ef2c1fb3021bd5fdd2a2a666dfea2129b6c40e7028a950899177c69eadf2c226

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
02/02/2025, 05:12 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef2c1fb3021bd5fdd2a2a666dfea2129b6c40e7028a950899177c69eadf2c226.elf
Size

33KB
MD5

e51e5ad5ab2f56f44eeee5c3e6383107
SHA1

3190ef741256308fa4f53a4f05c699207515a641
SHA256

ef2c1fb3021bd5fdd2a2a666dfea2129b6c40e7028a950899177c69eadf2c226
SHA512

a5c2ced3712937db0d7ac0779ca33017ac7f5e9fcd5f6f23c9f4ad7042409a95c7a6b32c51ea47b668d305428f66eed3717b7639e800ef074e2bcb999906b785
SSDEEP

768:Tjha+4zu8iCkF3zA1NwZMj+nWZZAxPUmLii:TjhaBaXMHg0+nWZZiMmLii

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (6708) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid
1562

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Renames itself 1 IoCs

pid
1562

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	168.235.111.72

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc
File opened for reading	/proc/net/tcp

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	pid
Changes the process name, possibly in an attempt to hide itself	1562

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc
File opened for reading	/proc/585/status
File opened for reading	/proc/1176/status
File opened for reading	/proc/1237/status
File opened for reading	/proc/1312/status
File opened for reading	/proc/1195/status
File opened for reading	/proc/1226/status
File opened for reading	/proc/1107/status
File opened for reading	/proc/1242/status
File opened for reading	/proc/1308/status
File opened for reading	/proc/self/maps
File opened for reading	/proc/1608/cmdline
File opened for reading	/proc/1283/status
File opened for reading	/proc/612/status
File opened for reading	/proc/750/status
File opened for reading	/proc/968/status
File opened for reading	/proc/1074/status
File opened for reading	/proc/1194/status
File opened for reading	/proc/639/status
File opened for reading	/proc/1588/cmdline
File opened for reading	/proc/451/status
File opened for reading	/proc/1044/status
File opened for reading	/proc/931/status
File opened for reading	/proc/1061/status
File opened for reading	/proc/1629/cmdline
File opened for reading	/proc/988/status
File opened for reading	/proc/1238/status
File opened for reading	/proc/1388/status
File opened for reading	/proc/797/status
File opened for reading	/proc/980/status
File opened for reading	/proc/1376/status
File opened for reading	/proc/1583/cmdline
File opened for reading	/proc/1419/status
File opened for reading	/proc/1630/cmdline
File opened for reading	/proc/613/status
File opened for reading	/proc/636/status
File opened for reading	/proc/774/status
File opened for reading	/proc/1131/status
File opened for reading	/proc/1140/status
File opened for reading	/proc/688/status
File opened for reading	/proc/1158/status
File opened for reading	/proc/1212/status
File opened for reading	/proc/1483/status
File opened for reading	/proc/633/status
File opened for reading	/proc/690/status
File opened for reading	/proc/1303/status
File opened for reading	/proc/1354/status
File opened for reading	/proc/1579/cmdline
File opened for reading	/proc/1639/cmdline
File opened for reading	/proc/1640/cmdline
File opened for reading	/proc/795/status
File opened for reading	/proc/1629/maps
File opened for reading	/proc/1189/status
File opened for reading	/proc/1552/status
File opened for reading	/proc/1630/maps
File opened for reading	/proc/762/status
File opened for reading	/proc/1009/status
File opened for reading	/proc/1033/status
File opened for reading	/proc/1082/status
File opened for reading	/proc/1160/status
File opened for reading	/proc/1084/status
File opened for reading	/proc/1144/status
File opened for reading	/proc/723/status
File opened for reading	/proc/736/status
File opened for reading	/proc/743/status

Network

DNS

serisontop.dyn

Remote address:

168.235.111.72:53

Request

serisontop.dyn

IN A

Response

serisontop.dyn

IN A

64.225.86.206

serisontop.dyn

IN A

209.38.188.134

serisontop.dyn

IN A

146.190.204.203

serisontop.dyn

IN A

209.38.56.129

serisontop.dyn

IN A

209.38.56.135

serisontop.dyn

IN A

68.183.244.135
DNS

_http._tcp.security.ubuntu.com

Request

_http._tcp.security.ubuntu.com

IN SRV

Response
DNS

_http._tcp.security.ubuntu.com

Request

_http._tcp.security.ubuntu.com

IN SRV

Response
DNS

_http._tcp.archive.ubuntu.com

Request

_http._tcp.archive.ubuntu.com

IN SRV

Response
DNS

archive.ubuntu.com

Request

archive.ubuntu.com

IN A

Response

archive.ubuntu.com

IN A

185.125.190.83

archive.ubuntu.com

IN A

91.189.91.81

archive.ubuntu.com

IN A

185.125.190.81

archive.ubuntu.com

IN A

91.189.91.82

archive.ubuntu.com

IN A

185.125.190.82

archive.ubuntu.com

IN A

91.189.91.83
DNS

archive.ubuntu.com

Request

archive.ubuntu.com

IN AAAA

Response

archive.ubuntu.com

IN AAAA

2620:2d:4000:1::103

archive.ubuntu.com

IN AAAA

2620:2d:4002:1::101

archive.ubuntu.com

IN AAAA

2620:2d:4002:1::102

archive.ubuntu.com

IN AAAA

2620:2d:4002:1::103

archive.ubuntu.com

IN AAAA

2620:2d:4000:1::102

archive.ubuntu.com

IN AAAA

2620:2d:4000:1::101
DNS

security.ubuntu.com

Request

security.ubuntu.com

IN A

Response

security.ubuntu.com

IN A

185.125.190.82

security.ubuntu.com

IN A

91.189.91.83

security.ubuntu.com

IN A

185.125.190.83

security.ubuntu.com

IN A

91.189.91.81

security.ubuntu.com

IN A

185.125.190.81

security.ubuntu.com

IN A

91.189.91.82
DNS

security.ubuntu.com

Request

security.ubuntu.com

IN AAAA

Response

security.ubuntu.com

IN AAAA

2620:2d:4002:1::101

security.ubuntu.com

IN AAAA

2620:2d:4000:1::103

security.ubuntu.com

IN AAAA

2620:2d:4002:1::103

security.ubuntu.com

IN AAAA

2620:2d:4002:1::102

security.ubuntu.com

IN AAAA

2620:2d:4000:1::102

security.ubuntu.com

IN AAAA

2620:2d:4000:1::101
GET

http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc-devtools_2.35-0ubuntu3.8_amd64.deb

Request

GET /ubuntu/pool/main/g/glibc/libc-devtools_2.35-0ubuntu3.8_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

Response

HTTP/1.1 200 OK

Date: Sun, 02 Feb 2025 05:15:02 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Wed, 29 May 2024 16:10:47 GMT
ETag: "7116-61999fe4fd38f"
Accept-Ranges: bytes
Content-Length: 28950
Cache-Control: max-age=86400
Content-Type: application/vnd.debian.binary-package
GET

http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc6-dev_2.35-0ubuntu3.8_amd64.deb

Request

GET /ubuntu/pool/main/g/glibc/libc6-dev_2.35-0ubuntu3.8_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

Response

HTTP/1.1 200 OK

Date: Sun, 02 Feb 2025 05:15:02 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Wed, 29 May 2024 16:10:48 GMT
ETag: "200d08-61999fe6280dc"
Accept-Ranges: bytes
Content-Length: 2100488
Cache-Control: max-age=86400
Content-Type: application/vnd.debian.binary-package
GET

http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc-dev-bin_2.35-0ubuntu3.8_amd64.deb

Request

GET /ubuntu/pool/main/g/glibc/libc-dev-bin_2.35-0ubuntu3.8_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

Response

HTTP/1.1 200 OK

Date: Sun, 02 Feb 2025 05:15:02 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Wed, 29 May 2024 16:10:48 GMT
ETag: "4f72-61999fe58ebb5"
Accept-Ranges: bytes
Content-Length: 20338
Cache-Control: max-age=86400
Content-Type: application/vnd.debian.binary-package
GET

http://archive.ubuntu.com/ubuntu/pool/main/l/linux/linux-libc-dev_5.15.0-117.127_amd64.deb

Request

GET /ubuntu/pool/main/l/linux/linux-libc-dev_5.15.0-117.127_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

Response

HTTP/1.1 404 Not Found

Date: Sun, 02 Feb 2025 05:15:02 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 280
Content-Type: text/html; charset=iso-8859-1
GET

http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc6-dbg_2.35-0ubuntu3.8_amd64.deb

Request

GET /ubuntu/pool/main/g/glibc/libc6-dbg_2.35-0ubuntu3.8_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

Response

HTTP/1.1 200 OK

Date: Sun, 02 Feb 2025 05:15:02 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Wed, 29 May 2024 16:10:49 GMT
ETag: "d29464-61999fe6668df"
Accept-Ranges: bytes
Content-Length: 13800548
Cache-Control: max-age=86400
Content-Type: application/vnd.debian.binary-package
GET

http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.35-0ubuntu3.8_amd64.deb

Request

GET /ubuntu/pool/main/g/glibc/libc6_2.35-0ubuntu3.8_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive
GET

http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc-bin_2.35-0ubuntu3.8_amd64.deb

Request

GET /ubuntu/pool/main/g/glibc/libc-bin_2.35-0ubuntu3.8_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive
GET

http://archive.ubuntu.com/ubuntu/pool/main/p/python3.10/libpython3.10_3.10.12-1%7e22.04.4_amd64.deb

Request

GET /ubuntu/pool/main/p/python3.10/libpython3.10_3.10.12-1%7e22.04.4_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive
GET

http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl3_3.0.2-0ubuntu1.16_amd64.deb

Request

GET /ubuntu/pool/main/o/openssl/libssl3_3.0.2-0ubuntu1.16_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive
GET

http://archive.ubuntu.com/ubuntu/pool/main/p/python3.10/python3.10_3.10.12-1%7e22.04.4_amd64.deb

Request

GET /ubuntu/pool/main/p/python3.10/python3.10_3.10.12-1%7e22.04.4_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive
GET

http://archive.ubuntu.com/ubuntu/pool/main/p/python3.10/libpython3.10-stdlib_3.10.12-1%7e22.04.4_amd64.deb

Request

GET /ubuntu/pool/main/p/python3.10/libpython3.10-stdlib_3.10.12-1%7e22.04.4_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive
GET

http://archive.ubuntu.com/ubuntu/pool/main/p/python3.10/python3.10-minimal_3.10.12-1%7e22.04.4_amd64.deb

Request

GET /ubuntu/pool/main/p/python3.10/python3.10-minimal_3.10.12-1%7e22.04.4_amd64.deb HTTP/1.1
Host: archive.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive
GET

http://security.ubuntu.com/ubuntu/pool/main/m/mutter/gir1.2-mutter-10_42.9-0ubuntu7.1_amd64.deb

Request

GET /ubuntu/pool/main/m/mutter/gir1.2-mutter-10_42.9-0ubuntu7.1_amd64.deb HTTP/1.1
Host: security.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

Response

HTTP/1.1 200 OK

Date: Sun, 02 Feb 2025 05:15:02 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Thu, 09 May 2024 13:06:04 GMT
ETag: "20416-6180514dd3520"
Accept-Ranges: bytes
Content-Length: 132118
Cache-Control: max-age=86400
Content-Type: application/vnd.debian.binary-package
GET

http://security.ubuntu.com/ubuntu/pool/main/m/mutter/libmutter-10-0_42.9-0ubuntu7.1_amd64.deb

Request

GET /ubuntu/pool/main/m/mutter/libmutter-10-0_42.9-0ubuntu7.1_amd64.deb HTTP/1.1
Host: security.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

Response

HTTP/1.1 200 OK

Date: Sun, 02 Feb 2025 05:15:03 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Thu, 09 May 2024 13:06:04 GMT
ETag: "150ae4-6180514e02322"
Accept-Ranges: bytes
Content-Length: 1379044
Cache-Control: max-age=86400
Content-Type: application/vnd.debian.binary-package
GET

http://security.ubuntu.com/ubuntu/pool/main/m/mutter/mutter-common_42.9-0ubuntu7.1_all.deb

Request

GET /ubuntu/pool/main/m/mutter/mutter-common_42.9-0ubuntu7.1_all.deb HTTP/1.1
Host: security.ubuntu.com
User-Agent: Debian APT-HTTP/1.3 (2.4.11) non-interactive

190.40.164.196:23

40 B
1
74.89.52.196:23

40 B
1
195.1.7.174:23

40 B
1
69.251.95.156:23

40 B
1
24.68.155.154:23

40 B
1
219.114.207.206:23

40 B
1
144.163.180.160:23

40 B
1
126.98.201.109:23

40 B
1
68.21.121.156:23

40 B
1
116.110.218.240:23

40 B
1
179.1.88.255:23

40 B
1
179.168.59.125:23

40 B
1
72.76.179.218:23

40 B
1
129.61.58.19:23

40 B
1
187.184.24.65:23

40 B
1
182.20.124.152:23

40 B
1
171.228.151.16:23

40 B
1
192.148.161.117:23

40 B
1
96.40.130.54:23

40 B
1
125.222.77.108:23

40 B
1
203.219.163.47:23

40 B
1
174.200.166.135:23

40 B
1
57.128.18.151:23

40 B
1
193.150.209.36:23

40 B
1
173.197.96.12:23

40 B
1
178.84.103.172:23

40 B
1
53.160.129.143:23

40 B
1
102.0.87.88:23

40 B
1
204.248.63.91:23

40 B
1
66.150.5.205:23

40 B
1
200.236.107.142:23

40 B
1
121.33.56.179:23

40 B
1
66.187.10.252:23

40 B
40 B
1
1
18.134.103.49:23

40 B
1
178.139.224.202:23

40 B
1
154.54.115.233:23

40 B
1
82.30.175.72:23

40 B
1
125.232.198.151:23

40 B
1
86.2.85.196:23

40 B
1
95.249.199.13:23

40 B
1
95.237.158.83:23

40 B
1
196.193.177.223:23

40 B
1
79.10.57.236:23

40 B
1
187.192.67.38:23

40 B
1
195.2.114.5:23

40 B
1
64.225.86.206:1440

serisontop.dyn

851 B
638 B
16
12
165.185.57.38:23

40 B
1
83.202.194.122:23

40 B
1
163.249.151.194:23

40 B
1
212.142.33.228:23

40 B
1
51.165.49.195:23

40 B
1
106.21.13.220:23

40 B
1
140.251.14.156:23

40 B
1
23.180.89.143:23

40 B
1
200.13.10.112:23

40 B
1
111.229.25.83:23

40 B
1
123.80.77.239:23

40 B
1
135.141.22.238:23

40 B
1
88.243.93.7:23

40 B
1
155.233.228.43:23

40 B
1
188.241.21.164:23

40 B
1
65.100.209.229:23

40 B
1
210.44.37.52:23

40 B
1
217.62.206.121:23

40 B
1
145.152.184.238:23

40 B
1
171.95.73.108:23

40 B
1
213.96.245.134:23

40 B
1
176.146.94.8:23

40 B
1
13.63.252.222:23

40 B
1
188.178.244.161:23

40 B
1
81.95.150.193:23

40 B
1
25.62.174.184:23

40 B
1
118.71.20.93:23

40 B
1
2.129.127.112:23

40 B
1
88.91.250.6:23

40 B
1
77.214.79.234:23

40 B
1
19.25.153.39:23

40 B
1
4.190.158.52:23

40 B
1
189.161.54.69:23

40 B
1
155.75.62.155:23

40 B
1
173.27.183.130:23

40 B
1
38.203.120.60:23

40 B
1
76.134.198.91:23

40 B
1
189.10.140.102:23

40 B
1
139.138.230.63:23

40 B
1
35.108.86.131:23

40 B
1
156.122.94.113:23

40 B
1
162.138.188.20:23

40 B
1
196.41.164.3:23

40 B
1
38.154.211.123:23

40 B
1
141.23.24.185:23

40 B
1
60.109.40.130:23

40 B
40 B
1
1
93.107.0.231:23

40 B
1
195.98.187.94:23

40 B
1
202.123.203.125:23

40 B
1
45.79.111.33:23

40 B
1
51.123.68.226:23

40 B
1
193.103.208.104:23

40 B
1
148.10.90.148:23

40 B
1
193.175.9.204:23

40 B
1
41.41.17.25:23

40 B
1
141.106.246.27:23

40 B
1
34.75.209.10:23

40 B
1
13.68.9.61:23

40 B
1
92.164.64.236:23

40 B
1
108.97.148.62:23

40 B
1
123.168.139.205:23

40 B
1
212.183.44.231:23

40 B
1
218.187.118.234:23

40 B
1
179.121.69.191:23

40 B
1
184.212.21.185:23

40 B
1
199.81.11.195:23

40 B
1
212.244.230.34:23

40 B
1
74.11.144.85:23

40 B
1
53.57.13.127:23

40 B
1
125.148.198.1:23

40 B
1
137.91.224.188:23

40 B
1
95.192.138.149:23

40 B
1
183.66.219.17:23

40 B
1
168.169.86.164:23

40 B
1
216.134.147.132:23

40 B
1
213.250.28.119:23

40 B
1
107.159.70.49:23

40 B
1
90.198.231.172:23

40 B
1
39.12.203.194:23

40 B
1
123.212.153.127:23

40 B
1
115.173.233.177:23

40 B
1
80.120.245.29:23

40 B
1
178.84.0.3:23

40 B
1
118.40.124.235:23

40 B
40 B
1
1
45.242.78.226:23

40 B
1
208.30.115.237:23

40 B
1
179.16.184.60:23

40 B
1
176.169.52.170:23

40 B
1
27.11.72.228:23

40 B
1
83.81.72.17:23

40 B
1
57.205.201.224:23

40 B
1
39.44.122.241:23

40 B
1
48.146.149.29:23

40 B
1
95.145.87.164:23

40 B
1
24.98.212.238:23

40 B
1
86.87.234.22:23

40 B
1
108.107.168.15:23

40 B
1
155.34.247.58:23

40 B
1
179.75.15.60:23

40 B
1
68.64.57.221:23

40 B
1
157.137.240.237:23

40 B
1
86.189.37.15:23

40 B
1
158.120.27.246:23

40 B
1
175.26.173.145:23

40 B
1
173.34.93.95:23

40 B
1
77.33.130.116:23

40 B
1
136.140.196.175:23

40 B
1
140.110.46.141:23

40 B
1
47.250.58.62:23

40 B
1
87.149.231.31:23

40 B
1
134.36.69.249:23

40 B
1
211.110.203.239:23

40 B
1
119.119.110.21:23

40 B
1
8.44.175.120:23

40 B
1
40.74.127.91:23

40 B
1
159.194.141.225:23

40 B
1
31.103.123.68:23

40 B
1
140.72.56.205:23

40 B
1
126.53.217.140:23

40 B
1
62.29.3.38:23

80 B
40 B
2
1
140.239.81.95:23

40 B
1
112.4.59.202:23

40 B
1
153.157.83.50:23

40 B
1
47.251.211.172:23

40 B
1
19.232.225.145:23

40 B
1
106.70.244.215:23

40 B
1
201.84.173.246:23

40 B
1
154.232.194.9:23

40 B
1
58.127.126.105:23

40 B
40 B
1
1
206.199.61.52:23

40 B
1
140.27.202.60:23

40 B
1
142.68.219.175:23

40 B
1
148.91.102.106:23

40 B
1
109.42.126.125:23

40 B
1
125.232.210.194:23

40 B
1
216.200.46.225:23

40 B
1
20.162.23.171:23

40 B
1
1.135.37.44:23

40 B
1
92.120.214.49:23

40 B
1
195.138.212.222:23

40 B
1
194.75.139.57:23

40 B
1
66.159.226.15:23

40 B
1
187.93.97.181:23

40 B
1
92.73.128.35:23

40 B
1
141.220.67.244:23

40 B
1
116.153.154.62:23

40 B
1
165.171.159.84:23

40 B
1
66.63.48.68:23

40 B
1
157.181.136.133:23

40 B
1
17.97.238.180:23

40 B
1
84.189.83.71:23

40 B
1
223.132.188.253:23

40 B
1
147.38.218.200:23

40 B
1
68.49.27.22:23

40 B
1
155.137.90.78:23

40 B
1
188.210.153.237:23

40 B
1
110.243.226.124:23

40 B
1
189.39.214.109:23

40 B
1
197.57.230.229:23

40 B
1
92.240.175.128:23

40 B
1
119.114.29.17:23

40 B
1
221.189.186.36:23

40 B
1
89.241.2.74:23

40 B
1
14.120.172.34:23

40 B
1
218.239.8.134:23

40 B
1
183.230.242.231:23

40 B
1
72.188.228.151:23

40 B
1
75.132.101.189:23

40 B
1
115.8.176.198:23

40 B
40 B
1
1
141.174.201.10:23

40 B
1
155.229.201.31:23

40 B
1
14.80.125.58:23

40 B
40 B
1
1
180.69.170.67:23

40 B
1
72.156.163.189:23

40 B
1
198.225.74.3:23

40 B
1
86.0.202.159:23

40 B
1
168.184.254.61:23

40 B
1
185.149.105.152:23

40 B
1
69.143.104.72:23

40 B
1
106.54.11.188:23

40 B
1
62.29.3.38:23

140 B
100 B
3
2
167.71.142.95:23

40 B
1
191.37.250.13:23

40 B
1
190.134.227.110:23

40 B
1
8.139.143.148:23

40 B
1
36.207.68.35:23

40 B
1
84.95.166.169:23

40 B
1
71.42.139.153:23

40 B
1
118.227.158.23:23

40 B
1
69.208.250.146:23

40 B
1
217.240.193.215:23

40 B
1
123.201.250.56:23

40 B
1
31.117.209.106:23

40 B
1
74.158.52.202:23

40 B
1
134.125.197.233:23

40 B
1
69.150.174.250:23

40 B
1
126.131.188.220:23

40 B
1
88.213.234.242:23

40 B
1
12.125.160.107:23

40 B
1
149.158.66.112:23

40 B
1
160.105.232.182:23

40 B
40 B
1
1
167.104.244.48:23

40 B
1
140.35.200.90:23

40 B
1
115.30.187.170:23

40 B
1
68.131.81.217:23

40 B
1
147.79.193.93:23

40 B
1
57.149.21.58:23

40 B
1
205.114.211.158:23

40 B
1
137.151.71.60:23

40 B
1
167.141.50.56:23

40 B
1
4.162.120.249:23

40 B
1
131.164.252.254:23

40 B
1
91.147.5.39:23

40 B
1
112.31.199.20:23

40 B
1
23.159.71.143:23

40 B
1
202.234.170.143:23

40 B
1
223.84.150.83:23

40 B
1
117.69.122.192:23

40 B
1
117.251.135.166:23

40 B
1
195.243.150.39:23

40 B
1
138.12.2.64:23

40 B
1
27.168.179.167:23

40 B
1
69.195.197.110:23

40 B
1
196.221.35.65:23

40 B
1
193.211.40.140:23

40 B
1
220.209.122.206:23

40 B
1
204.254.97.181:23

40 B
1
177.156.95.227:23

40 B
1
178.82.189.247:23

40 B
1
176.35.160.56:23

40 B
1
63.39.102.232:23

40 B
1
144.83.163.218:23

40 B
1
132.37.243.177:23

40 B
1
173.132.100.227:23

40 B
1
147.80.194.163:23

40 B
1
187.16.221.115:23

40 B
1
69.213.154.67:23

40 B
1
76.253.19.155:23

40 B
1
97.185.105.150:23

40 B
1
183.49.174.17:23

40 B
1
178.51.222.170:23

40 B
1
155.82.255.69:23

40 B
1
81.240.122.86:23

40 B
1
109.57.48.43:23

40 B
1
103.38.185.183:23

40 B
1
49.227.233.175:23

40 B
1
176.165.234.226:23

40 B
1
47.74.200.197:23

40 B
1
46.219.217.31:23

40 B
1
42.191.82.123:23

40 B
1
120.152.174.75:23

40 B
1
105.37.102.57:23

40 B
1
40.214.45.101:23

40 B
1
217.45.93.161:23

40 B
1
67.222.82.15:23

40 B
1
95.50.159.46:23

40 B
1
24.105.10.220:23

40 B
1
102.10.242.146:23

40 B
1
41.209.70.214:23

40 B
1
114.246.19.90:23

40 B
1
18.223.58.186:23

40 B
1
17.177.241.82:23

40 B
1
165.152.39.88:23

40 B
1
119.94.38.10:23

40 B
1
51.93.136.169:23

40 B
1
159.175.23.68:23

40 B
1
96.136.154.18:23

40 B
1
59.220.198.67:23

40 B
1
201.85.216.224:23

40 B
1
210.242.79.48:23

40 B
1
140.67.82.77:23

40 B
1
40.104.0.68:23

40 B
1
172.225.119.92:23

40 B
40 B
1
1
14.227.174.137:23

40 B
1
158.85.116.30:23

40 B
1
101.169.145.50:23

40 B
1
87.33.24.168:23

40 B
1
17.195.220.20:23

40 B
1
181.155.218.139:23

40 B
1
150.231.116.244:23

40 B
1
96.236.248.1:23

40 B
1
65.80.209.190:23

40 B
1
223.67.1.181:23

40 B
1
153.158.130.62:23

40 B
1
124.95.61.19:23

40 B
1
92.98.145.165:23

40 B
1
109.118.55.66:23

40 B
1
179.46.230.173:23

40 B
1
205.25.65.235:23

40 B
1
80.212.107.201:23

40 B
1
91.118.215.209:23

40 B
1
185.84.212.194:23

40 B
1
177.73.208.161:23

40 B
1
80.59.237.104:23

40 B
1
191.196.110.111:23

40 B
1
204.80.142.165:23

40 B
1
147.5.145.14:23

40 B
1
130.137.167.74:23

40 B
1
180.166.100.213:23

40 B
1
198.190.250.11:23

40 B
1
83.193.205.84:23

40 B
1
70.124.32.201:23

40 B
1
213.103.98.51:23

40 B
1
65.144.255.121:23

40 B
1
138.222.144.164:23

40 B
1
134.70.199.229:23

40 B
1
44.153.247.167:23

40 B
1
177.29.186.178:23

40 B
1
97.41.128.18:23

40 B
1
139.123.194.42:23

40 B
1
42.41.138.35:23

40 B
1
57.161.254.247:23

40 B
1
109.87.47.162:23

40 B
1
13.101.130.210:23

40 B
1
13.114.206.45:23

40 B
1
197.220.183.131:23

40 B
1
41.66.8.159:23

40 B
40 B
1
1
128.168.212.140:23

40 B
1
209.165.188.35:23

40 B
1
148.114.67.143:23

40 B
1
117.186.29.114:23

40 B
1
153.254.35.146:23

40 B
1
104.255.95.241:23

40 B
1
128.197.188.125:23

40 B
1
43.251.113.108:23

40 B
1
193.35.140.54:23

40 B
1
154.85.196.104:23

40 B
1
70.163.9.169:23

40 B
1
77.243.46.18:23

40 B
1
143.42.160.104:23

40 B
1
148.41.239.53:23

40 B
1
149.59.202.109:23

40 B
1
130.89.216.57:23

40 B
1
106.185.201.122:23

40 B
1
213.22.90.203:23

40 B
1
189.227.211.111:23

40 B
1
155.114.99.238:23

40 B
1
14.86.202.118:23

40 B
1
213.73.250.215:23

40 B
1
113.77.105.209:23

40 B
1
101.177.71.54:23

40 B
1
121.192.219.224:23

40 B
1
188.248.127.111:23

40 B
1
37.2.245.58:23

40 B
1
109.27.200.11:23

40 B
1
149.33.161.3:23

40 B
1
126.58.212.232:23

40 B
1
68.1.0.171:23

40 B
1
19.6.96.35:23

40 B
1
143.137.211.242:23

40 B
1
182.139.165.205:23

40 B
1
27.73.164.111:23

40 B
1
174.192.240.210:23

40 B
1
44.152.150.55:23

40 B
1
132.217.254.94:23

40 B
1
161.143.101.0:23

40 B
1
53.213.52.38:23

40 B
1
190.208.97.56:23

40 B
1
73.26.80.70:23

40 B
1
200.41.1.206:23

40 B
1
135.21.183.161:23

40 B
1
132.141.88.248:23

40 B
1
203.16.16.169:23

40 B
1
36.229.175.91:23

40 B
1
135.202.95.70:23

40 B
1
168.26.129.62:23

40 B
1
20.24.114.233:23

40 B
1
199.215.227.223:23

40 B
1
201.110.237.248:23

40 B
1
27.110.1.108:23

40 B
1
124.95.5.185:23

40 B
1
116.210.98.13:23

40 B
1
163.234.46.79:23

40 B
1
137.191.185.182:23

40 B
1
107.218.233.178:23

40 B
1
2.142.126.235:23

40 B
1
160.45.193.17:23

40 B
1
185.39.22.173:23

40 B
1
136.208.65.103:23

40 B
1
70.115.240.58:23

40 B
1
216.15.194.243:23

40 B
1
142.143.83.81:23

40 B
1
44.226.198.90:23

40 B
1
19.16.149.122:23

40 B
1
200.36.243.98:23

40 B
1
80.205.254.185:23

40 B
1
176.88.44.167:23

40 B
1
77.125.39.102:23

40 B
1
75.80.184.136:23

40 B
1
8.199.221.44:23

40 B
1
66.63.174.135:23

40 B
1
94.22.248.212:23

40 B
1
42.159.158.242:23

40 B
1
170.8.181.3:23

40 B
1
103.43.157.226:23

40 B
1
79.130.246.73:23

40 B
1
100.254.78.226:23

40 B
1
61.157.198.148:23

40 B
1
137.228.44.241:23

40 B
1
195.16.156.196:23

40 B
1
69.246.27.18:23

40 B
1
82.214.248.200:23

40 B
1
60.228.160.171:23

40 B
1
162.44.48.127:23

40 B
1
205.249.96.145:23

40 B
1
63.100.27.191:23

40 B
1
124.93.226.127:23

40 B
1
222.194.225.218:23

40 B
1
218.228.250.200:23

40 B
1
32.143.235.54:23

40 B
1
145.165.112.75:23

40 B
1
222.202.69.244:23

40 B
1
76.33.149.244:23

40 B
1
86.12.14.94:23

40 B
1
92.11.67.109:23

40 B
1
160.117.31.190:23

40 B
1
40.130.22.174:23

40 B
1
176.18.123.150:23

40 B
1
68.24.75.132:23

40 B
1
181.233.170.127:23

40 B
1
66.150.242.139:23

40 B
1
157.136.207.198:23

40 B
1
58.247.55.183:23

40 B
1
157.160.84.3:23

40 B
1
201.155.89.173:23

40 B
1
150.64.28.181:23

40 B
1
126.11.164.92:23

40 B
1
108.217.134.124:23

40 B
1
194.167.166.77:23

40 B
1
117.13.228.63:23

40 B
1
86.132.209.27:23

40 B
1
200.153.56.9:23

40 B
1
188.199.185.112:23

40 B
1
24.8.196.225:23

40 B
1
53.11.197.29:23

40 B
1
94.241.207.138:23

40 B
1
65.247.143.21:23

40 B
1
107.209.12.254:23

40 B
1
152.13.5.130:23

40 B
1
75.140.235.245:23

40 B
1
87.22.157.97:23

40 B
1
192.233.248.1:23

40 B
1
116.137.101.182:23

40 B
1
47.136.170.29:23

40 B
1
83.148.129.160:23

40 B
1
99.19.151.228:23

40 B
1
96.109.25.222:23

40 B
1
223.187.164.71:23

40 B
1
204.146.225.130:23

40 B
1
203.145.90.163:23

40 B
1
110.149.43.223:23

40 B
1
47.40.249.249:23

40 B
1

224.0.0.251:5353

146 B
2
168.235.111.72:53

serisontop.dyn

dns

60 B
156 B
1
1

DNS Request

serisontop.dyn

DNS Response

64.225.86.206

209.38.188.134

146.190.204.203

209.38.56.129

209.38.56.135

68.183.244.135

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

DNS Request

DNS Response

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.