f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0

Analysis

max time kernel
150s
max time network
153s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20241127-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
10/12/2024, 03:49 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
Size

68KB
MD5

56e53d695c841e581df815c0725b8855
SHA1

ec60dad1388ec1044b808a22791f794c1915f618
SHA256

f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0
SHA512

f7825a1c2e3dec98245b16002db1781a3205d1936553fa4c5dbb2b2622716941b757dfac135efc282f629d331b3cf91bcdc117f72ae33d97ce242b248d6514f6
SSDEEP

1536:mOhjXtM7ayXRulHeEqPZTSBLDi8eKvJ3rw0hc1g4:mkXO7ayUJeEmZTSxD9eKvF8Qc1g

Score

9^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Contacts a large (23832) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for modification	/dev/misc/watchdog	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for modification	/bin/watchdog	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf

Reads process memory 1 TTPs 31 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/447/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/555/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/455/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/474/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/793/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/955/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/631/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/452/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/491/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/535/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/560/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/950/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/454/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/456/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/470/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/679/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/799/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/983/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/441/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/513/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/769/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/791/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/442/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/489/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/496/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/634/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/993/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/483/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/502/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/774/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/961/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	1392	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2025/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2198/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1564/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1623/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1297/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1394/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1899/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2015/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1554/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2040/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2156/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2571/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1057/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1397/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2547/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1335/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1379/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1559/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1649/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1336/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1618/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1343/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1482/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2200/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1044/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1077/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1331/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1340/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1387/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1470/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1586/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1590/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1916/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2036/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2108/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2029/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1547/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1556/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1635/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1950/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1747/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1109/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1463/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1541/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1640/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1333/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1570/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2035/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2224/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1083/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1503/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1631/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2125/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1526/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1548/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1968/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2031/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2215/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1516/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1596/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2141/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2219/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/1977/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
File opened for reading	/proc/2566/maps	f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf

/tmp/f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
/tmp/f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads process memory
- Changes its process name
- Reads runtime system information
PID:1392

Network

DNS

connectivity-check.ubuntu.com

Remote address:

1.1.1.1:53

Request

connectivity-check.ubuntu.com

IN AAAA

Response

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4000:1::2b

connectivity-check.ubuntu.com

IN AAAA

2001:67c:1562::24

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4002:1::196

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4000:1::23

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4000:1::96

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4002:1::198

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4000:1::2a

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4000:1::97

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4000:1::98

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4000:1::22

connectivity-check.ubuntu.com

IN AAAA

2620:2d:4002:1::197

connectivity-check.ubuntu.com

IN AAAA

2001:67c:1562::23
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN A

Response

daisy.ubuntu.com

IN A

162.213.35.24

daisy.ubuntu.com

IN A

162.213.35.25
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN AAAA

Response
DNS

30.0.127.10.in-addr.arpa

Request

30.0.127.10.in-addr.arpa

IN PTR

Response
DNS

30.0.127.10.in-addr.arpa

Request

30.0.127.10.in-addr.arpa

IN PTR

Response
DNS

b.e.3.8.8.f.e.f.f.f.6.1.1.7.4.6.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa

Request

b.e.3.8.8.f.e.f.f.f.6.1.1.7.4.6.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa

IN PTR

Response
DNS

b.e.3.8.8.f.e.f.f.f.6.1.1.7.4.6.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa

Request

b.e.3.8.8.f.e.f.f.f.6.1.1.7.4.6.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa

IN PTR

Response
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN A

Response

daisy.ubuntu.com

IN A

162.213.35.24

daisy.ubuntu.com

IN A

162.213.35.25
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN AAAA

Response
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN AAAA

Response
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN A

Response

daisy.ubuntu.com

IN A

162.213.35.25

daisy.ubuntu.com

IN A

162.213.35.24
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN AAAA

Response
DNS

daisy.ubuntu.com

Request

daisy.ubuntu.com

IN AAAA

Response
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy
DNS

Response

HTTP/1.0 200 OK

Server: Proxy

154.213.187.84:63645

969 B
808 B
18
15
193.58.105.126:2323

40 B
1
220.7.179.126:23

40 B
1
104.84.103.237:23

40 B
1
63.54.33.219:23

40 B
1
185.177.46.248:23

40 B
1
80.44.138.201:23

40 B
1
121.144.197.82:23

40 B
40 B
1
1
160.13.197.168:23

40 B
1
8.19.25.83:23

40 B
1
186.117.100.73:23

40 B
1
164.166.62.247:2323

40 B
1
73.227.55.50:23

40 B
1
69.41.158.127:23

40 B
1
206.162.116.14:23

40 B
1
93.165.39.64:23

40 B
1
217.227.186.201:23

40 B
1
211.215.171.105:23

40 B
1
112.173.114.136:23

40 B
1
180.83.170.10:23

40 B
1
93.245.241.47:23

40 B
1
207.44.125.244:2323

40 B
40 B
1
1
41.96.57.243:23

40 B
40 B
1
1
166.105.95.109:23

40 B
1
170.5.143.0:23

40 B
1
175.224.113.177:23

40 B
1
133.248.50.252:23

40 B
1
76.107.169.140:23

40 B
1
110.121.161.12:23

40 B
1
35.62.230.222:23

40 B
1
118.155.9.147:23

40 B
1
88.172.92.9:2323

40 B
1
1.66.164.118:23

40 B
40 B
1
1
175.67.20.72:23

40 B
1
154.159.49.98:23

40 B
1
48.103.56.49:23

40 B
1
89.221.247.244:23

40 B
40 B
1
1
66.152.70.138:23

40 B
1
65.42.147.190:23

40 B
1
223.171.162.39:23

40 B
1
23.65.212.137:23

40 B
1
163.45.222.241:2323

40 B
1
163.124.121.236:23

40 B
1
72.196.43.126:23

40 B
1
100.224.50.224:23

40 B
1
132.0.201.24:23

40 B
1
38.186.145.106:23

40 B
1
92.195.129.33:23

40 B
1
166.3.23.97:23

40 B
1
203.23.87.222:23

40 B
1
195.118.136.141:23

40 B
1
151.97.9.205:2323

40 B
1
184.114.90.74:23

40 B
1
202.205.4.25:23

40 B
1
207.166.185.85:23

40 B
1
168.115.223.205:23

40 B
1
170.203.135.231:23

40 B
1
170.27.10.119:23

40 B
1
119.162.200.85:23

40 B
1
65.212.228.192:23

40 B
1
136.88.161.3:23

40 B
1
173.56.242.160:2323

40 B
1
144.32.111.238:23

40 B
1
151.34.191.12:23

40 B
1
184.187.178.102:23

40 B
1
41.145.180.100:23

40 B
1
122.200.145.21:23

40 B
1
126.52.210.17:23

40 B
1
116.225.29.2:23

40 B
1
13.169.57.45:23

40 B
1
201.180.111.248:23

40 B
1
223.224.147.245:2323

40 B
1
112.204.243.194:23

40 B
1
60.28.156.175:23

40 B
1
194.132.218.75:23

40 B
1
90.6.24.221:23

40 B
1
87.243.90.33:23

40 B
1
187.228.191.159:23

40 B
1
118.117.134.78:23

40 B
1
48.157.222.69:23

40 B
1
217.153.92.36:23

40 B
1
148.236.105.60:2323

40 B
1
163.3.205.55:23

40 B
1
220.252.162.97:23

40 B
1
108.234.23.224:23

40 B
1
63.178.46.47:23

40 B
1
58.84.98.14:23

40 B
1
71.165.43.234:23

40 B
1
174.7.151.107:23

40 B
1
186.216.22.43:23

40 B
1
70.73.100.6:23

40 B
1
204.184.52.230:2323

40 B
1
75.39.70.145:23

40 B
1
125.122.12.106:23

40 B
1
149.131.66.255:23

40 B
1
97.219.154.117:23

40 B
1
19.237.164.206:23

40 B
1
178.201.98.142:23

40 B
1
218.188.169.54:23

40 B
1
180.100.68.129:23

40 B
1
193.88.177.69:23

40 B
1
196.164.254.115:2323

40 B
1
14.196.213.3:23

40 B
1
114.122.44.13:23

40 B
1
40.144.201.129:23

40 B
1
142.236.203.54:23

40 B
1
204.94.152.214:23

40 B
1
114.83.46.235:23

40 B
1
221.226.19.74:23

40 B
1
82.120.32.140:23

40 B
1
200.58.19.151:23

40 B
1
53.184.248.44:2323

40 B
1
171.178.41.248:23

40 B
1
168.86.151.144:23

40 B
1
210.30.25.164:23

40 B
1
95.100.116.241:23

40 B
1
218.242.157.181:23

40 B
1
143.36.128.222:23

40 B
1
220.243.167.169:23

40 B
1
182.123.13.221:23

40 B
1
133.153.51.14:23

40 B
1
211.32.140.14:2323

40 B
40 B
1
1
106.151.2.225:23

40 B
1
42.131.129.103:23

40 B
1
149.21.46.217:23

40 B
1
122.146.107.79:23

40 B
1
141.202.132.190:23

40 B
1
125.98.144.16:23

40 B
1
122.127.165.224:23

40 B
1
83.247.61.190:23

40 B
1
9.98.203.90:23

40 B
1
115.228.15.55:2323

40 B
1
170.40.194.3:23

40 B
1
95.16.213.229:23

40 B
1
76.168.82.51:23

40 B
1
159.104.113.89:23

40 B
1
182.138.134.228:23

40 B
1
176.29.237.124:23

40 B
1
182.245.205.108:23

40 B
1
203.75.67.131:23

40 B
1
36.45.33.101:23

40 B
1
156.183.200.85:2323

40 B
1
211.237.146.95:23

40 B
1
115.14.103.201:23

40 B
40 B
1
1
43.160.196.77:23

40 B
1
177.227.68.43:23

40 B
1
70.20.113.62:23

40 B
1
194.87.67.146:23

40 B
40 B
1
1
217.24.151.4:23

40 B
1
211.99.58.21:23

40 B
1
91.211.186.48:23

40 B
1
80.55.192.32:2323

40 B
1
173.34.113.55:23

40 B
1
67.67.102.55:23

40 B
1
162.109.140.127:23

40 B
1
95.33.175.243:23

40 B
1
111.216.117.169:23

40 B
1
39.116.177.6:23

40 B
40 B
1
1
83.186.237.189:23

40 B
1
105.34.149.50:23

40 B
1
221.62.229.16:23

40 B
1
106.85.207.100:2323

40 B
1
174.40.249.191:23

40 B
1
89.67.125.235:23

40 B
1
32.85.91.38:23

40 B
1
145.214.10.7:23

40 B
1
4.132.72.125:23

40 B
1
57.180.20.251:23

40 B
1
82.139.152.236:23

40 B
1
142.140.224.91:23

40 B
1
23.36.134.208:23

40 B
1
92.185.27.56:2323

40 B
1
45.231.252.47:23

40 B
1
85.196.139.213:23

40 B
1
81.22.132.210:23

40 B
40 B
1
1
157.16.131.93:23

40 B
1
63.79.178.139:23

40 B
1
75.214.119.229:23

40 B
1
92.98.196.52:23

40 B
1
189.85.228.51:23

40 B
1
108.24.37.150:23

40 B
1
212.147.186.16:2323

40 B
1
84.70.69.69:23

40 B
1
163.105.232.253:23

40 B
1
211.26.33.129:23

40 B
1
61.145.228.42:23

40 B
1
165.176.172.130:23

40 B
1
187.246.119.143:23

40 B
1
4.237.247.224:23

40 B
1
209.104.179.55:23

40 B
1
172.130.247.229:23

40 B
1
142.240.67.57:2323

40 B
1
83.161.92.77:23

40 B
1
84.133.119.86:23

40 B
1
46.191.91.215:23

40 B
1
93.167.222.251:23

40 B
1
114.199.127.160:23

40 B
1
79.51.75.241:23

40 B
1
179.252.111.184:23

40 B
1
188.43.121.227:23

40 B
1
38.163.26.35:23

40 B
1
159.72.45.161:2323

40 B
1
58.165.0.116:23

40 B
1
1.126.153.43:23

40 B
1
70.169.144.246:23

40 B
1
136.29.160.190:23

40 B
1
198.196.46.13:23

40 B
1
62.110.170.165:23

40 B
1
85.155.90.156:23

40 B
1
5.5.19.178:23

40 B
1
1.61.130.86:23

40 B
1
146.217.55.128:2323

40 B
1
160.8.108.127:23

40 B
1
184.79.129.72:23

40 B
1
208.34.240.244:23

40 B
1
149.72.79.234:23

40 B
1
191.213.149.190:23

40 B
1
126.241.138.140:23

40 B
1
117.90.43.195:23

40 B
1
190.87.167.207:23

40 B
1
75.41.174.87:23

40 B
1
103.13.38.168:2323

40 B
1
44.88.96.234:23

40 B
1
58.182.178.98:23

40 B
1
63.148.249.99:23

40 B
1
12.242.100.199:23

40 B
1
17.66.93.211:23

40 B
1
149.126.54.37:23

40 B
1
154.94.134.102:23

40 B
1
36.88.78.236:23

40 B
1
17.181.206.179:23

40 B
1
31.55.116.133:2323

40 B
1
176.113.127.211:23

40 B
1
107.140.10.51:23

40 B
1
46.77.75.87:23

40 B
40 B
1
1
204.167.3.13:23

40 B
1
111.68.123.183:23

40 B
1
150.18.5.2:23

40 B
1
75.220.178.10:23

40 B
1
40.177.34.117:23

40 B
1
180.186.148.179:23

40 B
1
27.213.26.64:2323

40 B
1
83.124.165.186:23

40 B
1
82.18.162.128:23

40 B
1
136.126.29.60:23

40 B
1
62.23.193.191:23

40 B
40 B
1
1
104.235.247.202:23

40 B
1
67.23.88.121:23

40 B
1
139.4.63.27:23

40 B
1
223.247.186.126:23

40 B
1
107.139.58.153:23

40 B
1
73.17.170.255:2323

40 B
1
96.144.55.222:23

40 B
1
44.185.83.31:23

40 B
1
213.226.81.55:23

40 B
1
46.40.114.227:23

40 B
1
42.64.35.112:23

40 B
1
17.76.120.48:23

40 B
1
27.147.154.94:23

40 B
1
89.202.75.117:23

40 B
1
194.126.79.209:23

40 B
1
133.240.214.214:2323

40 B
1
177.199.26.196:23

40 B
40 B
1
1
125.141.154.180:23

40 B
1
136.6.50.131:23

40 B
1
63.32.206.12:23

40 B
1
34.92.148.181:23

40 B
1
144.18.37.89:23

40 B
1
46.187.45.124:23

40 B
40 B
1
1
69.103.131.163:23

40 B
1
111.253.80.26:23

40 B
1
53.136.96.195:2323

40 B
1
161.43.73.251:23

40 B
1
175.150.189.23:23

40 B
1
46.120.118.148:23

40 B
1
168.43.144.55:23

40 B
1
172.103.144.9:23

40 B
1
180.231.249.109:23

40 B
1
192.47.28.207:23

40 B
1
101.133.225.164:23

40 B
1
146.99.97.19:23

40 B
1
123.26.191.209:2323

40 B
1
194.58.16.114:23

40 B
1
152.220.227.70:23

40 B
1
73.21.20.241:23

40 B
1
72.198.56.94:23

40 B
1
212.27.52.2:23

40 B
1
209.194.17.162:23

40 B
1
183.230.155.140:23

40 B
1
79.87.89.128:23

40 B
1
120.80.84.96:23

40 B
1
27.76.201.22:2323

40 B
1
77.28.60.170:23

40 B
1
41.249.16.140:23

40 B
1
188.132.60.220:23

40 B
1
81.161.2.12:23

40 B
40 B
1
1
210.253.26.74:23

40 B
1
177.244.58.39:23

40 B
1
154.1.166.73:23

40 B
1
73.32.38.218:23

40 B
1
44.243.28.13:23

40 B
1
65.33.12.239:2323

40 B
1
68.238.213.126:23

40 B
1
189.158.125.73:23

40 B
1
164.156.161.219:23

40 B
1
68.0.155.161:23

40 B
1
62.95.32.121:23

40 B
1
94.233.72.197:23

40 B
1
31.102.176.143:23

40 B
1
5.200.91.243:23

40 B
1
102.214.209.155:23

40 B
1
133.41.140.96:2323

40 B
1
187.130.245.54:23

40 B
1
45.218.38.70:23

40 B
1
206.74.164.212:23

40 B
1
209.80.246.163:23

40 B
1
148.161.130.49:23

40 B
1
12.236.70.212:23

40 B
1
45.1.159.161:23

40 B
1
70.8.76.68:23

40 B
1
156.28.233.31:23

40 B
1
213.86.90.30:2323

40 B
1
19.118.139.242:23

40 B
1
147.46.197.30:23

40 B
1
115.163.116.23:23

40 B
1
174.226.239.69:23

40 B
1
190.89.89.71:23

40 B
1
68.28.118.37:23

40 B
1
42.169.100.224:23

40 B
1
147.123.183.101:23

40 B
1
212.227.181.101:23

40 B
1
118.82.148.242:2323

40 B
1
89.128.179.53:23

40 B
1
141.238.0.139:23

40 B
1
87.151.61.100:23

40 B
1
75.41.124.174:23

40 B
1
121.96.15.192:23

40 B
1
42.212.72.197:23

40 B
1
89.42.47.0:23

40 B
1
18.110.148.120:23

40 B
1
164.164.168.132:23

40 B
1
163.84.145.200:2323

40 B
1
68.161.115.91:23

40 B
1
176.135.239.104:23

40 B
1
75.86.74.77:23

40 B
1
223.76.32.188:23

40 B
1
117.50.242.25:23

40 B
1
155.97.139.94:23

40 B
1
194.61.12.15:23

40 B
1
63.205.108.251:23

40 B
1
96.26.26.60:23

40 B
1
102.95.131.40:2323

40 B
1
103.207.42.32:23

40 B
1
119.1.219.124:23

40 B
1
12.119.107.190:23

40 B
1
196.21.181.220:23

40 B
1
155.54.96.144:23

40 B
1
36.33.227.95:23

40 B
1
59.105.233.205:23

40 B
1
74.48.4.242:23

40 B
40 B
1
1
206.101.255.138:23

40 B
1
69.71.159.171:2323

40 B
1
58.97.143.29:23

40 B
1
202.9.239.97:23

40 B
1
130.216.114.22:23

40 B
1
115.21.91.134:23

40 B
1
19.81.1.88:23

40 B
1
121.216.240.107:23

40 B
1
110.41.226.138:23

40 B
1
86.196.4.180:23

40 B
1
142.240.210.72:23

40 B
1
108.247.17.161:2323

40 B
1
126.57.39.224:23

40 B
1
24.200.1.208:23

40 B
1
141.96.147.144:23

40 B
1
164.29.96.53:23

40 B
1
207.34.246.129:23

40 B
1
156.47.71.110:23

40 B
1
162.248.168.184:23

40 B
1
48.0.63.72:23

40 B
1
132.254.6.253:23

40 B
1
180.202.14.108:2323

40 B
1
154.63.231.150:23

40 B
1
145.143.180.121:23

40 B
1
211.193.214.9:23

40 B
1
177.227.86.196:23

40 B
1
162.33.98.71:23

40 B
1
168.25.195.162:23

40 B
1
74.239.108.191:23

40 B
1
160.19.49.13:23

40 B
1
66.220.72.36:23

40 B
1
62.39.88.236:2323

40 B
1
80.88.200.155:23

40 B
1
169.32.147.151:23

40 B
1
203.93.187.223:23

40 B
1
106.134.245.152:23

40 B
1
84.226.40.110:23

40 B
1
204.73.153.18:23

40 B
1
14.199.19.19:23

40 B
1
104.48.53.180:23

40 B
1
186.173.89.183:23

40 B
1
110.60.23.224:2323

40 B
1
82.246.215.89:23

40 B
1
13.50.242.26:23

40 B
1
60.12.43.173:23

40 B
1
36.146.90.5:23

40 B
1
61.19.237.45:23

40 B
1
203.241.12.203:23

40 B
1
209.196.85.195:23

40 B
1
104.230.133.101:23

40 B
1
216.54.226.202:23

40 B
1
61.89.162.159:2323

40 B
1
119.45.202.146:23

40 B
1
204.164.207.56:23

40 B
1
140.248.130.37:23

40 B
1
85.128.200.247:23

40 B
1
207.111.72.211:23

40 B
1
139.144.228.61:23

40 B
1
104.175.21.169:23

40 B
1
119.152.215.112:23

40 B
1
12.17.143.27:23

40 B
1
204.148.70.108:2323

40 B
1
102.100.107.158:23

40 B
1
148.217.198.131:23

40 B
1
173.53.113.248:23

40 B
1
199.100.144.243:23

40 B
1
211.38.192.154:23

40 B
1
4.19.209.82:23

40 B
1
157.236.82.25:23

40 B
1
208.24.94.84:23

40 B
1
208.211.248.241:23

40 B
1
147.24.117.176:2323

40 B
1
94.241.105.255:23

40 B
1
13.218.7.187:23

40 B
1
94.226.140.5:23

40 B
40 B
1
1
189.111.95.84:23

40 B
1
41.70.132.123:23

40 B
1
23.123.61.235:23

40 B
1
135.12.34.21:23

40 B
1
151.18.76.10:23

40 B
1
42.149.163.35:23

40 B
1
169.77.7.103:2323

40 B
1
154.70.122.82:23

40 B
1
67.30.109.195:23

40 B
1
81.197.162.168:23

40 B
1
64.237.166.101:23

40 B
1
136.23.118.147:23

40 B
1
147.20.73.156:23

40 B
1
61.66.114.148:23

40 B
1
147.5.54.94:23

40 B
1
167.47.200.20:23

40 B
1
200.9.193.111:2323

40 B
1
136.54.65.140:23

40 B
1
75.148.8.23:23

40 B
1
119.162.90.165:23

40 B
1
14.62.153.133:23

40 B
40 B
1
1
173.92.27.29:23

40 B
1
40.144.246.167:23

40 B
1
63.196.126.137:23

40 B
1
121.70.49.128:23

40 B
1
148.226.198.182:23

40 B
1
48.32.233.196:2323

40 B
1
76.127.238.123:23

40 B
1
93.36.229.113:23

40 B
1
151.197.102.227:23

40 B
1
107.165.24.20:23

40 B
1
12.173.144.141:23

40 B
1
172.222.87.112:23

40 B
1
105.59.139.183:23

40 B
1
209.218.169.145:23

40 B
1
136.160.220.56:23

40 B
1
12.219.206.137:2323

40 B
1
165.106.149.87:23

40 B
1
159.67.243.163:23

40 B
1
209.64.93.194:23

40 B
1
113.237.13.227:23

40 B
1
36.105.51.104:23

40 B
1
171.66.223.216:23

40 B
1
170.176.225.95:23

40 B
1
78.250.252.213:23

40 B
1
72.239.82.31:23

40 B
1
145.41.172.123:2323

40 B
1
9.192.19.157:23

40 B
1
109.151.183.74:23

40 B
1
211.1.177.198:23

40 B
1
187.38.218.14:23

40 B
1
47.223.219.119:23

40 B
1
59.234.185.70:23

40 B
1
70.159.163.198:23

40 B
1
85.252.219.185:23

40 B
1
47.209.230.76:23

40 B
1
54.96.224.203:2323

40 B
1
121.123.169.91:23

40 B
1
70.177.121.113:23

40 B
1
91.119.121.54:23

40 B
1
44.236.162.83:23

40 B
1
159.167.249.70:23

40 B
1
90.93.132.129:23

40 B
1

224.0.0.251:5353

8.6kB
55
1.1.1.1:53

connectivity-check.ubuntu.com

dns

86 B
422 B
1
1

DNS Request

connectivity-check.ubuntu.com

DNS Response

2620:2d:4000:1::2b

2001:67c:1562::24

2620:2d:4002:1::196

2620:2d:4000:1::23

2620:2d:4000:1::96

2620:2d:4002:1::198

2620:2d:4000:1::2a

2620:2d:4000:1::97

2620:2d:4000:1::98

2620:2d:4000:1::22

2620:2d:4002:1::197

2001:67c:1562::23

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

DNS Request

DNS Response

Loading Replay Monitor...