d7bb7678d4dd79a1772cac
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Detected TCP or UDP traffic on non-standard ports
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads system version information
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)
Yara detected Mirai

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: jew.mpsl.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: jew.mpsl.elf ReversingLabs: Detection: 68%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:37222 -> 147.45.79.174:9931
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 102.12.103.110:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 37.173.57.1:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 109.36.55.115:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 145.127.116.66:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 165.192.8.46:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 59.226.56.217:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 80.14.114.168:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 191.241.68.220:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 108.150.196.214:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 40.183.196.91:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 20.192.84.253:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 92.150.79.70:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 123.159.184.192:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 120.52.128.81:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.169.64.223:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 147.92.16.209:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 154.218.32.46:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 223.30.97.128:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.200.212.106:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 115.51.199.108:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.223.122.120:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 97.195.206.139:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 218.231.253.130:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 9.86.110.84:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 102.184.79.83:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 38.233.127.117:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 208.30.199.45:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 216.187.89.168:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 148.204.30.158:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 218.69.8.27:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 12.89.232.165:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 115.184.17.9:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 50.0.21.178:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 58.241.72.235:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 188.201.85.197:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 63.40.252.147:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 18.223.68.250:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 171.5.165.215:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 220.172.119.55:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 14.109.185.110:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 61.68.166.156:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 90.35.57.79:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 101.78.213.173:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 71.197.40.159:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 196.122.31.83:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.126.117.135:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 58.127.11.15:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 181.23.89.81:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 147.115.0.204:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 37.30.124.251:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 73.35.29.222:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 171.84.81.105:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 44.242.131.123:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 95.203.88.11:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 116.111.119.122:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 65.15.134.252:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 114.20.76.248:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 108.170.83.105:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 65.246.17.8:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 102.180.18.104:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 101.85.252.254:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 98.149.100.164:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 102.23.13.49:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 59.165.214.81:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 189.4.212.222:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 110.184.86.190:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 186.211.65.217:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 117.216.168.179:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 216.172.150.119:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 38.115.158.107:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 2.33.198.32:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 50.224.148.167:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.17.83.251:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 117.100.215.34:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 153.242.76.111:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 212.99.121.50:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 206.230.33.41:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 117.201.97.11:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 156.31.24.84:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 218.140.69.95:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 117.27.84.25:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 41.169.137.6:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 125.202.194.58:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 153.5.156.118:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 157.22.182.27:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 202.129.55.10:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 142.134.238.124:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 169.33.90.131:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 130.235.107.63:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 155.56.166.33:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.45.246.151:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.87.232.111:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 134.101.249.33:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 126.4.41.105:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 148.69.232.43:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 50.235.152.136:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 216.41.222.121:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 203.137.113.107:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 193.243.18.171:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 116.251.203.148:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 196.120.215.155:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 114.194.60.75:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 185.40.27.46:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 12.84.124.168:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 97.214.173.7:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 129.190.135.239:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 36.144.176.167:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 57.75.111.167:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 142.189.126.41:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 179.179.167.22:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 109.39.53.5:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 164.234.166.148:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 36.82.63.145:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 218.198.165.101:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 159.1.95.254:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 57.117.102.147:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 146.143.119.224:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 85.225.14.129:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 111.23.200.62:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 184.124.127.120:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.100.27.108:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 199.117.20.113:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 76.179.208.202:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 129.61.200.117:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 117.205.174.21:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 153.2.199.210:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 83.122.70.242:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 132.96.96.232:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 68.234.204.12:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 83.12.109.247:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 216.220.96.232:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 131.82.250.156:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 46.40.192.215:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 14.120.30.78:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 173.237.246.255:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 27.87.97.67:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 182.196.0.84:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 75.105.127.132:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 202.163.239.52:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 68.81.228.250:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 98.83.82.155:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 44.17.193.73:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 20.196.100.51:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 141.169.183.186:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 60.85.33.113:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 61.29.184.143:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 205.97.157.198:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 86.159.152.53:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 141.184.198.148:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 125.77.191.236:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 185.121.139.129:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 200.29.167.47:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 76.35.247.19:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 94.107.232.110:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 68.231.111.38:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 86.78.108.51:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 155.62.206.233:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 174.97.23.234:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 101.100.19.50:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 221.110.233.146:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 213.136.33.160:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.124.217.229:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 204.115.6.97:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 151.189.107.9:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 157.94.175.201:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 34.136.31.46:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 108.165.234.130:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 62.229.127.117:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.41.190.129:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 76.185.27.115:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 181.241.23.253:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 98.135.255.189:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 122.166.223.83:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 221.127.148.80:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 116.1.37.152:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 178.61.49.244:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 132.255.235.21:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 179.241.143.199:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 112.91.127.225:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 175.179.127.46:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 176.14.232.119:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 35.214.16.65:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 76.10.222.60:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 200.216.37.226:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 20.178.78.127:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 67.131.209.223:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 24.214.139.88:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 37.54.136.68:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 173.32.195.197:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 159.80.94.153:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 68.11.109.131:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 66.159.131.213:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 52.248.239.42:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 97.34.34.138:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 128.4.203.226:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 185.178.37.151:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 165.109.51.119:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 18.24.4.80:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 49.229.174.72:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 108.184.28.136:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 122.114.26.240:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 163.60.131.125:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 164.19.158.21:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 60.0.68.169:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 132.161.107.119:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 140.123.64.158:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 217.231.169.57:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 168.76.105.128:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 135.37.43.185:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 91.144.158.115:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 210.55.97.81:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 165.34.184.25:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 39.151.113.196:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 204.125.212.239:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 18.17.91.235:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 37.56.208.45:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 86.60.36.202:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 111.117.131.62:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.153.189.171:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.19.232.189:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 18.67.170.212:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 89.8.233.46:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 105.43.233.85:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 189.220.120.74:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 204.126.23.198:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 112.130.39.147:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.44.149.18:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 196.39.9.116:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 156.34.94.155:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 137.173.81.53:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 38.137.243.220:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 200.84.200.5:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 129.24.228.65:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.125.122.181:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 147.151.19.44:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 122.145.113.194:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 198.14.71.104:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 81.117.36.144:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 5.176.14.138:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 183.91.60.138:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 45.145.93.225:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 157.162.113.77:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 165.153.251.31:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 23.177.176.175:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.92.200.184:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 168.63.71.28:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 211.150.108.28:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 207.188.118.151:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 68.71.240.61:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 217.11.134.234:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 50.189.178.148:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 78.171.36.122:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 131.84.62.172:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.166.37.63:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 41.187.242.165:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 173.210.4.209:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 14.58.207.134:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 180.226.106.39:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 14.24.23.159:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 93.10.115.234:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 204.137.128.75:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 222.52.187.96:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 111.235.33.255:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 176.190.210.141:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 193.14.0.133:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 123.253.228.132:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 118.195.179.167:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 114.1.122.63:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 203.5.35.61:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.172.92.107:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.52.90.56:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 117.211.38.122:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 121.52.15.177:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 199.7.40.67:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 176.252.141.213:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 120.133.30.195:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 186.220.79.197:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 99.222.174.247:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 221.154.213.239:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 149.252.205.83:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 136.181.22.12:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 120.72.198.198:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 155.178.132.93:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 212.55.57.148:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 161.28.56.168:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 77.135.12.211:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 105.235.106.97:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 4.110.20.236:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 132.212.203.158:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 161.139.9.5:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 42.56.172.7:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 212.182.155.103:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 159.178.109.16:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 199.140.139.76:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 207.28.126.119:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 122.111.76.125:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 134.11.200.83:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 133.173.25.26:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 191.192.101.241:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 105.148.137.100:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 32.176.98.178:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 122.2.58.69:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 146.193.36.121:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 43.204.164.56:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 217.59.139.220:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 77.52.202.40:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 122.59.129.232:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 165.243.86.48:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 132.48.97.93:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 5.94.237.175:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.125.30.80:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 19.92.152.14:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 118.78.149.104:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 79.109.178.78:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 9.246.250.125:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 116.60.215.95:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 164.195.144.183:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 181.158.188.16:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 134.25.40.165:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 129.215.37.184:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 112.87.220.163:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 123.243.243.92:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 17.252.164.169:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 44.32.11.69:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 17.27.125.172:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 69.127.182.99:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 44.98.98.251:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 129.11.88.106:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 82.49.50.148:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 88.118.3.112:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 2.167.58.215:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 173.244.44.141:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 98.247.136.234:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 134.143.77.128:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 208.56.11.0:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 66.34.3.151:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 64.164.226.38:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 68.70.87.202:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 31.111.254.58:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 113.158.166.27:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 89.68.235.30:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 121.177.243.242:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 169.162.109.239:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 1.18.123.198:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 173.214.138.213:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 209.177.127.127:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 74.156.186.210:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 109.55.148.177:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 198.132.18.11:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 124.12.111.200:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 203.58.206.179:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 67.125.246.211:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 201.69.165.9:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 128.155.72.79:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 83.204.36.168:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 182.204.217.128:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.23.13.52:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 133.248.254.253:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 38.230.26.44:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 212.20.254.210:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 144.133.183.117:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 86.24.188.173:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 138.163.177.223:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 125.155.195.143:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 105.60.168.242:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 116.211.57.63:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 1.162.167.210:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 40.117.209.234:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 75.73.178.134:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.171.222.8:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 161.134.70.32:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 223.215.166.159:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 121.48.75.244:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 210.50.97.247:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 31.116.125.60:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 69.25.47.14:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 174.236.232.52:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 78.86.167.112:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 184.196.52.37:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 110.207.87.132:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 111.183.14.207:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 205.29.238.134:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 196.9.10.20:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 179.219.55.93:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 200.54.9.41:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 99.20.48.176:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 74.77.250.120:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 119.100.130.203:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 46.82.72.240:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 32.134.75.239:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 83.228.166.128:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 106.43.206.109:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 136.8.143.26:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 219.55.226.208:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 150.198.243.75:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 74.213.81.245:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 79.198.41.89:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 83.161.36.143:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 46.44.244.111:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 103.73.60.173:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 123.28.12.165:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 155.114.18.123:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 111.131.115.29:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 62.133.191.200:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 75.252.30.153:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 83.99.198.138:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 108.55.44.198:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 83.54.204.215:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 157.101.120.185:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 187.236.167.97:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 177.239.149.149:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 222.125.8.25:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 198.183.117.41:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 24.128.0.60:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 1.38.90.232:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 50.5.112.181:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 107.160.0.132:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 163.238.85.135:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 63.4.132.42:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 155.54.192.208:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 61.229.116.53:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 39.166.148.219:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 179.215.201.37:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 85.239.238.81:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 130.213.51.36:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 169.87.135.227:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 71.144.17.116:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 166.60.110.202:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 189.48.52.39:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 18.21.210.59:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 38.77.72.196:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.163.27.174:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 35.212.66.57:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 148.7.28.186:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 128.228.145.194:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 18.89.192.188:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 139.253.198.207:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 168.139.216.161:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 44.15.230.100:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 45.227.92.184:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 113.190.7.94:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 162.9.110.12:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 72.229.220.81:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 8.237.7.223:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 87.177.126.86:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 131.51.235.170:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 102.5.34.115:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 36.247.26.22:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 53.190.14.234:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 87.64.68.195:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 187.167.31.159:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 93.196.202.41:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 85.220.75.50:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 102.153.225.14:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 32.61.48.148:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 112.176.40.214:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 138.194.48.197:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 166.227.31.123:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 111.210.116.180:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 156.58.134.106:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 116.163.117.154:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 195.81.189.156:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 60.49.154.234:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 145.100.9.219:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 81.248.119.40:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 216.86.27.231:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 102.69.252.240:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 123.104.149.14:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 43.212.47.229:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 137.113.36.88:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 140.86.101.171:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 45.1.251.255:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 112.142.122.56:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 93.194.191.146:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 105.67.239.194:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 173.239.60.70:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 62.213.182.33:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 79.205.83.200:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 1.159.202.98:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 70.225.16.92:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 14.204.51.102:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 168.171.145.142:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 209.74.60.72:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 99.149.102.149:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 218.9.110.131:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 199.154.116.91:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 128.69.195.189:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 182.67.106.17:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 222.156.0.28:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 150.226.10.209:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 173.107.59.250:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 216.110.63.46:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 130.175.26.0:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 78.255.145.233:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 131.159.81.162:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 112.126.168.145:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 64.181.147.165:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 91.108.108.6:2323
Source: global traffic TCP traffic: 192.168.2.13:52335 -> 168.189.149.75:2323
Sample listens on a socket
Source: /tmp/jew.mpsl.elf (PID: 5719) Socket: 127.0.0.1:1926 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 102.12.103.110
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.79.174
Source: unknown TCP traffic detected without corresponding DNS query: 13.98.8.111
Source: unknown TCP traffic detected without corresponding DNS query: 80.204.107.234
Source: unknown TCP traffic detected without corresponding DNS query: 198.142.86.29
Source: unknown TCP traffic detected without corresponding DNS query: 51.108.134.74
Source: unknown TCP traffic detected without corresponding DNS query: 134.186.8.140
Source: unknown TCP traffic detected without corresponding DNS query: 146.87.201.2
Source: unknown TCP traffic detected without corresponding DNS query: 119.118.188.38
Source: unknown TCP traffic detected without corresponding DNS query: 220.161.219.116
Source: unknown TCP traffic detected without corresponding DNS query: 57.219.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 94.109.196.248
Source: unknown TCP traffic detected without corresponding DNS query: 191.145.193.19
Source: unknown TCP traffic detected without corresponding DNS query: 37.173.57.1
Source: unknown TCP traffic detected without corresponding DNS query: 65.50.26.117
Source: unknown TCP traffic detected without corresponding DNS query: 48.23.52.155
Source: unknown TCP traffic detected without corresponding DNS query: 40.212.165.29
Source: unknown TCP traffic detected without corresponding DNS query: 173.21.124.111
Source: unknown TCP traffic detected without corresponding DNS query: 14.47.7.37
Source: unknown TCP traffic detected without corresponding DNS query: 61.244.167.170
Source: unknown TCP traffic detected without corresponding DNS query: 76.248.187.174
Source: unknown TCP traffic detected without corresponding DNS query: 197.17.12.227
Source: unknown TCP traffic detected without corresponding DNS query: 109.36.55.115
Source: unknown TCP traffic detected without corresponding DNS query: 105.95.245.56
Source: unknown TCP traffic detected without corresponding DNS query: 13.247.49.0
Source: unknown TCP traffic detected without corresponding DNS query: 94.141.168.224
Source: unknown TCP traffic detected without corresponding DNS query: 162.45.172.7
Source: unknown TCP traffic detected without corresponding DNS query: 145.127.116.66
Source: unknown TCP traffic detected without corresponding DNS query: 196.43.131.185
Source: unknown TCP traffic detected without corresponding DNS query: 188.11.175.196
Source: unknown TCP traffic detected without corresponding DNS query: 74.203.188.85
Source: unknown TCP traffic detected without corresponding DNS query: 50.46.4.12
Source: unknown TCP traffic detected without corresponding DNS query: 211.168.181.150
Source: unknown TCP traffic detected without corresponding DNS query: 4.168.140.142
Source: unknown TCP traffic detected without corresponding DNS query: 88.42.21.236
Source: unknown TCP traffic detected without corresponding DNS query: 153.85.212.176
Source: unknown TCP traffic detected without corresponding DNS query: 60.28.142.105
Source: unknown TCP traffic detected without corresponding DNS query: 50.2.243.20
Source: unknown TCP traffic detected without corresponding DNS query: 155.28.143.44
Source: unknown TCP traffic detected without corresponding DNS query: 109.60.40.131
Source: unknown TCP traffic detected without corresponding DNS query: 36.230.156.124
Source: unknown TCP traffic detected without corresponding DNS query: 165.192.8.46
Source: unknown TCP traffic detected without corresponding DNS query: 35.2.51.135
Source: unknown TCP traffic detected without corresponding DNS query: 25.124.193.62
Source: unknown TCP traffic detected without corresponding DNS query: 143.125.39.83
Source: unknown TCP traffic detected without corresponding DNS query: 65.162.72.1
Source: unknown TCP traffic detected without corresponding DNS query: 129.144.230.12
Source: unknown TCP traffic detected without corresponding DNS query: 23.83.46.122

System Summary
barindex
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method.c
Source: ELF static info symbol of initial sample Name: attack_method_greeth
Source: ELF static info symbol of initial sample Name: attack_method_greip
Source: ELF static info symbol of initial sample Name: attack_method_ovh
Source: ELF static info symbol of initial sample Name: attack_method_std
Sample and/or dropped files contains symbols with suspicious names
Source: jew.mpsl.elf ELF static info symbol of initial sample: scanner.c
Source: jew.mpsl.elf ELF static info symbol of initial sample: scanner_init
Source: jew.mpsl.elf ELF static info symbol of initial sample: scanner_pid
Source: jew.mpsl.elf ELF static info symbol of initial sample: scanner_rawpkt
Source: classification engine Classification label: mal68.troj.linELF@0/0@0/0
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /usr/lib/snapd/snap-failure (PID: 5781) Systemctl executable: /usr/bin/systemctl -> systemctl stop snapd.socket Jump to behavior
Reads system version information
Source: /usr/lib/snapd/snap-failure (PID: 5768) Reads version info: /proc/version Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jew.mpsl.elf (PID: 5719) Queries kernel information via 'uname': Jump to behavior
Source: jew.mpsl.elf, 5719.1.0000563db008b000.0000563db0112000.rw-.sdmp, jew.mpsl.elf, 5721.1.0000563db008b000.0000563db0112000.rw-.sdmp, jew.mpsl.elf, 5724.1.0000563db008b000.0000563db0112000.rw-.sdmp Binary or memory string: =V!/etc/qemu-binfmt/mipsel
Source: jew.mpsl.elf, 5719.1.0000563db008b000.0000563db0112000.rw-.sdmp, jew.mpsl.elf, 5721.1.0000563db008b000.0000563db0112000.rw-.sdmp, jew.mpsl.elf, 5724.1.0000563db008b000.0000563db0112000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: jew.mpsl.elf, 5719.1.00007ffe21b7b000.00007ffe21b9c000.rw-.sdmp, jew.mpsl.elf, 5721.1.00007ffe21b7b000.00007ffe21b9c000.rw-.sdmp, jew.mpsl.elf, 5724.1.00007ffe21b7b000.00007ffe21b9c000.rw-.sdmp Binary or memory string: j:Xoux86_64/usr/bin/qemu-mipsel/tmp/jew.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jew.mpsl.elf
Source: jew.mpsl.elf, 5719.1.00007ffe21b7b000.00007ffe21b9c000.rw-.sdmp, jew.mpsl.elf, 5721.1.00007ffe21b7b000.00007ffe21b9c000.rw-.sdmp, jew.mpsl.elf, 5724.1.00007ffe21b7b000.00007ffe21b9c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
Yara detected Mirai
Source: Yara match File source: jew.mpsl.elf, type: SAMPLE
Yara detected Mirai
Source: Yara match File source: jew.mpsl.elf, type: SAMPLE

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
134.247.139.127
 unknown Germany
34127 MUNICH-AIRPORT-ASDE false
181.117.231.41
 unknown Argentina
11664 TechtelLMDSComunicacionesInteractivasSAAR false
196.161.183.142
 unknown South Africa
328065 Vast-Networks-ASZA false
196.167.122.181
 unknown South Africa
328065 Vast-Networks-ASZA false
223.81.125.127
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
152.199.90.23
 unknown United States
15133 EDGECASTUS false
170.69.95.100
 unknown United States
16761 FEDMOG-ASN-01US false
118.12.131.22
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
151.231.128.249
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
105.6.201.215
 unknown South Africa
37168 CELL-CZA false
153.238.40.125
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
176.145.187.187
 unknown France
5410 BOUYGTEL-ISPFR false
138.32.141.191
 unknown United States
264524 CunhaeZanatotelecomLTDAMEBR false
84.179.182.148
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
153.90.184.37
 unknown United States
13476 MSU-BOZEMANUS false
150.217.3.115
 unknown Italy
137 ASGARRConsortiumGARREU false
133.144.248.136
 unknown Japan 2500 WIDE-BBWIDEProjectJP false
101.160.84.62
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
165.201.154.37
 unknown United States
3446 KANSASUS false
207.225.187.36
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
170.202.97.148
 unknown United States
23381 TRAVELERSUS false
89.205.31.176
 unknown Macedonia
41557 TELEKABEL-ASMK false
129.90.16.234
 unknown Venezuela
1942 FR-TIGREToileInformatiqueGREnobloiseEU false
66.7.38.172
 unknown United States
7029 WINDSTREAMUS false
109.239.104.182
 unknown United Kingdom
33920 AQLGB false
152.240.231.54
 unknown Brazil
26599 TELEFONICABRASILSABR false
150.215.62.11
 unknown United States
3680 NOVELLUS false
150.78.101.33
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
175.14.248.48
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
77.17.208.116
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
139.126.6.235
 unknown United States
32190 ADS-17-32190US false
1.94.226.253
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
100.210.170.163
 unknown United States
21928 T-MOBILE-AS21928US false
18.207.133.40
 unknown United States
14618 AMAZON-AESUS false
5.129.34.93
 unknown Russian Federation
31200 NTKIPv6customersRU false
67.168.72.17
 unknown United States
7922 COMCAST-7922US false
177.77.153.112
 unknown Brazil
26599 TELEFONICABRASILSABR false
166.221.142.151
 unknown United States
6614 USCC-ASNUS false
187.255.97.230
 unknown Brazil
28573 CLAROSABR false
20.230.47.163
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
155.190.184.222
 unknown Netherlands
20437 AS20437US false
61.4.47.187
 unknown Hong Kong
10132 EASTAR-TECHNOLOGY-APTowngasTelecommunicationsFixedNetwor false
68.144.147.77
 unknown Canada
6327 SHAWCA false
27.160.102.34
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
199.91.86.22
 unknown Canada
15247 RADIANT-VANCOUVERCA false
164.139.228.83
 unknown Germany
8569 MSYSDE false
19.181.248.127
 unknown United States
3 MIT-GATEWAYSUS false
154.225.107.7
 unknown Uganda
37075 ZAINUGASUG false
90.81.242.25
 unknown France
3215 FranceTelecom-OrangeFR false
109.226.104.82
 unknown Russian Federation
8439 AISTTogliattiRussiaRU false
168.144.246.125
 unknown Canada
27435 OPSOURCE-INCUS false
186.167.121.137
 unknown Venezuela
27717 CorporacionDigitelCAVE false
43.2.234.165
 unknown Japan 4249 LILLY-ASUS false
95.194.248.76
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
118.34.245.60
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
137.130.207.14
 unknown United States
668 DNIC-AS-00668US false
57.146.187.185
 unknown Belgium
2686 ATGS-MMD-ASUS false
69.73.156.9
 unknown United States
11042 NTHLUS false
179.209.165.142
 unknown Brazil
28573 CLAROSABR false
190.45.54.164
 unknown Chile
22047 VTRBANDAANCHASACL false
157.143.40.229
 unknown United States
16922 OUHSC-EDUUS false
194.37.15.95
 unknown Austria
1853 ACONETACOnetBackboneAT false
88.6.217.17
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
153.75.13.164
 unknown United States
14962 NCR-252US false
88.172.217.174
 unknown France
12322 PROXADFR false
191.11.195.251
 unknown Brazil
26599 TELEFONICABRASILSABR false
148.167.34.92
 unknown United States
16502 CITY-OF-PHOENIXUS false
169.164.65.20
 unknown United States
37611 AfrihostZA false
159.77.2.176
 unknown United States
721 DNIC-ASBLK-00721-00726US false
27.229.151.27
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
187.66.92.82
 unknown Brazil
28573 CLAROSABR false
134.100.204.172
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
213.176.143.92
 unknown Iceland
12969 VODAFONE_ICELANDIS false
205.239.46.213
 unknown United States
2166 HPESUS false
51.205.119.4
 unknown United States
2686 ATGS-MMD-ASUS false
72.132.9.202
 unknown United States
20001 TWC-20001-PACWESTUS false
19.199.221.102
 unknown United States
3 MIT-GATEWAYSUS false
49.10.121.220
 unknown Korea Republic of
9858 KRNICNETKoreaInternetSecurityAgencyKR false
107.75.244.20
 unknown United States
7018 ATT-INTERNET4US false
40.234.9.90
 unknown United States
4249 LILLY-ASUS false
84.173.195.235
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
74.46.25.253
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
111.165.97.160
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
136.218.16.242
 unknown United States
1563 DNIC-ASBLK-01550-01601US false
175.10.90.17
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
179.184.4.94
 unknown Brazil
18881 TELEFONICABRASILSABR false
219.230.15.41
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
38.92.222.158
 unknown United States
47096 COMPISPUS false
191.239.123.233
 unknown Brazil
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
143.159.228.252
 unknown United States
6871 PLUSNETUKInternetServiceProviderGB false
122.238.135.20
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
37.181.24.109
 unknown Italy
30722 VODAFONE-IT-ASNIT false
164.107.53.109
 unknown United States
159 OSUNET-ASUS false
155.49.228.91
 unknown United States
26746 HARVARD-PILGRIM-HEALTH-CAREUS false
58.128.105.85
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
61.248.201.42
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
118.239.189.217
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
131.127.144.32
 unknown United States
668 DNIC-AS-00668US false
201.17.110.175
 unknown Brazil
28573 CLAROSABR false
131.22.149.31
 unknown United States
385 AFCONC-BLOCK1-ASUS false