Linux Analysis Report
sora.arm.elf

Overview

General Information

Sample name: sora.arm.elf
Analysis ID: 1561521
MD5: 0ece4cd98d4c079c639b2186bc43b645
SHA1: 48e53df0aa883a5b5c2e61f495b6e8494b713c60
SHA256: ce28f399bd7c307a8b9b59a8b3e8d49d709e9edbb927bc3dbb6a53dff9cb50d2
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: sora.arm.elf ReversingLabs: Detection: 50%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:36222 -> 45.95.169.104:1312
Sample listens on a socket
Source: /tmp/sora.arm.elf (PID: 5506) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) Socket: 0.0.0.0:53413 Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) Socket: 0.0.0.0:37215 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown TCP traffic detected without corresponding DNS query: 89.117.179.104
Source: unknown TCP traffic detected without corresponding DNS query: 20.187.91.109
Source: unknown TCP traffic detected without corresponding DNS query: 183.54.239.231
Source: unknown TCP traffic detected without corresponding DNS query: 213.59.98.231
Source: unknown TCP traffic detected without corresponding DNS query: 117.222.96.95
Source: unknown TCP traffic detected without corresponding DNS query: 14.143.118.77
Source: unknown TCP traffic detected without corresponding DNS query: 80.28.234.74
Source: unknown TCP traffic detected without corresponding DNS query: 218.121.187.245
Source: unknown TCP traffic detected without corresponding DNS query: 39.174.56.237
Source: unknown TCP traffic detected without corresponding DNS query: 170.102.173.227
Source: unknown TCP traffic detected without corresponding DNS query: 201.12.44.248
Source: unknown TCP traffic detected without corresponding DNS query: 186.255.50.61
Source: unknown TCP traffic detected without corresponding DNS query: 121.6.221.58
Source: unknown TCP traffic detected without corresponding DNS query: 58.20.171.101
Source: unknown TCP traffic detected without corresponding DNS query: 57.57.134.111
Source: unknown TCP traffic detected without corresponding DNS query: 219.214.119.133
Source: unknown TCP traffic detected without corresponding DNS query: 47.173.180.6
Source: unknown TCP traffic detected without corresponding DNS query: 223.174.168.202
Source: unknown TCP traffic detected without corresponding DNS query: 68.59.181.39
Source: unknown TCP traffic detected without corresponding DNS query: 155.234.224.79
Source: unknown TCP traffic detected without corresponding DNS query: 9.34.93.86
Source: unknown TCP traffic detected without corresponding DNS query: 216.169.163.100
Source: unknown TCP traffic detected without corresponding DNS query: 220.209.32.165
Source: unknown TCP traffic detected without corresponding DNS query: 79.243.236.233
Source: unknown TCP traffic detected without corresponding DNS query: 78.116.59.7
Source: unknown TCP traffic detected without corresponding DNS query: 102.165.136.28
Source: unknown TCP traffic detected without corresponding DNS query: 80.28.217.48
Source: unknown TCP traffic detected without corresponding DNS query: 198.24.7.41
Source: unknown TCP traffic detected without corresponding DNS query: 187.146.200.218
Source: unknown TCP traffic detected without corresponding DNS query: 19.100.156.161
Source: unknown TCP traffic detected without corresponding DNS query: 146.40.181.179
Source: unknown TCP traffic detected without corresponding DNS query: 101.220.67.103
Source: unknown TCP traffic detected without corresponding DNS query: 86.244.111.102
Source: unknown TCP traffic detected without corresponding DNS query: 88.183.79.63
Source: unknown TCP traffic detected without corresponding DNS query: 149.249.160.63
Source: unknown TCP traffic detected without corresponding DNS query: 139.239.109.127
Source: unknown TCP traffic detected without corresponding DNS query: 171.142.229.204
Source: unknown TCP traffic detected without corresponding DNS query: 135.42.254.74
Source: unknown TCP traffic detected without corresponding DNS query: 13.186.40.180
Source: unknown TCP traffic detected without corresponding DNS query: 217.159.43.19
Source: unknown TCP traffic detected without corresponding DNS query: 122.25.219.253
Source: unknown TCP traffic detected without corresponding DNS query: 241.141.6.69
Source: unknown TCP traffic detected without corresponding DNS query: 114.136.42.203
Source: unknown TCP traffic detected without corresponding DNS query: 23.113.95.169
Source: unknown TCP traffic detected without corresponding DNS query: 143.25.142.74
Source: unknown TCP traffic detected without corresponding DNS query: 141.185.66.152
Source: unknown TCP traffic detected without corresponding DNS query: 161.249.184.242
Source: unknown TCP traffic detected without corresponding DNS query: 105.75.237.42
Source: unknown TCP traffic detected without corresponding DNS query: 119.234.161.208
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: sora.arm.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5656.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5656.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5508.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5508.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5632.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5632.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5518.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5518.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5627.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5627.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5506.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5506.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5643.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5643.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5504.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5504.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5504, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5504, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5506, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5506, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5632, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5632, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5643, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5643, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5656, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.arm.elf PID: 5656, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Sample tries to kill a process (SIGKILL)
Source: /tmp/sora.arm.elf (PID: 5506) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) SIGKILL sent: pid: 940, result: successful Jump to behavior
Yara signature match
Source: 5656.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5656.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5508.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5508.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5632.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5632.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5518.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5518.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5627.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5627.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5506.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5506.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5643.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5643.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5504.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5504.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5504, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5504, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5506, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5506, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5508, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5632, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5632, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5643, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5643, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5656, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.arm.elf PID: 5656, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@2/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/490/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/791/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/794/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/795/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/797/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/853/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/780/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/661/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/782/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/785/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/940/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/767/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/801/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/725/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/769/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/726/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/803/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/806/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/807/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5512) File opened: /proc/928/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/490/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/791/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/794/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/795/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/797/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/853/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/780/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/661/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/782/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/785/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/940/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/767/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/801/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/725/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/769/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/726/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/803/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/806/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/807/fd Jump to behavior
Source: /tmp/sora.arm.elf (PID: 5506) File opened: /proc/928/fd Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: sora.arm.elf Submission file: segment LOAD with 7.9448 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sora.arm.elf (PID: 5504) Queries kernel information via 'uname': Jump to behavior
Source: sora.arm.elf, 5504.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5506.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5632.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5656.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5643.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5508.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5627.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5518.1.000055e252eb3000.000055e253061000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: sora.arm.elf, 5504.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5506.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5632.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5656.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5643.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5508.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5627.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5518.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/sora.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.arm.elf
Source: sora.arm.elf, 5504.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5506.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5632.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5656.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5643.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5508.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5627.1.000055e252eb3000.000055e253061000.rw-.sdmp, sora.arm.elf, 5518.1.000055e252eb3000.000055e253061000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: sora.arm.elf, 5504.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5506.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5632.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5656.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5643.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5508.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5627.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp, sora.arm.elf, 5518.1.00007ffc937b7000.00007ffc937d8000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5656.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5632.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5518.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5627.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5506.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5643.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5504.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5656.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5508.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5632.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5518.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5627.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5506.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5643.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5504.1.00007fdda4017000.00007fdda4029000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
126.205.19.101
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
152.213.166.208
 unknown United States
701 UUNETUS false
153.96.246.62
 unknown Germany
12643 IGDDE false
248.5.172.23
 unknown Reserved
unknown unknown false
199.114.53.70
 unknown United States
721 DNIC-ASBLK-00721-00726US false
153.96.246.66
 unknown Germany
12643 IGDDE false
203.223.78.202
 unknown Japan 17809 VEETIME-TW-APVEETIMECORPTW false
82.221.214.208
 unknown Iceland
50613 THORDC-ASIS false
84.227.75.85
 unknown Switzerland
6730 SUNRISECH false
17.189.140.88
 unknown United States
714 APPLE-ENGINEERINGUS false
71.244.220.134
 unknown United States
701 UUNETUS false
138.232.232.146
 unknown Austria
1110 UniversityofInnsbruckAT false
9.142.190.250
 unknown United States
3356 LEVEL3US false
42.202.30.63
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
82.228.46.107
 unknown France
12322 PROXADFR false
195.250.25.43
 unknown United Kingdom
57276 OPTIMITYGB false
150.94.153.62
 unknown Japan 6400 CompaniaDominicanadeTelefonosSADO false
202.60.69.43
 unknown Australia
45671 AS45671-NET-AUWholesaleServicesProviderAU false
39.44.18.191
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
160.49.75.171
 unknown Germany
2381 WISCNET1-ASUS false
4.81.105.212
 unknown United States
3356 LEVEL3US false
168.104.15.238
 unknown United States
3597 FundacionInnovaTAR false
245.59.60.152
 unknown Reserved
unknown unknown false
91.90.227.128
 unknown Latvia
24589 TELENETSIA-ASTelenetAUT-NUMpeeringspecificationobject false
78.224.112.146
 unknown France
12322 PROXADFR false
143.37.31.188
 unknown United States
11003 PANDGUS false
181.219.209.190
 unknown Brazil
21826 CorporacionTelemicCAVE false
36.234.139.150
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
91.21.45.213
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
246.188.82.235
 unknown Reserved
unknown unknown false
253.177.51.170
 unknown Reserved
unknown unknown false
4.78.10.59
 unknown United States
3356 LEVEL3US false
241.224.185.21
 unknown Reserved
unknown unknown false
163.85.91.145
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
201.76.54.187
 unknown Brazil
27715 LocawebServicosdeInternetSABR false
115.82.160.205
 unknown Taiwan; Republic of China (ROC)
24158 TAIWANMOBILE-ASTaiwanMobileCoLtdTW false
9.68.50.161
 unknown United States
3356 LEVEL3US false
192.34.169.223
 unknown United States
54712 CI-100-43-212-0US false
104.100.148.234
 unknown United States
9443 VOCUS-RETAIL-AUVocusRetailAU false
85.185.219.61
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
13.91.200.25
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
169.240.5.221
 unknown United States
47024 THE-METROHEALTH-SYSTEMUS false
32.35.17.38
 unknown United States
2686 ATGS-MMD-ASUS false
191.254.53.62
 unknown Brazil
27699 TELEFONICABRASILSABR false
117.58.17.69
 unknown China
4782 GSNETDataCommunicationBusinessGroupTW false
211.251.80.16
 unknown Korea Republic of
38692 JBES-AS-KRJeonlabukdoEducationResearchInformationInstit false
251.111.38.222
 unknown Reserved
unknown unknown false
126.123.142.21
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
184.229.236.18
 unknown United States
10507 SPCSUS false
17.230.68.228
 unknown United States
714 APPLE-ENGINEERINGUS false
115.102.174.91
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
188.156.194.181
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
5.144.113.81
 unknown Russian Federation
8359 MTSRU false
23.87.149.76
 unknown United States
395954 LEASEWEB-USA-LAX-11US false
8.70.114.84
 unknown United States
3356 LEVEL3US false
113.189.219.236
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
195.133.109.250
 unknown Spain
43962 INTENPL false
43.61.74.57
 unknown Japan 4249 LILLY-ASUS false
8.61.112.20
 unknown United States
3356 LEVEL3US false
62.209.149.211
 unknown Uzbekistan
34718 TPSUZ-ASUZ false
212.49.223.44
 unknown United Kingdom
8426 CLARANET-ASClaraNETLTDGB false
86.36.113.88
 unknown Qatar
29384 QATAR-FOUNDATIONQA false
157.87.160.65
 unknown United States
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
201.213.161.77
 unknown Argentina
10481 TelecomArgentinaSAAR false
113.134.216.103
 unknown China
134768 CHINANET-SHAANXI-CLOUD-BASECHINANETSHAANXIprovinceCloud false
97.251.90.171
 unknown United States
6167 CELLCO-PARTUS false
170.21.66.159
 unknown United States
6102 CBSCORPORATEUS false
202.99.106.13
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
40.150.230.251
 unknown United States
4249 LILLY-ASUS false
46.224.193.38
 unknown Iran (ISLAMIC Republic Of)
56402 DADEHGOSTAR-ASAS12880-DataCommunicationCompanyofIran false
187.210.223.104
 unknown Mexico
8151 UninetSAdeCVMX false
118.109.4.210
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
9.193.186.242
 unknown United States
3356 LEVEL3US false
90.187.85.67
 unknown Germany
31334 KABELDEUTSCHLAND-ASDE false
152.33.196.188
 unknown United States
32417 ELONU-ASUS false
240.30.101.140
 unknown Reserved
unknown unknown false
94.164.232.61
 unknown Italy
24608 WINDTRE-ASIT false
88.160.179.127
 unknown France
12322 PROXADFR false
27.243.116.52
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
27.221.3.136
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
42.83.196.204
 unknown China
24151 CNNIC-CRITICAL-APChinaInternetNetworkInfomationCenter false
246.26.33.170
 unknown Reserved
unknown unknown false
104.214.22.71
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
107.192.39.103
 unknown United States
7018 ATT-INTERNET4US false
175.10.90.15
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
108.67.100.153
 unknown United States
7018 ATT-INTERNET4US false
157.40.148.219
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
177.193.82.219
 unknown Brazil
28573 CLAROSABR false
122.222.232.30
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
31.36.219.248
 unknown France
5410 BOUYGTEL-ISPFR false
119.9.55.158
 unknown Hong Kong
58683 RACKSPACE-ASRackspacecomSydneyHK false
18.243.215.239
 unknown United States
16509 AMAZON-02US false
253.182.147.184
 unknown Reserved
unknown unknown false
149.50.153.180
 unknown United States
174 COGENT-174US false
109.160.97.255
 unknown Bulgaria
205352 KBLNETBG false
70.211.53.103
 unknown United States
6167 CELLCO-PARTUS false
95.100.100.154
 unknown European Union
20940 AKAMAI-ASN1EU false
80.71.137.212
 unknown Denmark
197301 PARKNET-ASDK false
87.8.209.198
 unknown Italy
3269 ASN-IBSNAZIT false
141.79.193.14
 unknown Germany
553 BELWUEBelWue-KoordinationEU false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true