Linux Analysis Report
sora.sh4.elf

Overview

General Information

Sample name: sora.sh4.elf
Analysis ID: 1561519
MD5: 9c51c2e56d59db108dec69af6a8c2875
SHA1: 7d8a5a2373660f2d198ee07e7439b4d6786de1f9
SHA256: e422b054938e8d688022c5959476396cf765e3ec6613bfa375809214a5b384f0
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: sora.sh4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: sora.sh4.elf ReversingLabs: Detection: 65%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:47134 -> 45.95.169.104:1312
Sample listens on a socket
Source: /tmp/sora.sh4.elf (PID: 6258) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) Socket: 0.0.0.0:53413 Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) Socket: 0.0.0.0:0 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 251.217.183.134
Source: unknown TCP traffic detected without corresponding DNS query: 213.17.223.134
Source: unknown TCP traffic detected without corresponding DNS query: 148.178.240.80
Source: unknown TCP traffic detected without corresponding DNS query: 219.252.226.106
Source: unknown TCP traffic detected without corresponding DNS query: 219.57.196.190
Source: unknown TCP traffic detected without corresponding DNS query: 5.242.245.224
Source: unknown TCP traffic detected without corresponding DNS query: 196.247.197.215
Source: unknown TCP traffic detected without corresponding DNS query: 193.82.13.89
Source: unknown TCP traffic detected without corresponding DNS query: 173.192.169.43
Source: unknown TCP traffic detected without corresponding DNS query: 98.158.93.79
Source: unknown TCP traffic detected without corresponding DNS query: 117.105.14.179
Source: unknown TCP traffic detected without corresponding DNS query: 207.15.208.173
Source: unknown TCP traffic detected without corresponding DNS query: 124.231.51.103
Source: unknown TCP traffic detected without corresponding DNS query: 67.150.128.242
Source: unknown TCP traffic detected without corresponding DNS query: 142.186.132.128
Source: unknown TCP traffic detected without corresponding DNS query: 185.158.41.245
Source: unknown TCP traffic detected without corresponding DNS query: 87.177.177.43
Source: unknown TCP traffic detected without corresponding DNS query: 60.163.164.223
Source: unknown TCP traffic detected without corresponding DNS query: 196.171.108.197
Source: unknown TCP traffic detected without corresponding DNS query: 116.194.169.125
Source: unknown TCP traffic detected without corresponding DNS query: 156.141.138.50
Source: unknown TCP traffic detected without corresponding DNS query: 47.94.124.247
Source: unknown TCP traffic detected without corresponding DNS query: 135.85.131.194
Source: unknown TCP traffic detected without corresponding DNS query: 185.46.106.221
Source: unknown TCP traffic detected without corresponding DNS query: 91.68.208.13
Source: unknown TCP traffic detected without corresponding DNS query: 212.69.56.91
Source: unknown TCP traffic detected without corresponding DNS query: 74.54.87.111
Source: unknown TCP traffic detected without corresponding DNS query: 8.168.250.112
Source: unknown TCP traffic detected without corresponding DNS query: 154.124.202.98
Source: unknown TCP traffic detected without corresponding DNS query: 154.131.74.214
Source: unknown TCP traffic detected without corresponding DNS query: 163.122.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 58.158.149.6
Source: unknown TCP traffic detected without corresponding DNS query: 164.27.73.18
Source: unknown TCP traffic detected without corresponding DNS query: 85.12.3.251
Source: unknown TCP traffic detected without corresponding DNS query: 190.175.36.221
Source: unknown TCP traffic detected without corresponding DNS query: 122.185.221.41
Source: unknown TCP traffic detected without corresponding DNS query: 126.44.9.127
Source: unknown TCP traffic detected without corresponding DNS query: 113.48.16.14
Source: unknown TCP traffic detected without corresponding DNS query: 109.58.202.242
Source: unknown TCP traffic detected without corresponding DNS query: 191.30.109.40
Source: unknown TCP traffic detected without corresponding DNS query: 4.143.241.254
Source: unknown TCP traffic detected without corresponding DNS query: 108.157.22.125
Source: unknown TCP traffic detected without corresponding DNS query: 189.5.131.107
Source: unknown TCP traffic detected without corresponding DNS query: 205.178.211.2
Source: unknown TCP traffic detected without corresponding DNS query: 61.188.207.15
Source: unknown TCP traffic detected without corresponding DNS query: 187.58.62.238
Source: unknown TCP traffic detected without corresponding DNS query: 218.64.28.119
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sora.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: sora.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6258.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6258.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6256.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6256.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6373.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6373.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6377.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6377.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6265.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6265.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6259.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6370.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6370.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6391.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6391.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6258, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6258, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6265, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6265, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6370, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6370, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6373, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6373, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6377, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.sh4.elf PID: 6377, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/sora.sh4.elf (PID: 6258) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) SIGKILL sent: pid: 936, result: successful Jump to behavior
Yara signature match
Source: sora.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: sora.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6258.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6258.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6256.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6256.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6373.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6373.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6377.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6377.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6265.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6265.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6259.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6259.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6370.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6370.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6391.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6391.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6256, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6258, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6258, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6265, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6265, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6370, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6370, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6373, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6373, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6377, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.sh4.elf PID: 6377, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal72.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/491/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/793/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/772/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/796/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/774/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/797/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/777/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/799/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/658/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/912/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/759/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/936/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/918/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/761/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/785/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/884/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/720/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/721/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/788/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/789/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/801/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/847/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6264) File opened: /proc/904/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/491/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/793/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/772/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/796/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/774/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/797/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/777/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/799/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/658/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/912/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/759/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/936/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/918/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/761/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/785/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/884/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/720/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/721/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/788/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/789/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/801/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/847/fd Jump to behavior
Source: /tmp/sora.sh4.elf (PID: 6258) File opened: /proc/904/fd Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sora.sh4.elf (PID: 6256) Queries kernel information via 'uname': Jump to behavior
Source: sora.sh4.elf, 6256.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6258.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6370.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6391.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6377.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6259.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6373.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6265.1.00007ffe83168000.00007ffe83189000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: sora.sh4.elf, 6256.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6258.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6370.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6391.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6377.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6259.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6373.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6265.1.000055c89c033000.000055c89c096000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sora.sh4.elf, 6256.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6258.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6370.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6391.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6377.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6259.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6373.1.000055c89c033000.000055c89c096000.rw-.sdmp, sora.sh4.elf, 6265.1.000055c89c033000.000055c89c096000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: sora.sh4.elf, 6256.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6258.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6370.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6391.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6377.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6259.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6373.1.00007ffe83168000.00007ffe83189000.rw-.sdmp, sora.sh4.elf, 6265.1.00007ffe83168000.00007ffe83189000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/sora.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.sh4.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: sora.sh4.elf, type: SAMPLE
Source: Yara match File source: 6258.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6256.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6373.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6377.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6265.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6370.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6391.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: sora.sh4.elf, type: SAMPLE
Source: Yara match File source: 6258.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6256.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6373.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6377.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6265.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6259.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6370.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6391.1.00007fbcb8400000.00007fbcb8410000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
40.171.13.139
 unknown United States
4249 LILLY-ASUS false
46.42.188.209
 unknown Russian Federation
29125 TATINT-ASRU false
125.24.185.103
 unknown Thailand
23969 TOT-NETTOTPublicCompanyLimitedTH false
102.183.41.50
 unknown Liberia
37611 AfrihostZA false
123.143.96.29
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
190.196.244.62
 unknown Brazil
266176 LidercomProvedordeInternetEireliBR false
12.37.37.21
 unknown United States
7018 ATT-INTERNET4US false
206.184.228.2
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
67.168.72.31
 unknown United States
7922 COMCAST-7922US false
198.52.48.12
 unknown Canada
16532 ASB2B2CCA false
79.241.129.230
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
160.243.164.250
 unknown Japan 33763 Paratus-TelecomNA false
104.193.64.238
 unknown Canada
40788 START-CA false
123.161.178.145
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
123.219.236.188
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
249.29.139.155
 unknown Reserved
unknown unknown false
141.179.178.54
 unknown Saudi Arabia
197921 HBTFJO false
37.155.141.80
 unknown Turkey
20978 TT_MOBILIstanbulTR false
84.136.128.150
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
34.196.147.221
 unknown United States
14618 AMAZON-AESUS false
120.133.230.95
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
34.133.129.132
 unknown United States
2686 ATGS-MMD-ASUS false
242.99.174.101
 unknown Reserved
unknown unknown false
18.2.148.82
 unknown United States
10578 GIGAPOP-NEUS false
89.26.19.168
 unknown Austria
8445 SALZBURG-AG-ASAT false
136.71.206.201
 unknown United States
60311 ONEFMCH false
179.8.44.140
 unknown Chile
7418 TELEFONICACHILESACL false
183.47.151.219
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
187.222.84.158
 unknown Mexico
8151 UninetSAdeCVMX false
174.150.82.9
 unknown United States
10507 SPCSUS false
18.13.159.78
 unknown United States
3 MIT-GATEWAYSUS false
160.184.64.149
 unknown South Africa
36903 MT-MPLSMA false
139.21.35.28
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
91.26.178.49
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
97.106.64.66
 unknown United States
33363 BHN-33363US false
159.210.217.155
 unknown Italy
131090 CAT-IDC-4BYTENET-AS-APCATTELECOMPublicCompanyLtdCATT false
200.195.143.98
 unknown Brazil
14868 COPELTelecomunicacoesSABR false
247.109.216.28
 unknown Reserved
unknown unknown false
101.77.181.47
 unknown China
24361 CNGI-NJ-IX-AS-APCERNET2IXatSoutheastUniversityCN false
83.171.120.94
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
16.182.229.249
 unknown United States
unknown unknown false
102.200.149.32
 unknown unknown
36926 CKL1-ASNKE false
240.190.252.32
 unknown Reserved
unknown unknown false
223.172.114.105
 unknown Korea Republic of
17853 LGTELECOM-AS-KRLGTELECOMKR false
240.141.28.147
 unknown Reserved
unknown unknown false
104.250.106.163
 unknown United States
38001 NEWMEDIAEXPRESS-AS-APNewMediaExpressPteLtdSG false
80.28.143.127
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
119.189.161.216
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
122.145.97.147
 unknown Japan 7522 STCNSTNetIncorporatedJP false
147.206.36.55
 unknown United States
55542 RMSNET-AS-APRoadsandMaritimeServicesAU false
9.40.102.234
 unknown United States
3356 LEVEL3US false
255.0.99.41
 unknown Reserved
unknown unknown false
128.34.109.214
 unknown United States
22 DNIC-AS-00022US false
75.34.40.76
 unknown United States
7018 ATT-INTERNET4US false
27.21.210.147
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
17.71.130.178
 unknown United States
714 APPLE-ENGINEERINGUS false
201.44.4.70
 unknown Brazil
4230 CLAROSABR false
97.182.161.38
 unknown United States
6167 CELLCO-PARTUS false
252.150.250.16
 unknown Reserved
unknown unknown false
117.91.17.188
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
177.164.124.57
 unknown Brazil
26615 TIMSABR false
249.97.54.74
 unknown Reserved
unknown unknown false
197.223.37.80
 unknown Egypt
37069 MOBINILEG false
176.36.221.61
 unknown Ukraine
39608 LANETUA-ASUA false
193.71.170.111
 unknown Norway
2116 ASN-CATCHCOMNO false
40.228.53.87
 unknown United States
4249 LILLY-ASUS false
221.251.101.224
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
125.226.158.96
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
31.136.150.74
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
192.127.197.56
 unknown United States
394122 DEBEVOISEUS false
185.10.130.115
 unknown Russian Federation
197078 YARNET-ASRU false
244.119.40.147
 unknown Reserved
unknown unknown false
153.8.254.9
 unknown United States
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
96.4.168.124
 unknown United States
11686 ENAUS false
85.165.155.15
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
176.134.120.70
 unknown France
5410 BOUYGTEL-ISPFR false
150.139.46.208
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
154.109.4.203
 unknown Tunisia
37693 TUNISIANATN false
190.2.206.247
 unknown Paraguay
23201 TelecelSAPY false
255.229.75.25
 unknown Reserved
unknown unknown false
104.32.102.253
 unknown United States
20001 TWC-20001-PACWESTUS false
187.71.10.11
 unknown Brazil
22085 ClaroSABR false
102.253.185.129
 unknown South Africa
5713 SAIX-NETZA false
125.76.57.51
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
198.25.182.14
 unknown United States
367 DNIC-ASBLK-00306-00371US false
98.122.159.225
 unknown United States
11426 TWC-11426-CAROLINASUS false
190.174.129.153
 unknown Argentina
22927 TelefonicadeArgentinaAR false
34.14.230.135
 unknown United States
2686 ATGS-MMD-ASUS false
148.63.160.193
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
245.90.212.74
 unknown Reserved
unknown unknown false
35.139.51.39
 unknown United States
33363 BHN-33363US false
176.202.29.171
 unknown Qatar
42298 GCC-MPLS-PEERINGGCCMPLSpeeringQA false
123.2.106.157
 unknown Australia
38285 VOCUS-RETAIL-AUVocusRetailAU false
168.151.75.210
 unknown United States
204472 ROYALEASNDE false
179.158.195.232
 unknown Brazil
28573 CLAROSABR false
96.224.76.158
 unknown United States
701 UUNETUS false
139.153.86.92
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
156.161.254.49
 unknown Egypt
36992 ETISALAT-MISREG false
66.16.127.110
 unknown United States
7029 WINDSTREAMUS false
135.45.138.143
 unknown United States
54614 CIKTELECOM-CABLECA false