b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/03/2025, 04:41 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
Size

36KB
MD5

60dcb6b17e4c2bfe8538c546e0891790
SHA1

fa479fa7ca6381d2ffeea8ae216c0fc599069850
SHA256

b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35
SHA512

c3c8381f3ebf9a281b706d144219fb392df46756f9f40f0526fed0ff0c9e9e67e5073f43a14b1139991313d615cde048ef0288c63a5cfc6e44a19249eaf9603a
SSDEEP

768:6tpf5yjepoCyNjwxBbPct5sUIlP4XEA7bNPMfA9tbU6IL4C:2f5yC+NUxB7ct5kPQEmMI9tJ/

Score

9^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Contacts a large (14398) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for modification	/dev/misc/watchdog	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf

Renames itself 1 IoCs

pid	Process
644	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	168.235.111.72

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/762/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/772/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/664/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/687/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/694/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/706/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/730/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/740/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/773/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/774/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/667/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/722/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/738/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/765/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/776/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/777/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/779/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/685/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/709/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/745/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/756/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/768/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/726/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/691/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/698/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/704/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/725/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/732/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/668/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/671/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/676/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/703/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/710/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/712/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/733/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/763/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/693/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/708/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/735/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/748/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/757/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/767/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/771/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/781/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/716/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/755/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/761/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/764/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/770/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/684/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/707/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/780/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/695/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/697/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/727/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/742/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/769/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/663/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/670/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/682/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/713/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/714/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/720/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/739/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	login	644	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/636/status	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/773/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/6/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/23/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/269/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/644/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/630/status	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/670/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/721/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/743/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/7/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/107/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/636/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/299/status	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/698/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/716/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/747/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/781/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/29/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/106/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/212/status	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/663/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/677/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/740/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/752/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/780/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/684/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/693/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/212/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/296/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/637/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/668/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/696/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/723/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/162/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/410/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/735/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/750/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/770/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/775/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/12/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/17/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/18/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/641/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/639/status	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/self/maps	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/727/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/136/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/299/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/708/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/715/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/726/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/265/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/394/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/599/status	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/707/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/709/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/714/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/738/cmdline	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/26/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/5/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/25/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/74/comm	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
File opened for reading	/proc/296/status	b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf

/tmp/b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
/tmp/b97d3b2d55c0a8fc873da4accd60f26d45031d4a1f45d9cefdac7350bba9dc35.elf
1⤵
- Modifies Watchdog functionality
- Renames itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:644

Network

DNS

watchmepull.dyn

Remote address:

168.235.111.72:53

Request

watchmepull.dyn

IN A

Response

watchmepull.dyn

IN A

185.220.204.227

watchmepull.dyn

IN A

45.147.251.145

watchmepull.dyn

IN A

64.227.79.152

watchmepull.dyn

IN A

159.89.101.70

watchmepull.dyn

IN A

193.143.1.116

20.7.73.30:23

40 B
1
88.13.25.241:23

40 B
1
43.194.112.158:23

40 B
1
160.212.120.118:23

40 B
1
63.237.49.239:23

40 B
1
176.53.200.213:23

40 B
1
159.219.246.216:23

40 B
1
107.247.253.249:23

40 B
1
84.99.110.161:23

40 B
1
135.131.104.187:23

40 B
1
131.142.224.245:23

40 B
1
209.212.194.100:23

40 B
1
50.160.24.131:23

40 B
1
104.167.208.34:23

40 B
1
144.123.79.56:23

40 B
1
187.169.90.135:23

40 B
1
39.105.42.64:23

40 B
1
162.145.232.63:23

40 B
1
34.165.193.253:23

40 B
1
195.53.91.45:23

40 B
1
110.76.90.228:23

40 B
1
37.39.13.108:23

40 B
1
171.189.74.161:23

40 B
1
113.12.2.79:23

40 B
1
198.213.43.30:23

40 B
1
91.3.131.57:23

40 B
1
205.250.70.87:23

40 B
1
58.101.153.255:23

40 B
1
122.77.33.148:23

40 B
1
165.92.176.119:23

40 B
1
144.113.70.151:23

40 B
1
23.195.185.131:23

40 B
1
58.204.227.187:23

40 B
1
175.188.207.79:23

40 B
1
140.160.176.154:23

40 B
1
31.4.166.177:23

40 B
1
41.196.214.40:23

40 B
1
168.60.203.221:23

40 B
1
35.115.177.153:23

40 B
1
43.89.135.35:23

40 B
1
9.53.172.32:23

40 B
1
167.49.168.224:23

40 B
1
12.218.28.67:23

40 B
1
190.105.73.25:23

40 B
1
151.52.32.161:23

40 B
1
140.0.218.21:23

40 B
1
154.188.182.189:23

40 B
1
36.141.113.62:23

40 B
1
218.166.136.190:23

40 B
1
166.13.135.166:23

40 B
1
146.90.69.127:23

40 B
1
121.144.176.152:23

40 B
1
87.93.30.101:23

40 B
1
68.228.226.201:23

40 B
1
194.75.228.77:23

40 B
1
71.131.207.107:23

40 B
1
158.51.172.85:23

40 B
1
74.121.13.123:23

40 B
1
78.210.46.187:23

40 B
1
105.120.128.97:23

40 B
1
196.25.148.38:23

40 B
1
142.192.116.97:23

40 B
1
23.74.77.110:23

40 B
1
219.110.26.204:23

40 B
1
218.195.187.181:23

40 B
1
35.74.51.249:23

40 B
1
165.80.239.70:23

40 B
1
182.228.40.199:23

40 B
1
67.110.99.217:23

40 B
1
107.209.47.179:23

40 B
1
9.43.134.63:23

40 B
1
142.177.29.213:23

40 B
1
98.44.83.140:23

40 B
1
70.107.201.8:23

40 B
1
195.188.251.131:23

40 B
1
31.175.61.146:23

40 B
1
77.131.18.111:23

40 B
1
120.112.74.114:23

40 B
1
115.213.253.122:23

40 B
1
52.171.33.106:23

40 B
1
114.7.238.82:23

40 B
1
186.194.95.163:23

40 B
1
88.212.114.180:23

40 B
1
135.243.20.64:23

40 B
1
114.18.42.167:23

40 B
1
105.198.2.64:23

40 B
1
135.247.227.244:23

40 B
1
62.239.184.239:23

40 B
1
70.12.116.132:23

40 B
1
165.234.9.203:23

40 B
1
2.34.59.210:23

40 B
1
35.204.198.32:23

40 B
1
101.17.154.163:23

40 B
1
164.107.157.77:23

40 B
1
159.249.72.205:23

40 B
1
122.113.174.109:23

40 B
1
70.128.124.20:23

40 B
1
19.184.19.107:23

40 B
1
212.113.23.123:23

40 B
1
65.101.189.185:23

40 B
1
64.227.79.152:1440

watchmepull.dyn

903 B
742 B
17
14
25.28.166.180:23

40 B
1
219.179.241.156:23

40 B
1
39.249.77.104:23

40 B
1
61.126.135.23:23

40 B
1
14.104.3.22:23

40 B
1
57.203.117.221:23

40 B
1
90.58.199.225:23

40 B
1
91.11.146.26:23

40 B
1
91.27.151.101:23

40 B
1
114.110.82.239:23

40 B
1
12.222.104.88:23

40 B
1
166.126.9.194:23

40 B
1
208.177.49.155:23

40 B
1
17.85.188.9:23

40 B
1
53.114.165.38:23

40 B
1
25.35.227.2:23

40 B
1
128.79.87.88:23

40 B
1
204.56.10.109:23

40 B
1
25.195.187.12:23

40 B
1
155.132.25.168:23

40 B
1
209.49.179.239:23

40 B
1
146.36.203.87:23

40 B
1
171.35.178.169:23

40 B
1
141.124.111.141:23

40 B
1
65.36.250.137:23

40 B
1
53.165.81.72:23

40 B
1
153.81.150.96:23

40 B
1
94.29.179.122:23

40 B
1
117.45.201.233:23

40 B
1
90.7.195.157:23

40 B
1
41.29.11.162:23

40 B
1
220.231.240.77:23

40 B
1
156.172.133.131:23

40 B
1
184.5.139.118:23

40 B
1
95.9.244.222:23

40 B
1
192.144.199.26:23

40 B
1
24.95.11.153:23

40 B
1
92.52.193.244:23

40 B
1
2.146.231.136:23

40 B
1
90.90.192.144:23

40 B
1
185.214.159.208:23

40 B
1
96.40.216.216:23

40 B
1
126.146.120.115:23

40 B
1
79.198.226.229:23

40 B
1
45.82.17.234:23

40 B
1
156.37.249.230:23

40 B
1
124.64.227.181:23

40 B
1
58.147.133.151:23

40 B
1
163.234.86.203:23

40 B
1
146.244.152.124:23

40 B
1
113.187.75.110:23

40 B
1
79.42.53.108:23

40 B
1
85.16.160.237:23

40 B
1
160.195.104.195:23

40 B
1
120.50.105.48:23

40 B
1
140.33.177.228:23

40 B
1
134.176.229.117:23

40 B
1
145.125.199.117:23

40 B
1
156.136.109.20:23

40 B
1
64.53.169.254:23

40 B
1
179.221.67.105:23

40 B
1
153.109.184.251:23

40 B
1
51.235.23.237:23

40 B
1
104.219.165.85:23

40 B
40 B
1
1
102.184.82.32:23

40 B
1
45.96.1.123:23

40 B
1
157.159.54.200:23

40 B
1
146.204.72.156:23

40 B
1
158.49.75.9:23

40 B
1
98.236.102.249:23

40 B
1
2.200.131.48:23

40 B
1
212.27.185.89:23

40 B
1
179.36.148.177:23

40 B
1
182.223.149.32:23

40 B
1
109.164.26.207:23

40 B
1
124.151.115.193:23

40 B
1
187.72.120.67:23

40 B
1
116.207.103.186:23

40 B
1
221.166.181.191:23

40 B
1
191.41.207.79:23

40 B
1
108.54.64.43:23

40 B
1
216.17.204.108:23

40 B
1
35.65.148.240:23

40 B
1
71.119.117.100:23

40 B
1
178.109.184.131:23

40 B
1
170.43.126.251:23

40 B
1
19.247.144.28:23

40 B
1
177.5.57.245:23

40 B
1
188.141.128.181:23

40 B
1
45.224.212.68:23

40 B
1
156.128.173.215:23

40 B
1
61.32.216.186:23

40 B
1
190.131.114.218:23

40 B
1
105.141.159.75:23

40 B
1
154.248.142.102:23

40 B
1
105.121.248.13:23

40 B
1
150.69.81.75:23

40 B
1
151.195.139.229:23

40 B
1
126.189.155.178:23

40 B
1
58.183.111.170:23

40 B
1
194.31.156.67:23

40 B
1
118.126.167.39:23

40 B
1
68.130.235.177:23

40 B
1
31.194.75.46:23

40 B
1
222.255.173.160:23

40 B
1
78.227.71.212:23

40 B
1
176.176.73.48:23

40 B
1
17.141.202.29:23

40 B
1
60.115.172.57:23

40 B
1
23.180.91.80:23

40 B
1
51.193.16.59:23

40 B
1
223.223.220.241:23

40 B
1
79.216.71.44:23

40 B
1
113.64.25.188:23

40 B
1
98.133.176.35:23

40 B
1
43.213.190.156:23

40 B
1
24.38.156.55:23

40 B
1
99.237.159.39:23

40 B
1
184.32.3.96:23

40 B
1
40.141.96.230:23

40 B
1
113.205.255.226:23

40 B
1
153.38.89.90:23

40 B
1
95.86.9.220:23

40 B
1
1.108.193.96:23

40 B
1
90.93.90.58:23

40 B
1
192.87.43.93:23

40 B
1
150.131.251.163:23

40 B
1
107.88.17.158:23

40 B
1
45.131.197.183:23

40 B
1
202.101.75.38:23

40 B
1
152.41.7.159:23

40 B
1
77.65.66.189:23

40 B
1
210.251.29.31:23

40 B
1
206.78.253.160:23

40 B
1
59.195.113.107:23

40 B
1
50.99.6.255:23

40 B
1
209.172.134.146:23

40 B
1
19.133.26.213:23

40 B
1
146.150.247.91:23

40 B
1
41.4.169.118:23

40 B
1
43.113.215.9:23

40 B
1
217.84.14.246:23

40 B
1
44.66.47.80:23

40 B
1
69.121.220.172:23

40 B
1
115.60.99.73:23

40 B
1
134.137.121.92:23

40 B
1
1.248.192.174:23

40 B
1
163.145.33.25:23

40 B
1
34.29.167.77:23

40 B
1
23.244.55.171:23

40 B
1
125.79.35.119:23

40 B
1
183.236.248.156:23

40 B
1
175.247.119.51:23

40 B
1
178.70.172.57:23

40 B
1
213.230.125.150:23

40 B
1
125.164.212.24:23

40 B
1
92.167.127.219:23

40 B
1
136.48.233.150:23

40 B
1
185.139.47.228:23

40 B
1
150.163.127.12:23

40 B
1
130.140.240.50:23

40 B
1
198.26.49.125:23

40 B
1
119.54.55.180:23

40 B
1
114.87.207.214:23

40 B
1
175.202.9.112:23

40 B
1
181.252.52.19:23

40 B
1
193.29.210.86:23

40 B
1
211.24.65.63:23

40 B
1
150.196.18.22:23

40 B
1
82.172.75.142:23

40 B
1
24.161.56.153:23

40 B
40 B
1
1
139.238.188.46:23

40 B
1
93.130.54.28:23

40 B
1
139.46.140.137:23

40 B
1
14.28.197.52:23

40 B
1
78.211.244.11:23

40 B
1
183.222.72.244:23

40 B
1
220.135.9.61:23

40 B
1
137.223.209.38:23

40 B
1
64.212.67.234:23

40 B
1
42.32.249.17:23

40 B
1
139.245.226.82:23

40 B
1
54.55.139.215:23

40 B
1
4.90.201.138:23

40 B
1
27.204.120.86:23

40 B
1
140.0.191.76:23

40 B
1
166.48.29.39:23

40 B
1
95.139.88.44:23

40 B
1
139.37.215.252:23

40 B
1
216.145.85.54:23

40 B
1
189.149.201.109:23

40 B
1
62.179.196.122:23

40 B
1
155.251.85.143:23

40 B
1
103.142.145.134:23

40 B
1
84.30.255.201:23

40 B
1
66.214.28.205:23

40 B
1
12.94.165.232:23

40 B
1
201.165.65.60:23

40 B
1
110.199.113.51:23

40 B
1
137.215.188.164:23

40 B
1
31.172.19.80:23

40 B
1
71.105.31.106:23

40 B
1
103.165.233.175:23

40 B
1
196.116.155.32:23

40 B
1
60.242.16.224:23

40 B
1
143.204.12.72:23

40 B
1
119.190.49.168:23

40 B
1
65.56.35.51:23

40 B
1
129.83.210.43:23

40 B
1
134.9.27.48:23

40 B
1
171.147.120.98:23

40 B
1
152.80.86.22:23

40 B
1
157.144.213.23:23

40 B
1
116.211.242.4:23

40 B
1
20.250.204.187:23

40 B
1
31.186.28.173:23

40 B
1
14.56.83.71:23

40 B
40 B
1
1
107.233.13.13:23

40 B
1
90.141.65.221:23

40 B
1
141.247.79.15:23

40 B
1
188.214.77.74:23

40 B
1
42.5.170.246:23

40 B
1
121.136.153.109:23

40 B
1
211.153.143.62:23

40 B
1
170.211.33.129:23

40 B
1
221.225.210.94:23

40 B
1
4.24.207.49:23

40 B
1
18.140.53.47:23

40 B
1
152.107.87.57:23

40 B
1
92.99.109.94:23

40 B
1
203.19.170.34:23

40 B
1
207.166.177.47:23

40 B
1
70.144.77.170:23

40 B
1
205.121.101.159:23

40 B
1
179.243.82.28:23

40 B
1
131.54.55.142:23

40 B
1
85.38.179.211:23

40 B
1
151.2.150.1:23

40 B
40 B
1
1
111.44.154.0:23

40 B
1
39.101.250.105:23

40 B
1
64.12.23.123:23

40 B
1
186.183.21.83:23

40 B
1
103.14.106.199:23

40 B
1
105.87.233.214:23

40 B
1
41.3.208.70:23

40 B
1
96.207.6.149:23

40 B
1
24.87.159.100:23

40 B
1
60.89.254.79:23

40 B
1
25.51.177.227:23

40 B
1
105.101.251.150:23

40 B
1
162.237.232.197:23

40 B
1
14.255.212.44:23

40 B
1
167.229.219.88:23

40 B
1
113.111.111.250:23

40 B
1
196.149.181.245:23

40 B
1
134.129.68.140:23

40 B
1
71.210.109.172:23

40 B
1
138.122.156.178:23

40 B
1
194.138.217.223:23

40 B
1
36.63.219.191:23

40 B
1
97.38.47.73:23

40 B
1
148.46.70.186:23

40 B
1
135.198.91.206:23

40 B
1
83.80.109.137:23

40 B
1
218.61.124.216:23

40 B
1
132.206.97.158:23

40 B
1
18.168.177.114:23

40 B
1
82.103.11.109:23

40 B
1
145.134.6.46:23

40 B
1
102.22.131.27:23

40 B
1
191.77.15.190:23

40 B
1
165.56.24.182:23

40 B
1
188.179.43.237:23

40 B
1
152.135.65.132:23

40 B
1
17.2.166.165:23

40 B
1
64.197.60.34:23

40 B
1
41.170.150.112:23

40 B
1
31.32.62.81:23

40 B
1
79.67.144.221:23

40 B
1
52.135.25.143:23

40 B
1
101.76.249.91:23

40 B
1
159.146.41.12:23

40 B
1
35.253.129.254:23

40 B
1
113.52.206.165:23

40 B
1
181.252.36.17:23

40 B
1
64.76.52.53:23

40 B
1
144.112.58.206:23

40 B
1
150.71.48.117:23

40 B
1
213.191.26.255:23

40 B
1
18.240.141.77:23

40 B
1
188.217.196.153:23

40 B
1
193.175.243.109:23

40 B
1
202.130.42.173:23

40 B
1
74.176.120.244:23

40 B
1
79.8.126.127:23

40 B
1
201.132.199.150:23

40 B
1
131.69.19.211:23

40 B
1
202.230.83.101:23

40 B
1
49.149.215.131:23

40 B
1
194.248.116.121:23

40 B
1
132.246.13.125:23

40 B
1
170.239.214.172:23

40 B
40 B
1
1
92.178.248.152:23

40 B
1
101.213.139.36:23

40 B
1
71.50.153.109:23

40 B
1
126.188.161.182:23

40 B
1
75.235.152.190:23

40 B
1
114.48.87.98:23

40 B
1
2.139.177.205:23

40 B
1
104.57.150.180:23

40 B
1
116.24.82.20:23

40 B
1
197.47.27.96:23

40 B
1
213.150.220.227:23

40 B
1
44.100.5.39:23

40 B
1
219.208.20.10:23

40 B
1
191.55.26.80:23

40 B
1
188.157.176.61:23

40 B
1
202.170.136.112:23

40 B
1
136.87.169.40:23

40 B
1
106.141.143.154:23

40 B
1
163.147.100.2:23

40 B
1
113.172.107.146:23

40 B
1
97.241.217.68:23

40 B
1
110.73.195.140:23

40 B
1
131.129.210.117:23

40 B
1
9.179.124.82:23

40 B
1
208.24.174.68:23

40 B
1
85.102.64.113:23

40 B
1
18.210.249.106:23

40 B
1
13.52.188.69:23

40 B
1
121.161.239.150:23

40 B
40 B
1
1
172.178.75.225:23

40 B
1
220.88.216.246:23

40 B
40 B
1
1
73.92.105.237:23

40 B
1
158.126.167.233:23

40 B
1
54.153.250.214:23

40 B
1
146.94.95.183:23

40 B
1
118.72.59.116:23

40 B
1
114.223.235.168:23

40 B
1
209.168.246.34:23

40 B
1
171.1.161.92:23

40 B
1
204.143.229.70:23

40 B
1
74.202.148.130:23

40 B
1
181.174.190.158:23

40 B
1
84.61.177.1:23

40 B
1
129.255.14.48:23

40 B
1
42.18.209.229:23

40 B
1
83.119.42.136:23

40 B
1
207.115.180.158:23

40 B
1
218.54.213.73:23

40 B
1
114.91.242.213:23

40 B
1
139.71.221.20:23

40 B
1
162.164.228.55:23

40 B
1
97.217.70.203:23

40 B
1
216.231.210.7:23

40 B
1
23.80.5.99:23

40 B
1
125.143.197.227:23

40 B
40 B
1
1
201.170.152.69:23

40 B
1
138.111.6.152:23

40 B
1
73.154.50.104:23

40 B
1
161.195.217.166:23

40 B
1
148.7.6.50:23

40 B
1
144.56.130.102:23

40 B
1
34.222.22.150:23

40 B
1
113.8.47.27:23

40 B
1
83.13.243.17:23

40 B
1
149.239.199.107:23

40 B
1
39.206.235.60:23

40 B
1
197.98.181.82:23

40 B
1
86.216.171.121:23

40 B
1
34.16.133.76:23

40 B
1
76.97.252.51:23

40 B
1
122.148.113.29:23

40 B
1
117.148.117.74:23

40 B
1
221.185.41.46:23

40 B
1
60.99.200.201:23

40 B
1
62.42.8.68:23

40 B
1
185.37.36.37:23

40 B
1
82.46.73.55:23

40 B
1
70.130.58.26:23

40 B
1
218.244.197.172:23

40 B
1
211.251.21.119:23

40 B
40 B
1
1
49.38.255.37:23

40 B
1
106.119.141.223:23

40 B
1
81.190.117.94:23

40 B
1
144.65.97.27:23

40 B
1
62.42.186.84:23

40 B
1
148.53.217.35:23

40 B
1
151.96.128.106:23

40 B
1
74.244.35.184:23

40 B
1
131.68.103.207:23

40 B
1
208.197.191.218:23

40 B
1
53.202.21.217:23

40 B
1
64.99.229.125:23

40 B
1
183.202.114.116:23

40 B
1
148.130.143.214:23

40 B
1
68.133.146.60:23

40 B
1
161.59.150.88:23

40 B
1

168.235.111.72:53

watchmepull.dyn

dns

61 B
141 B
1
1

DNS Request

watchmepull.dyn

DNS Response

185.220.204.227

45.147.251.145

64.227.79.152

159.89.101.70

193.143.1.116

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

DNS Request

DNS Response

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.