Edit tour

Linux Analysis Report
78mfG4QdNn.elf

Overview

General Information

Sample name:	78mfG4QdNn.elf renamed because original name is a hash value
Original sample name:	8cd2686d55d8abf6c5f626c71d94a8ff.elf
Analysis ID:	1417432
MD5:	8cd2686d55d8abf6c5f626c71d94a8ff
SHA1:	0c808f720090c41f1a397360eb66e5a238ad8f73
SHA256:	43026ac08eb41f4464a8cefecb8b9f7140f54ed598c2d2bc8e868fa0c063c0c5
Tags:	64elfgafgyt
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417432
Start date and time:	2024-03-29 09:45:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	78mfG4QdNn.elf renamed because original name is a hash value
Original Sample Name:	8cd2686d55d8abf6c5f626c71d94a8ff.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/78mfG4QdNn.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

78mfG4QdNn.elf (PID: 5432, Parent: 5357, MD5: 8cd2686d55d8abf6c5f626c71d94a8ff) Arguments: /tmp/78mfG4QdNn.elf

78mfG4QdNn.elf New Fork (PID: 5433, Parent: 5432)

78mfG4QdNn.elf New Fork (PID: 5434, Parent: 5433)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
78mfG4QdNn.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
78mfG4QdNn.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x10a7:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x6668:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0xfcd:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ff6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x405a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x4175:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x1777:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x182c:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1a6d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x9bf2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6a19:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x1deb:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0xeef:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0xb24:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3db6:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x6d0f:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
78mfG4QdNn.elf	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0xb18:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Click to see the 11 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5432.1.0000000000400000.0000000000413000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x10a7:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x6668:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0xfcd:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ff6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x405a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x4175:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x1777:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x182c:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1a6d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x9bf2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6a19:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x1deb:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0xeef:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0xb24:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3db6:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x6d0f:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5432.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0xb18:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5433.1.0000000000400000.0000000000413000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x10a7:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x6668:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0xfcd:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ff6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x405a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x4175:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x1777:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x182c:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1a6d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x9bf2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6a19:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x1deb:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0xeef:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0xb24:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3db6:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x6d0f:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5433.1.0000000000400000.0000000000413000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0xb18:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Process Memory Space: 78mfG4QdNn.elf PID: 5432	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 78mfG4QdNn.elf PID: 5432	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 78mfG4QdNn.elf PID: 5433	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 78mfG4QdNn.elf PID: 5433	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1bb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 29 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 78mfG4QdNn.elf

Avira: detected

Found malware configuration

Source: 78mfG4QdNn.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "193.35.18.56:65490"}

Multi AV Scanner detection for submitted file

Source: 78mfG4QdNn.elf	ReversingLabs: Detection: 50%
Source: 78mfG4QdNn.elf	Virustotal: Detection: 53%			Perma Link

Machine Learning detection for sample

Source: 78mfG4QdNn.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/78mfG4QdNn.elf (PID: 5432)

Opens: /proc/net/route

Jump to behavior

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.35.18.56 ports 0,4,5,6,9,65490

Source: global traffic

TCP traffic: 192.168.2.13:37710 -> 193.35.18.56:65490

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: Process Memory Space: 78mfG4QdNn.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 78mfG4QdNn.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: LZRDskidx86?-_-=1IObeENwjmipsvlxx.arm6vlxx.armvlxx.x86_64vlxx.mipsvlxx.arm7vlxx.m68kvlxx.mpslvlxx.ppcvlxx.sh4vlxx.x86vlxx.arm5sys64.m68ksys64.x86sys64.x86_64sys64.arm6sys64.mpslsys64.spcsys64.ar64besys64.sh4sys64.aarch64sys64.i686sys64.arm7sys64.armsys64.mipssys64.arm5IObeENwjmpslIObeENwjarmIObeENwjarm4IObeENwjarm5IObeENwjarm6IObeENwjarm7.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppcdvrhelperhuhudvrsupportmiraiArceusla.bot.0xc2sfuckjewishpeople.mipsfuckjewishpeoplessh.mipsHadesboatnetloligangSakuraDemonbladedemonhohohakaisoramessiahmipsmipselsh4superhx86armv7armv6i686campnig.x86nigpercx86dosbotBOTDOS@DOSBOTDOSBOTperci5perci6percmipspercmpslpercsparkpercm68kpercppcpercsh4percshpercoarmperceightysixpercmips&lperc.shCronx86anacronCronarmCronmipsCronmpslCronspcCronm68kCronppcCronsh4Cronshcnrpox(deleted)killpstreekillallbgpmaplsofarmUser-Agent:/dev/nullSTD/etc/rc.conf/proc/net/tcp/proc/self/exeUPX!/proc/net/route/etc/rc.d/rc.local/bin/shtophtopgrepbashcatnanopssshtelnetdpcbashdvarsshdcurltftpdtelnetvar/Challen

Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 78mfG4QdNn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: Process Memory Space: 78mfG4QdNn.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 78mfG4QdNn.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: 78mfG4QdNn.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: 78mfG4QdNn.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 78mfG4QdNn.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 78mfG4QdNn.elf PID: 5433, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Safari/605.1.1 31.5
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3 17.34
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.1 11.27
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.1 9.83
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 9.25
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120. 6.94
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117. 2.31
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0. 2.31
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115. 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.3 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Herring/90.1.9310.1 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 OPR/105.0.0. 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.4 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.169 Mobile/15E148 Safari/604.
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: 78mfG4QdNn.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: 78mfG4QdNn.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.0000000000400000.0000000000413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 78mfG4QdNn.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 78mfG4QdNn.elf PID: 5433, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "193.35.18.56:65490"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
78mfG4QdNn.elf	50%	ReversingLabs	Linux.Trojan.Gafgyt
78mfG4QdNn.elf	54%	Virustotal		Browse
78mfG4QdNn.elf	100%	Avira	EXP/ELF.Mirai.Z
78mfG4QdNn.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
193.35.18.56:65490	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.35.18.56	unknown	Germany		41865	BIALLNET-ASPL	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.35.18.56	1zIdRfHN5N.elf	Get hash	malicious	Mirai	Browse
	hiVHXinGE3.elf	Get hash	malicious	Unknown	Browse
	bD3m9BoJzq.elf	Get hash	malicious	Unknown	Browse
	n9wkBW1daO.elf	Get hash	malicious	Mirai	Browse
	lUnktZrfeB.elf	Get hash	malicious	Unknown	Browse
	sKxfttWizQ.elf	Get hash	malicious	Unknown	Browse
	UGqFMD5JnO.elf	Get hash	malicious	Unknown	Browse
	WZlLmKfo15.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
185.125.190.26	mZFiaBnsij.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Mirai	Browse
	amoYv7E7Jr.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	V6ZLE4LLdV.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	4Ms5Z2Nn3p.elf	Get hash	malicious	Mirai	Browse
	aD5M1d6xfi.elf	Get hash	malicious	Mirai	Browse
	ALO7VSqIz0.elf	Get hash	malicious	Mirai	Browse
	UayOxBHqww.elf	Get hash	malicious	Gafgyt	Browse
	slYwzljCeu.elf	Get hash	malicious	Gafgyt	Browse
	wM5jx5wgkI.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	SecuriteInfo.com.Linux.BtcMine.798.28745.31751.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	p8F35SRiO8.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Kie7OQsnAC.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	DHz0sMSRlg.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	dj4jBpJkg6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	7JP4pajFXr.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	cvdLNZXNPZ.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jcTITjYCy0.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	zWzbBH1Px2.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mZFiaBnsij.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.BtcMine.791.1794.25936.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	cG90Z4Gln7.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	amoYv7E7Jr.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	xU378s6kE2.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	V6ZLE4LLdV.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	1IE558rszZ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	4Ms5Z2Nn3p.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
BIALLNET-ASPL	t6Bg659hSX.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	Y5sssTW9Ev.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	sDx2bQyU33.elf	Get hash	malicious	Mirai	Browse	193.35.18.164
	oPgt6oZlbo.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	XKpbIPPjsg.elf	Get hash	malicious	Mirai	Browse	193.35.18.164
	C6gnJR70dQ.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	DhnbzTcwoA.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	J5nCznX1CW.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.223
	1eTQg9ZVyA.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.223
	SGfGg5CCrI.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.223

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.9935864605070694
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	78mfG4QdNn.elf
File size:	117'706 bytes
MD5:	8cd2686d55d8abf6c5f626c71d94a8ff
SHA1:	0c808f720090c41f1a397360eb66e5a238ad8f73
SHA256:	43026ac08eb41f4464a8cefecb8b9f7140f54ed598c2d2bc8e868fa0c063c0c5
SHA512:	c9ffce6fb7b8dc8ac91015452a5927f275994ed27b6fd1c7eb10eeb351d4dd4c16d7676a6a2c9066873163f7519e540b0c7caf186210f52198009ba948e6316f
SSDEEP:	3072:d1TYGMLI+pnNPEXR8emVs3woJBhWmkI7w/7H4ob:djYEXR8LohWmkI7w/T4ob
TLSH:	12B3E717F511867AC09303B527CFEE226C33B6F62776B10733B06AB46E964479D05E8A
File Content Preview:	.ELF..............>.......@.....@........^..........@.8...@.......................@.......@.....?!......?!........ .............@!......@!a.....@!a......1................ .....Q.td....................................................H...._....*...H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	89776
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xc954	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40ca54	0xca54	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40ca70	0xca70	0x56cf	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x612140	0x12140	0x252c	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x614670	0x14670	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x614680	0x14680	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x614690	0x14690	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x6146a0	0x146a0	0xc58	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x615300	0x152f8	0x6b58	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x152f8	0xb52	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x15e4a	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16270	0x45d8	0x18	0x0		14	250	8
.strtab	STRTAB	0x0	0x1a848	0x2382	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1213f	0x1213f	6.5017	0x5	R E	0x200000	.init .text .fini .rodata
LOAD	0x12140	0x612140	0x612140	0x31b8	0x9d18	3.5732	0x6	RW	0x200000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40ca54	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40ca70	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x612140	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x614670	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x614680	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x614690	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x6146a0	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x615300	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
C.1.3849	.symtab	0x410ac0	40	OBJECT	<unknown>	DEFAULT	4
JoinName	.symtab	0x61b640	80	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x615380	16384	OBJECT	<unknown>	DEFAULT	10
SendHTTP	.symtab	0x402a87	392	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x402dad	379	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0x402c0f	414	FUNC	<unknown>	DEFAULT	2
Trim	.symtab	0x40086d	182	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x4040b8	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x614678	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x614670	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x614f20	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x4101c0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x614f30	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x4104c0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x614f40	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x4107c0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x614688	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x614680	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x612140	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x614668	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x614f20	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x614f30	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x614f40	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x614f28	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x614f38	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x614f48	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x4045b8	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x404054	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40999c	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x4062f8	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x408840	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x403ff0	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x40676c	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x406788	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x40674c	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x408014	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40808f	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x406308	196	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x4040b8	43	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x4075a8	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x407a4c	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x40a94c	43	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x4083b0	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x404110	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x40437c	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x408b0a	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x408b35	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x408848	706	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x406558	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x61b5d8	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x407bc0	95	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x408c34	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x403ff0	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x409858	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x409700	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40999c	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x405980	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x4059f4	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x4045c0	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x40413c	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x405a68	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40aac4	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40aacc	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x4083dc	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x4083dc	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x405aa0	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40999c	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x408430	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x408454	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x40845c	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x408464	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x406508	10	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x406514	65	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x40a2b4	761	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x40c0ec	802	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x40c410	94	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x40846c	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x404164	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x408480	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x406584	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x4084a8	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x61b5dc	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x40647c	5	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x406474	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x4064e8	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40a22c	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x4064dd	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x406490	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40b1cb	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40aeeb	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x407990	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x40416c	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x4063e8	25	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x404328	18	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x4041d4	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40c910	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40c514	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x409bf0	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x405c00	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x409cdc	702	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x409a80	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x409f9c	233	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x405c70	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x408380	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x40a978	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x4084b0	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x4084d8	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x406489	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x406481	8	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x404200	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x4044a5	157	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40c470	41	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40a5b0	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x40767c	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x40787f	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40ada4	189	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x404298	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x4087b0	143	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x4065e4	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x4065f0	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x408500	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x4042c0	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x406620	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x40662c	48	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x40665c	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x4077d4	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x40830d	114	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x4066c4	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x40854c	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x407c20	142	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x4045cc	137	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x406694	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x404658	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x4078d9	183	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x40c49c	79	FUNC	<unknown>	HIDDEN	2
__GI_stat64	.symtab	0x40c49c	79	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40c940	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x405d50	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x40a088	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x405ef4	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x405ef4	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x405f20	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x409ae0	135	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40c51c	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x406000	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x4060e4	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x406168	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40ad18	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x40a194	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x409b68	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x406234	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x4063dc	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40a1cc	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x407a60	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x407a60	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x407d8f	560	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x406404	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x4042ec	8	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x40433c	30	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x40435c	30	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x40c4ec	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x4046f0	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40857c	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x4042f4	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x408b64	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x408bb8	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x408ba8	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x4042fc	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x614690	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x614690	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x61b5c8	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x6152b0	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x6152f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40805a	53	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x40c04c	109	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x614f28	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x614f38	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x614f48	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x61b5e0	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x6146b0	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x40b3d4	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40c618	156	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40b4ec	1853	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40ca20	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x6146a0	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40c970	162	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40c554	193	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40c6b4	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x61b5b8	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x4045b8	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x61b5a8	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x404054	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x40999c	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x61466c	0	NOTYPE	<unknown>	HIDDEN	5
__fini_array_start	.symtab	0x61466c	0	NOTYPE	<unknown>	HIDDEN	5
__get_hosts_byname_r	.symtab	0x40c0bc	48	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x40a9a4	288	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x40a9a4	288	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x40846c	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x4062f8	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x408840	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x61466c	0	NOTYPE	<unknown>	HIDDEN	5
__init_array_start	.symtab	0x61466c	0	NOTYPE	<unknown>	HIDDEN	5
__libc_close	.symtab	0x404110	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x406558	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x403ff0	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x40413c	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40c910	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40c514	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x4084d8	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x404200	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x404298	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x4065e4	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x4065f0	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x4042c0	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x406620	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x40662c	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x40830d	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x61b5b0	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x4042f4	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x4042fc	42	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x412120	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x407232	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x4067a8	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x615170	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x61b750	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x40719c	150	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x61be48	8	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x61be50	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40c704	10	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40bc81	968	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x61b5c0	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x61466c	0	NOTYPE	<unknown>	HIDDEN	5
__preinit_array_start	.symtab	0x61466c	0	NOTYPE	<unknown>	HIDDEN	5
__progname	.symtab	0x6152e0	8	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x6152e8	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x407ff7	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x407ff4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x407ff4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x407ff4	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x407ff4	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x40c70e	511	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x61be38	8	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x6152f5	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x61b5f0	40	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x6152f4	1	OBJECT	<unknown>	HIDDEN	9
__restore_rt	.symtab	0x408304	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x61b5d0	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x61be40	8	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x61be54	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x40676c	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x406788	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x40674c	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x614f68	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40abb0	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x408d44	171	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40abec	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x408df0	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x404a43	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4920	.symtab	0x410af0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40ac70	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40acf4	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40ac98	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x408ef4	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x404adc	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x614f70	8	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x408014	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40808f	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x4080c9	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x6152d8	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x406308	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x408658	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x4085ac	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x408704	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x61b390	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x404b04	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x61b6a0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x61b6f0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x615160	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x40a934	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x61be28	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x61be30	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x6152f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x61be58	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x61b5d8	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x4040b8	43	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40ca54	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x619390	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x404b51	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x4090e0	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x61b5dc	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x408f8c	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x405280	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x40551a	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x4052f4	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x405338	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x4054ec	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x408002	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x407ffa	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x61b740	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x4047b0	563	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x4049e4	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x614f78	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x614f80	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x409780	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x619384	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x614fb0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x619380	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x614fe0	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x404a52	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x614fd8	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x407a6c	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x408fe4	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x410bf0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x409014	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x404bc9	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x4075a8	200	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x4040e4	41	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
allowed_bin_names	.symtab	0x614c80	104	OBJECT	<unknown>	DEFAULT	9
allowed_bin_names_size	.symtab	0x614ce8	4	OBJECT	<unknown>	DEFAULT	9
allowed_directory_paths	.symtab	0x614d00	344	OBJECT	<unknown>	DEFAULT	9
allowed_directory_paths_size	.symtab	0x614e58	4	OBJECT	<unknown>	DEFAULT	9
astd	.symtab	0x4022a8	252	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x407a4c	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x401dff	1193	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x4063cc	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x61b5a0	4	OBJECT	<unknown>	DEFAULT	10
bin_names	.symtab	0x6146c0	1040	OBJECT	<unknown>	DEFAULT	9
bin_strings	.symtab	0x614ae0	416	OBJECT	<unknown>	DEFAULT	9
botkiller	.symtab	0x400266	1543	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x40a94c	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x4066c4	133	FUNC	<unknown>	DEFAULT	2
buf.3312	.symtab	0x61b3b0	16	OBJECT	<unknown>	DEFAULT	10
buf.5843	.symtab	0x61b3c0	448	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x405b20	210	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x614e6c	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x4070a4	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
check_exe	.symtab	0x400954	109	FUNC	<unknown>	DEFAULT	2
clock_getres	.symtab	0x4083b0	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x404110	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x40437c	147	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x614e60	8	OBJECT	<unknown>	DEFAULT	9
completed.5156	.symtab	0x615300	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x406558	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x401930	582	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x401c49	116	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x614e68	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x6146b0	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x61b5b8	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x61b5d8	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x407bc0	95	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x411f80	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x408c34	269	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x403ff0	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x404410	149	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x400b24	130	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x404542	115	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x409858	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x409700	128	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40999c	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x405980	116	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x4059f4	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x411f60	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x4045c0	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x40413c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x405a68	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x4073c9	451	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40aac4	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40aac4	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40aacc	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x4083dc	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x4083dc	82	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x405aa0	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x403a39	6	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x401643	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x400ba6	483	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x400af5	47	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x409700	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x40999c	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x408430	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x408454	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x40845c	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x408464	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x406508	10	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x406514	65	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x40a2b4	761	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x40c0ec	802	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x40c410	94	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x40846c	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x404164	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x408480	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x408480	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x406584	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x4065b0	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x4084a8	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x615364	4	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x61b5dc	4	OBJECT	<unknown>	DEFAULT	10
hoste.5842	.symtab	0x61b580	32	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x40647c	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x406474	8	FUNC	<unknown>	DEFAULT	2
i.5312	.symtab	0x614f18	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x405d50	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x4064e8	29	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40a22c	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x4064dd	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x406490	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40b1cb	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40b0d8	243	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40aeeb	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40ae64	135	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x403911	296	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4009c1	126	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x40771e	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x407990	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x40416c	101	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
is_allowed_bin_name	.symtab	0x4001c0	83	FUNC	<unknown>	DEFAULT	2
is_allowed_directory_path	.symtab	0x400213	83	FUNC	<unknown>	DEFAULT	2
isatty	.symtab	0x4063e8	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x404328	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x4041d4	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_bk	.symtab	0x400923	49	FUNC	<unknown>	DEFAULT	2
killer_status	.symtab	0x615378	4	OBJECT	<unknown>	DEFAULT	10
killerid	.symtab	0x61b620	4	OBJECT	<unknown>	DEFAULT	10
last_id.5904	.symtab	0x6152f0	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5903	.symtab	0x61b5e8	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x401b76	211	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40c910	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40c514	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x615370	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x403a3f	1456	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x615360	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x401d66	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x401684	110	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x4023a4	169	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x406816	2187	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x40758c	28	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x409bf0	236	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x405c00	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x409cdc	702	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x409a80	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x409f9c	233	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x405c70	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x408380	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x40a978	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x4084b0	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x6151a0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x6151d0	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x4084d8	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1699	.symtab	0x61b3a0	8	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x407cb0	223	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x406489	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x406481	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x615368	8	OBJECT	<unknown>	DEFAULT	10
object.5168	.symtab	0x615320	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x404200	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x4044a5	157	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x61b690	4	OBJECT	<unknown>	DEFAULT	10
p.5154	.symtab	0x6146a8	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x61b698	8	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x40c470	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x40426c	44	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5143	.symtab	0x410b28	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x4010b2	1084	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400e3f	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x400f71	321	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x400e8a	231	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x402f28	2537	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x6152e8	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x6152e0	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5150	.symtab	0x410b40	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40a5b0	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x407670	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x400a3f	182	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x40767c	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x411750	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x40787f	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x615230	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40ada4	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x404298	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x4087b0	143	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40a5c4	878	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x4065e4	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x4016f2	574	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x4065f0	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5885	.symtab	0x61b618	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x40a194	53	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x408500	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x4042c0	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x406620	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x40662c	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x40665c	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x4076c4	90	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x4077d4	171	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x40830d	114	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x4066c4	133	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x40854c	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x40bc55	44	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x40bc2c	41	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x407c20	142	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x4045cc	137	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x406694	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x4029af	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x4014ee	341	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5149	.symtab	0x410b60	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5142	.symtab	0x410b34	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5146	.symtab	0x410bc0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5145	.symtab	0x410bd8	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5148	.symtab	0x410b70	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5147	.symtab	0x410b80	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x404658	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x40778c	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x40778c	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x4078d9	183	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x40c49c	79	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stat64	.symtab	0x40c49c	79	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x614f60	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x614f50	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x614f58	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40c940	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x405d50	417	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x40a088	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x405ef4	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x405ef4	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x405f20	213	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x409ae0	135	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40c51c	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x406308	196	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x406000	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x4060e4	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x406168	201	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40ad18	140	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x40a194	53	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x409b68	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x406234	193	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x407a60	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x4063dc	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40a1cc	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x407a60	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x407a60	10	FUNC	<unknown>	DEFAULT	2
strtoq	.symtab	0x407a60	10	FUNC	<unknown>	DEFAULT	2
swarmbot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x407d8f	560	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x406404	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x401cbd	169	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x4042ec	8	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x40433c	30	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x40435c	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400d89	182	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x410b90	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x410ba8	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x40c4ec	38	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1721	.symtab	0x410be0	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x615200	40	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x614e80	152	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x407fc0	52	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x40244d	1378	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x4046f0	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x40857c	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x4042f4	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x408b64	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x408bb8	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x408ba8	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x4042fc	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3743	.symtab	0x4120b0	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 09:45:44.697957039 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:45:44.882678986 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:45:44.882819891 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:45:44.882819891 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:45:45.068454027 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:45:54.203943014 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:45:54.204428911 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:45:54.388890982 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:45:54.388997078 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:45:58.069153070 CET	48202	443	192.168.2.13	185.125.190.26
Mar 29, 2024 09:46:29.813009024 CET	48202	443	192.168.2.13	185.125.190.26
Mar 29, 2024 09:46:54.208759069 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:46:54.208970070 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:46:54.394608974 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:46:54.394782066 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:47:54.213823080 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:47:54.213931084 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:47:54.398395061 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:47:54.398461103 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:48:54.218755007 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:48:54.218930960 CET	37710	65490	192.168.2.13	193.35.18.56
Mar 29, 2024 09:48:54.404452085 CET	65490	37710	193.35.18.56	192.168.2.13
Mar 29, 2024 09:48:54.404515982 CET	37710	65490	192.168.2.13	193.35.18.56

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 09:48:31.727647066 CET	50370	53	192.168.2.13	1.1.1.1
Mar 29, 2024 09:48:31.727721930 CET	37730	53	192.168.2.13	1.1.1.1
Mar 29, 2024 09:48:31.824831009 CET	53	50370	1.1.1.1	192.168.2.13
Mar 29, 2024 09:48:31.824851990 CET	53	37730	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 09:48:31.727647066 CET	192.168.2.13	1.1.1.1	0x8d43	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 29, 2024 09:48:31.727721930 CET	192.168.2.13	1.1.1.1	0xb7f3	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 09:48:31.824831009 CET	1.1.1.1	192.168.2.13	0x8d43	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Mar 29, 2024 09:48:31.824831009 CET	1.1.1.1	192.168.2.13	0x8d43	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: 78mfG4QdNn.elf PID: 5432, Parent PID: 5357

General

Start time (UTC):	08:45:43
Start date (UTC):	29/03/2024
Path:	/tmp/78mfG4QdNn.elf
Arguments:	/tmp/78mfG4QdNn.elf
File size:	117706 bytes
MD5 hash:	8cd2686d55d8abf6c5f626c71d94a8ff

Chronological Activities

Analysis Process: 78mfG4QdNn.elf PID: 5433, Parent PID: 5432

General

Start time (UTC):	08:45:43
Start date (UTC):	29/03/2024
Path:	/tmp/78mfG4QdNn.elf
Arguments:	-
File size:	117706 bytes
MD5 hash:	8cd2686d55d8abf6c5f626c71d94a8ff

Chronological Activities

Analysis Process: 78mfG4QdNn.elf PID: 5434, Parent PID: 5433

General

Start time (UTC):	08:45:43
Start date (UTC):	29/03/2024
Path:	/tmp/78mfG4QdNn.elf
Arguments:	-
File size:	117706 bytes
MD5 hash:	8cd2686d55d8abf6c5f626c71d94a8ff

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 78mfG4QdNn.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: 78mfG4QdNn.elf PID: 5432, Parent PID: 5357

General

Chronological Activities

Analysis Process: 78mfG4QdNn.elf PID: 5433, Parent PID: 5432

General

Chronological Activities

Analysis Process: 78mfG4QdNn.elf PID: 5434, Parent PID: 5433

General

Linux Analysis Report
78mfG4QdNn.elf