Edit tour

Linux Analysis Report
0P0xPHw37E.elf

Overview

General Information

Sample name:	0P0xPHw37E.elf renamed because original name is a hash value
Original sample name:	750981f0c5439cb0d07a766ac7073a71.elf
Analysis ID:	1427708
MD5:	750981f0c5439cb0d07a766ac7073a71
SHA1:	a7ba66e7c908d84a3b9b44b91e3af33042832a64
SHA256:	1c949eb8ef7d074f0dd5fcb3806c5ae4c3150c8fef5910dec67a12e04de964b0
Tags:	32elfgafgytrenesas
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427708
Start date and time:	2024-04-18 01:26:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	0P0xPHw37E.elf renamed because original name is a hash value
Original Sample Name:	750981f0c5439cb0d07a766ac7073a71.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 0P0xPHw37E.elf

Runtime Messages

Command:	/tmp/0P0xPHw37E.elf
PID:	5493
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

0P0xPHw37E.elf (PID: 5493, Parent: 5417, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/0P0xPHw37E.elf

0P0xPHw37E.elf New Fork (PID: 5495, Parent: 5493)

0P0xPHw37E.elf New Fork (PID: 5497, Parent: 5493)

0P0xPHw37E.elf New Fork (PID: 5499, Parent: 5497)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
0P0xPHw37E.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
0P0xPHw37E.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
0P0xPHw37E.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1330c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1335c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5497.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5497.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1330c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1335c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5493.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5493.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1330c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1335c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5495.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5495.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1330c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1335c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 0P0xPHw37E.elf PID: 5493	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3b21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3be9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bfd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c75:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 0P0xPHw37E.elf PID: 5495	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9c3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ca3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9cb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ccb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9cdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9cf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9da7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9dbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9dcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 0P0xPHw37E.elf PID: 5497	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9aec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 4 entries

Snort Signatures

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:28:31.083376
SID:	2839489
Source Port:	1486
Destination Port:	32774
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:29:17.366082
SID:	2839489
Source Port:	1486
Destination Port:	32780
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:29:32.829541
SID:	2839489
Source Port:	1486
Destination Port:	32782
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:29:48.244555
SID:	2839489
Source Port:	1486
Destination Port:	32784
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:30:03.659691
SID:	2839489
Source Port:	1486
Destination Port:	32786
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:27:13.871875
SID:	2839489
Source Port:	1486
Destination Port:	60996
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:26:58.412823
SID:	2839489
Source Port:	1486
Destination Port:	60994
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:30:19.126739
SID:	2839489
Source Port:	1486
Destination Port:	32788
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:27:29.334720
SID:	2839489
Source Port:	1486
Destination Port:	60998
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:28:00.248642
SID:	2839489
Source Port:	1486
Destination Port:	32770
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:29:01.948525
SID:	2839489
Source Port:	1486
Destination Port:	32778
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:28:15.664279
SID:	2839489
Source Port:	1486
Destination Port:	32772
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:28:46.494139
SID:	2839489
Source Port:	1486
Destination Port:	32776
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:27:44.796770
SID:	2839489
Source Port:	1486
Destination Port:	32768
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0P0xPHw37E.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: 0P0xPHw37E.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/0P0xPHw37E.elf (PID: 5493)

Opens: /proc/net/route

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:60994
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:60996
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:60998
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32768
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32770
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32772
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32774
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32776
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32778
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32780
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32782
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32784
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32786
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32788

Source: global traffic

TCP traffic: 192.168.2.14:60994 -> 185.150.26.226:1486

Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 0P0xPHw37E.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5497.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5493.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5495.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 0P0xPHw37E.elf PID: 5493, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 0P0xPHw37E.elf PID: 5495, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 0P0xPHw37E.elf PID: 5497, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: 0P0xPHw37E.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5497.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5493.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5495.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 0P0xPHw37E.elf PID: 5493, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 0P0xPHw37E.elf PID: 5495, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 0P0xPHw37E.elf PID: 5497, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/0@2/0

Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/string/sh/memchr.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/string/sh/sh4/memcpy.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/string/sh/sh4/memset.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/string/sh/sh4/strcpy.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/string/sh/sh4/strncpy.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/string/sh/strlen.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sh/crt1.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sh/crti.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sh/crtn.S
Source: 0P0xPHw37E.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sh/vfork.S

Source: /tmp/0P0xPHw37E.elf (PID: 5493)

Queries kernel information via 'uname':

Jump to behavior

Source: 0P0xPHw37E.elf, 5493.1.00007ffd8ac41000.00007ffd8ac62000.rw-.sdmp, 0P0xPHw37E.elf, 5495.1.00007ffd8ac41000.00007ffd8ac62000.rw-.sdmp, 0P0xPHw37E.elf, 5497.1.00007ffd8ac41000.00007ffd8ac62000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: 0P0xPHw37E.elf, 5493.1.00005571eb54c000.00005571eb5d0000.rw-.sdmp, 0P0xPHw37E.elf, 5495.1.00005571eb54c000.00005571eb5d0000.rw-.sdmp, 0P0xPHw37E.elf, 5497.1.00005571eb54c000.00005571eb5d0000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: 0P0xPHw37E.elf, 5493.1.00005571eb54c000.00005571eb5d0000.rw-.sdmp, 0P0xPHw37E.elf, 5495.1.00005571eb54c000.00005571eb5d0000.rw-.sdmp, 0P0xPHw37E.elf, 5497.1.00005571eb54c000.00005571eb5d0000.rw-.sdmp	Binary or memory string: qU5!/etc/qemu-binfmt/sh4
Source: 0P0xPHw37E.elf, 5493.1.00007ffd8ac41000.00007ffd8ac62000.rw-.sdmp, 0P0xPHw37E.elf, 5495.1.00007ffd8ac41000.00007ffd8ac62000.rw-.sdmp, 0P0xPHw37E.elf, 5497.1.00007ffd8ac41000.00007ffd8ac62000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/0P0xPHw37E.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/0P0xPHw37E.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: 0P0xPHw37E.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: 0P0xPHw37E.elf, type: SAMPLE
Source: Yara match	File source: 5497.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5493.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: 0P0xPHw37E.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: 0P0xPHw37E.elf, type: SAMPLE
Source: Yara match	File source: 5497.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5493.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007f6ec4400000.00007f6ec4417000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0P0xPHw37E.elf	66%	ReversingLabs	Linux.Trojan.Gafgyt
0P0xPHw37E.elf	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.150.26.226	unknown	Netherlands		44592	SKYLINKNL	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.150.26.226	8xnQBClhg7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
185.150.26.226	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	8xnQBClhg7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	ClPVG70TmC.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	5VaGSbWdTq.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	n3l6rOHrCy.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Ag0lD8sQ2M.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	64ZOedXgZ1.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ZNmO15OLbB.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	p83YQKCH5M.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	YHbakNEfOJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	8hQCf2Y8Ra.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYLINKNL	8xnQBClhg7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.150.26.226
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.150.26.226
	wXKNYp2Oz7.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	u03NaKUcTE.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	OxijfIfpE4.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	iohvlkX3du.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	3c5LsY4PK6.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	hEy4ti72CC.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	NNS8GpmHiy.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	MBK672tbE2.elf	Get hash	malicious	Unknown	Browse	185.150.26.199

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.6419487924987255
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	0P0xPHw37E.elf
File size:	122'392 bytes
MD5:	750981f0c5439cb0d07a766ac7073a71
SHA1:	a7ba66e7c908d84a3b9b44b91e3af33042832a64
SHA256:	1c949eb8ef7d074f0dd5fcb3806c5ae4c3150c8fef5910dec67a12e04de964b0
SHA512:	ffa21f2b217a8333e2f63202e21712d6d5566baec36338670f6145436798bf7beddceff83b040b9c5860db2d15ddb82263229181c0e0a2d1f279496dfba6fa17
SSDEEP:	3072:X0Y1SpZ1XznZ4NrxXGIa5hBvmrLzZYerNu:X0gSpolahJmrLzZYerNu
TLSH:	66C3087394649EB2C041A9F125FA8D710F236D930B6B0A94623D77F04A7F5CEB48AF64
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@..f...f...............p...pB..pB.8....j..........Q.td............................././"O.n........#.@........#.*@l ...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	98320
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x4000e0	0xe0	0x12080	0x0	0x6	AX	0	0	32
.fini	PROGBITS	0x412160	0x12160	0x24	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x412184	0x12184	0x4488	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x427000	0x17000	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x427004	0x17004	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x42700c	0x1700c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x427014	0x17014	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x427018	0x17018	0x320	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x427338	0x17338	0x6760	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x17338	0xc72	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x17faa	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x18268	0x3460	0x10	0x0		14	310	4
.strtab	STRTAB	0x0	0x1b6c8	0x2750	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1660c	0x1660c	6.9260	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x17000	0x427000	0x427000	0x338	0x6a98	3.9947	0x6	RW	0x10000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x400094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x4000e0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x412160	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x412184	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x427000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x427004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x42700c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x427014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x427018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x427338	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
.jmp_loc	.symtab	0x409a2a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40b0aa	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40b14a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40b22a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40b28a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40b6aa	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40f8ca	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3399	.symtab	0x416214	24	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x427354	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x4270c8	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x42d5b0	4	OBJECT	<unknown>	DEFAULT	10
L_abort	.symtab	0x4001d0	0	NOTYPE	<unknown>	DEFAULT	2
L_fini	.symtab	0x4001c8	0	NOTYPE	<unknown>	DEFAULT	2
L_init	.symtab	0x4001c4	0	NOTYPE	<unknown>	DEFAULT	2
L_main	.symtab	0x4001c0	0	NOTYPE	<unknown>	DEFAULT	2
L_uClibc_main	.symtab	0x4001cc	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x427370	16384	OBJECT	<unknown>	DEFAULT	10
UserAgents	.symtab	0x427038	144	OBJECT	<unknown>	DEFAULT	9
_Exit	.symtab	0x409f08	52	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x427008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x427004	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x4270dc	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x414f6c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x427330	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x41630c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x4270e4	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x41526c	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x427010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x42700c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x427000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x427000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x4270dc	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x427330	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x4270e4	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x4270e0	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x427334	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x4270e8	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x409fd0	20	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x409d98	168	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40f74c	216	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x40b944	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x40e3f8	20	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x409cf0	168	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x40bf28	40	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x40bf50	42	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x40befc	44	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x40dbac	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40dc60	72	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x40b994	208	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x409f08	52	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x40cda8	184	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x40d2f4	24	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x40dfe8	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x409f74	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x40e124	152	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x40e6a4	72	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x40e6ec	60	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x40e40c	664	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x40bc38	52	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x409a50	52	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x42d584	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x40da34	228	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x40df84	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x40d464	112	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x40e800	272	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x409cf0	168	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40f610	316	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x40f428	136	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40f74c	216	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x40f4b0	120	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x40f824	132	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x40e910	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x409ba0	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x40afa8	68	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x4104ac	28	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x4104c8	232	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x410188	84	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x40afec	152	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40f74c	216	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x409c88	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x40e050	18	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x409b8c	18	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x40e062	18	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x40bbd0	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x40bbe4	84	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x40fe60	596	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x4118b8	578	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x411b30	112	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x40dfb8	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x409b34	16	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x40e01c	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x40bc6c	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x40dfd4	18	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x42d588	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x40bb2c	48	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x40bb14	24	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x40bba4	44	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40fd98	200	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x410ae0	500	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x410828	404	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x40d238	188	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x409e74	148	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x40ba7c	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x409cbc	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x411bf4	96	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40f900	24	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x40b340	860	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x40f920	188	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40fc88	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40fb40	200	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x40b180	150	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x40dec0	56	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x40e0dc	56	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40e074	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x40e0a8	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x40bb74	48	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x40bb5c	24	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x409a94	160	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x40e24c	144	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x409998	64	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x411afc	52	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x4100b4	40	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x40ce74	100	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x40d100	108	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40fa9c	164	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x409c54	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x40e360	152	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x40bcd8	52	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x40bd0c	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40def8	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x409c1c	56	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x40bd44	52	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x40bd78	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x40bdb0	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x40d01c	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x4100dc	20	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x40be1c	60	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x40be58	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x40be6c	144	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x409f3c	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x40d4d4	156	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x40bde8	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x40a01c	132	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x40d16c	204	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x411ba0	84	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x412024	64	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x40b880	196	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x40fcac	192	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x40b7d6	34	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x40b7d6	34	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x40b260	16	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x40fa54	72	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x411c54	76	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x40b0e0	88	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x40b6e0	40	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x40b7f8	136	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40fd6c	44	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x40fc38	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40fc08	48	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x40b720	182	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x40b97c	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40f9dc	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40d30c	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x40d678	956	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x40baa0	116	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x409b44	16	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x40e114	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x409fa8	40	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x411ff0	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x4099e0	54	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x40a0a0	164	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40df50	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x409bd4	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40e728	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40e78c	116	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40e76c	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x409e40	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x427014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x427014	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x42d57c	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x427308	24	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x427338	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40dc18	72	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x411808	124	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x4270e0	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x427334	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x4270e8	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x42d58c	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x427018	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x410cd4	220	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x411d68	148	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x410db0	1624	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x412120	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x4000e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x427018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x412064	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x411ca0	200	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x411dfc	104	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x42d574	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x409fd0	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x42d56c	4	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x409d98	168	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x40f74c	216	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x427004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x427004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x411884	52	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x4103b4	248	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x40dfb8	28	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x40b944	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x40e3f8	20	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x427004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x427004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_brk	.symtab	0x410144	68	FUNC	<unknown>	HIDDEN	2
__init_brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__libc_close	.symtab	0x409f74	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x40bc38	52	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x409cf0	168	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x409ba0	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x411bf4	96	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x40e0a8	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x409a94	160	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x409c54	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x40bcd8	52	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x40bd0c	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x409c1c	56	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x40bd44	52	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x40bd78	56	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x4100dc	20	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x42d570	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x409bd4	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x409e40	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x4162ec	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x40caac	328	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x40bf7c	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x42722c	24	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x42d704	888	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x40ca10	156	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x42da8c	4	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x42da90	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x411e64	24	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x411488	896	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x42d578	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x427004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x427004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x427324	4	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x427328	4	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40db72	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x40db64	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x40db64	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x40db64	14	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x40db64	14	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x411e7c	372	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x42da84	4	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x42732f	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x42d594	24	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x42732e	1	OBJECT	<unknown>	HIDDEN	9
__rtld_fini	.symtab	0x42d580	4	OBJECT	<unknown>	HIDDEN	10
__sdivsi3_i4i	.symtab	0x409644	852	FUNC	<unknown>	HIDDEN	2
__searchdomain	.symtab	0x42da88	4	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x42da94	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x40bf28	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x40bf50	42	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x40befc	44	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x4270f8	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x4105b0	80	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40e928	152	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x410600	180	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40ebf0	264	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x40a1a4	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4419	.symtab	0x41556c	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x4106b4	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x41075c	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x4106e4	120	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40ecf8	176	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x40a258	52	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x4270fc	4	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x409a20	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x40b0a0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x40b140	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x40b220	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x40b280	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x40b6a0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x40f8c0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x410380	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x40dbac	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40dc60	72	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x40dca8	536	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x427320	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3_i4i	.symtab	0x409574	208	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x4099e0	54	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x40b994	208	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x410268	128	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x4101dc	140	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x4102e8	152	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_brk	.symtab	0x410110	52	FUNC	<unknown>	HIDDEN	2
_bss_custom_printf_spec	.symtab	0x42d38c	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x40a28c	88	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x42d6ac	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x42d6d4	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x427228	4	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x4100f0	32	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x42da7c	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x42da80	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x427338	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x42da98	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x42d584	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x409f08	52	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x412160	0	FUNC	<unknown>	HIDDEN	3
_fixed_buffers	.symtab	0x42b38c	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x40a2e4	124	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40ef40	1256	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x42d588	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x400094	0	FUNC	<unknown>	HIDDEN	1
_load_inttype	.symtab	0x40eda8	94	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x40a8e0	124	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x40aba8	1024	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x40a95c	72	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x40a9a4	456	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x40ab6c	60	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x40db90	28	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40db80	16	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x42d6fc	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x4001a0	30	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40e9c0	560	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x40a144	96	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x427100	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x427104	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40f528	232	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x42b388	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x42711c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x42b384	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x427138	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x40a1c0	152	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x427134	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40d320	324	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40ee06	56	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x41563c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40ee40	256	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x40a360	1408	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x40cda8	184	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x409be8	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x404128	228	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x408610	160	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x40d2f4	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x40d2f4	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
axis_bp	.symtab	0x427034	4	OBJECT	<unknown>	DEFAULT	9
bcopy	.symtab	0x40b964	24	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x42d568	4	OBJECT	<unknown>	DEFAULT	10
bsd_signal	.symtab	0x40be6c	144	FUNC	<unknown>	DEFAULT	2
buf.5269	.symtab	0x42d39c	440	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x40ba64	24	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x4270d0	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x40c68c	216	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x4001d4	160	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x400274	444	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x400430	444	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x409fe4	56	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x40dfe8	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x409f74	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x40e124	152	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4568	.symtab	0x427338	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x40bc38	52	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x402088	776	FUNC	<unknown>	DEFAULT	2
crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x402524	232	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x427020	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x409a50	52	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x42d574	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x42d584	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x40da34	228	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x40df84	52	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x40d464	112	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x416240	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x40e800	272	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x409cf0	168	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x40e1bc	144	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x401930	200	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x42b370	4	OBJECT	<unknown>	DEFAULT	10
fdopendir	.symtab	0x40e2dc	132	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0x4017f0	320	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x4015b8	568	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x40f610	316	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x40f428	136	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40f74c	216	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40f4b0	120	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40f824	132	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x4024c8	92	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x41622c	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x40e910	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x409ba0	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x40afa8	68	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400140	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x40cbf4	384	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x4104ac	28	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x4104ac	28	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x4104c8	232	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x410188	84	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x40afec	152	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x406e4c	12	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x401bd4	84	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x406baa	674	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x40f428	136	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x40f74c	216	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x409c88	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x40e050	18	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x409b8c	18	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40e062	18	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x40bbd0	20	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x40bbe4	84	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x40fe60	596	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x4118b8	578	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x411b30	112	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x40dfb8	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x409b34	16	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x409a84	16	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x40e01c	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x40bc6c	52	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x40bca0	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40dfd4	18	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x42d588	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x427024	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x427028	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x42702c	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x427030	4	OBJECT	<unknown>	DEFAULT	9
hextable	.symtab	0x412e78	1024	OBJECT	<unknown>	DEFAULT	4
hoste.5268	.symtab	0x42d554	20	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x40bb2c	48	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x40bb14	24	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0x40432c	1264	FUNC	<unknown>	DEFAULT	2
i.4772	.symtab	0x4270d4	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x40b880	196	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x40bba4	44	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40fd98	200	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x410ae0	500	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x4109bc	292	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x410828	404	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x410790	152	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x406a0c	414	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x40071c	180	FUNC	<unknown>	DEFAULT	2
initstate	.symtab	0x40cf44	120	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x40d238	188	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x409e74	148	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x40ba7c	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x409cbc	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x427364	4	OBJECT	<unknown>	DEFAULT	10
last_id.5326	.symtab	0x42732c	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5325	.symtab	0x42d590	4	OBJECT	<unknown>	DEFAULT	10
libc/string/sh/memchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sh/sh4/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sh/sh4/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sh/sh4/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sh/sh4/strncpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sh/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x402390	312	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x411bf4	96	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x427368	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x406e58	2080	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x40271c	224	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x401c84	156	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x403a12	246	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x40bfec	1696	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x40cd74	52	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40f900	24	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x40b340	860	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x40f920	188	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40fc88	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x40fb40	200	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x40b180	150	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x40dec0	56	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x40e0dc	56	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x40e074	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x427244	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x42725c	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x40e0a8	52	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1251	.symtab	0x42d398	4	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x42d5b8	4	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x40d570	264	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x40bb74	48	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x40bb5c	24	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x42735c	8	OBJECT	<unknown>	DEFAULT	10
object.4580	.symtab	0x42733c	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x409a94	160	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x40e24c	144	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x42d5b4	4	OBJECT	<unknown>	DEFAULT	10
p.4566	.symtab	0x42701c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x4019f8	124	FUNC	<unknown>	DEFAULT	2
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x42d5c0	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x409998	64	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x411afc	52	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x409b54	56	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4639	.symtab	0x415594	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x400eb4	1068	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400b64	104	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x400d24	400	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x400bcc	344	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x40481c	8688	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x427328	4	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x427324	4	OBJECT	<unknown>	DEFAULT	9
qual_chars.4648	.symtab	0x4155a8	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x4100b4	40	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x40ce60	20	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x407788	224	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x407868	176	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x400a28	316	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x400918	272	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x407678	116	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x4076ec	156	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x40ce74	100	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x416198	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x40d100	108	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x427288	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40fa9c	164	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x409c54	52	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x40e360	152	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40c764	684	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x40bcd8	52	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401d20	872	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x40bd0c	56	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5311	.symtab	0x42d5ac	4	OBJECT	<unknown>	DEFAULT	10
resolv_domain_to_hostname	.symtab	0x407918	280	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x408318	84	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x407b1c	2044	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x407a30	236	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x40fc38	80	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x403374	1108	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x40def8	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x42d5bc	4	OBJECT	<unknown>	DEFAULT	10
select	.symtab	0x409c1c	56	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x40bd44	52	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x4037c8	586	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x40bd78	56	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x40bdb0	56	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x40ced8	108	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x40d01c	228	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x4100dc	20	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x40be1c	60	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x40be58	20	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x40be6c	144	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x409f3c	56	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x411448	64	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x411408	64	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x40d4d4	156	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x40bde8	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x40420c	288	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x401450	360	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4647	.symtab	0x4155bc	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4638	.symtab	0x4155a0	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4644	.symtab	0x41560c	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4643	.symtab	0x415624	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4646	.symtab	0x4155cc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4645	.symtab	0x4155dc	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x40a01c	132	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x40cfbc	96	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x40cfbc	96	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x40d16c	204	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x411ba0	84	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stderr	.symtab	0x4270f4	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x4270ec	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x4270f0	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x412024	64	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x40b880	196	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x40fcac	192	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x40b7d6	34	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x40b7d6	34	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x40b260	16	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x40fa54	72	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x411c54	76	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x40b994	208	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x40b0e0	88	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x40b6e0	40	FUNC	<unknown>	DEFAULT	2
strnlen	.symtab	0x40b7f8	136	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40fd6c	44	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x40fc38	80	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x40fc08	48	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x40b720	182	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x40b97c	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40f9dc	120	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40d30c	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x40d678	956	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x401394	188	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x42d5c4	232	OBJECT	<unknown>	DEFAULT	10
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x40836c	436	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x4270d8	4	OBJECT	<unknown>	DEFAULT	9
table_lock_val	.symtab	0x408568	72	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x4085b0	96	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x408520	72	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x40baa0	116	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x402dc4	1456	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x40260c	272	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x409b44	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x40e114	16	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x4086b0	360	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x409fa8	40	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x4007d0	328	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x4155e6	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x415600	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x4027fc	1480	FUNC	<unknown>	DEFAULT	2
uname	.symtab	0x411ff0	52	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1273	.symtab	0x41562c	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x427274	20	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x401c28	92	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x4270cc	4	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x40db18	76	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x408bc8	684	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x409370	220	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x40948c	88	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x409534	64	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x4094e4	80	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x40944c	64	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x408e74	452	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x409288	232	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x408aea	130	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x409038	222	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x408a78	114	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x40894c	196	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x408a10	104	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x409116	370	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x408818	90	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x408872	218	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x408b6c	92	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x4099e0	54	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x403b08	1568	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x40a0a0	164	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x42b380	4	OBJECT	<unknown>	DEFAULT	10
wait4	.symtab	0x40df50	52	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x409bd4	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x4005ec	304	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x427358	4	OBJECT	<unknown>	DEFAULT	10
wcrtomb	.symtab	0x40e728	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40e78c	116	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40e76c	32	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x401a74	352	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x409e40	52	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x42b374	4	OBJECT	<unknown>	DEFAULT	10
xdigits.3297	.symtab	0x41628c	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x42b378	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x42b37c	4	OBJECT	<unknown>	DEFAULT	10
zprintf	.symtab	0x4012e0	180	FUNC	<unknown>	DEFAULT	2

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/18/24-01:28:31.083376	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32774	185.150.26.226	192.168.2.14
04/18/24-01:29:17.366082	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32780	185.150.26.226	192.168.2.14
04/18/24-01:29:32.829541	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32782	185.150.26.226	192.168.2.14
04/18/24-01:29:48.244555	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32784	185.150.26.226	192.168.2.14
04/18/24-01:30:03.659691	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32786	185.150.26.226	192.168.2.14
04/18/24-01:27:13.871875	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	60996	185.150.26.226	192.168.2.14
04/18/24-01:26:58.412823	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	60994	185.150.26.226	192.168.2.14
04/18/24-01:30:19.126739	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32788	185.150.26.226	192.168.2.14
04/18/24-01:27:29.334720	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	60998	185.150.26.226	192.168.2.14
04/18/24-01:28:00.248642	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32770	185.150.26.226	192.168.2.14
04/18/24-01:29:01.948525	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32778	185.150.26.226	192.168.2.14
04/18/24-01:28:15.664279	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32772	185.150.26.226	192.168.2.14
04/18/24-01:28:46.494139	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32776	185.150.26.226	192.168.2.14
04/18/24-01:27:44.796770	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32768	185.150.26.226	192.168.2.14

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 01:26:57.950057983 CEST	60994	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:26:58.181356907 CEST	1486	60994	185.150.26.226	192.168.2.14
Apr 18, 2024 01:26:58.181451082 CEST	60994	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:26:58.181981087 CEST	60994	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:26:58.412822962 CEST	1486	60994	185.150.26.226	192.168.2.14
Apr 18, 2024 01:26:58.412888050 CEST	1486	60994	185.150.26.226	192.168.2.14
Apr 18, 2024 01:26:58.412985086 CEST	1486	60994	185.150.26.226	192.168.2.14
Apr 18, 2024 01:26:58.413343906 CEST	60994	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:26:58.414216042 CEST	60994	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:26:58.644546986 CEST	1486	60994	185.150.26.226	192.168.2.14
Apr 18, 2024 01:26:58.645201921 CEST	1486	60994	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:13.415786982 CEST	60996	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:13.643323898 CEST	1486	60996	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:13.644094944 CEST	60996	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:13.644717932 CEST	60996	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:13.871875048 CEST	1486	60996	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:13.871946096 CEST	1486	60996	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:13.871964931 CEST	1486	60996	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:13.872612000 CEST	60996	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:13.872612000 CEST	60996	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:14.100225925 CEST	1486	60996	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:14.100289106 CEST	1486	60996	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:28.873358965 CEST	60998	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:29.103923082 CEST	1486	60998	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:29.104455948 CEST	60998	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:29.104763031 CEST	60998	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:29.334638119 CEST	1486	60998	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:29.334719896 CEST	1486	60998	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:29.334765911 CEST	1486	60998	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:29.334989071 CEST	60998	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:29.565216064 CEST	1486	60998	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:44.336421013 CEST	32768	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:44.566303015 CEST	1486	32768	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:44.566915035 CEST	32768	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:44.566915035 CEST	32768	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:44.796711922 CEST	1486	32768	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:44.796770096 CEST	1486	32768	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:44.796813011 CEST	1486	32768	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:44.796992064 CEST	32768	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:27:45.026391983 CEST	1486	32768	185.150.26.226	192.168.2.14
Apr 18, 2024 01:27:59.797494888 CEST	32770	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:00.022800922 CEST	1486	32770	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:00.023260117 CEST	32770	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:00.023260117 CEST	32770	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:00.248595953 CEST	1486	32770	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:00.248641968 CEST	1486	32770	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:00.248681068 CEST	1486	32770	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:00.249010086 CEST	32770	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:00.474092960 CEST	1486	32770	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:15.249505997 CEST	32772	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:15.456696033 CEST	1486	32772	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:15.457148075 CEST	32772	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:15.457148075 CEST	32772	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:15.664253950 CEST	1486	32772	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:15.664278984 CEST	1486	32772	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:15.664297104 CEST	1486	32772	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:15.664573908 CEST	32772	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:15.871797085 CEST	1486	32772	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:30.664812088 CEST	32774	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:30.874224901 CEST	1486	32774	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:30.874392033 CEST	32774	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:30.874500990 CEST	32774	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:31.083375931 CEST	1486	32774	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:31.083398104 CEST	1486	32774	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:31.083414078 CEST	1486	32774	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:31.083515882 CEST	32774	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:31.293081999 CEST	1486	32774	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:46.083878040 CEST	32776	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:46.288794994 CEST	1486	32776	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:46.289182901 CEST	32776	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:46.289182901 CEST	32776	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:46.494060993 CEST	1486	32776	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:46.494138956 CEST	1486	32776	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:46.494158030 CEST	1486	32776	185.150.26.226	192.168.2.14
Apr 18, 2024 01:28:46.494333029 CEST	32776	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:28:46.699187040 CEST	1486	32776	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:01.494642973 CEST	32778	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:01.721477032 CEST	1486	32778	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:01.721754074 CEST	32778	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:01.721806049 CEST	32778	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:01.948463917 CEST	1486	32778	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:01.948524952 CEST	1486	32778	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:01.948538065 CEST	1486	32778	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:01.948606014 CEST	32778	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:02.175307989 CEST	1486	32778	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:16.949254990 CEST	32780	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:17.158030987 CEST	1486	32780	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:17.158236980 CEST	32780	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:17.158458948 CEST	32780	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:17.366081953 CEST	1486	32780	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:17.366102934 CEST	1486	32780	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:17.366190910 CEST	1486	32780	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:17.366230965 CEST	32780	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:17.366503000 CEST	32780	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:17.574094057 CEST	1486	32780	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:17.574302912 CEST	1486	32780	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:32.366774082 CEST	32782	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:32.597984076 CEST	1486	32782	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:32.598346949 CEST	32782	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:32.598346949 CEST	32782	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:32.829497099 CEST	1486	32782	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:32.829540968 CEST	1486	32782	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:32.829556942 CEST	1486	32782	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:32.829736948 CEST	32782	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:33.060859919 CEST	1486	32782	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:47.830005884 CEST	32784	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:48.037081957 CEST	1486	32784	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:48.037331104 CEST	32784	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:48.037523031 CEST	32784	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:48.244502068 CEST	1486	32784	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:48.244554996 CEST	1486	32784	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:48.244594097 CEST	1486	32784	185.150.26.226	192.168.2.14
Apr 18, 2024 01:29:48.244671106 CEST	32784	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:29:48.451833010 CEST	1486	32784	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:03.245388985 CEST	32786	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:03.452322006 CEST	1486	32786	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:03.452677011 CEST	32786	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:03.452799082 CEST	32786	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:03.659655094 CEST	1486	32786	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:03.659691095 CEST	1486	32786	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:03.659713030 CEST	1486	32786	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:03.660005093 CEST	32786	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:03.867106915 CEST	1486	32786	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:18.660545111 CEST	32788	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:18.893037081 CEST	1486	32788	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:18.893333912 CEST	32788	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:18.893333912 CEST	32788	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:19.126679897 CEST	1486	32788	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:19.126739025 CEST	1486	32788	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:19.126780987 CEST	1486	32788	185.150.26.226	192.168.2.14
Apr 18, 2024 01:30:19.127032042 CEST	32788	1486	192.168.2.14	185.150.26.226
Apr 18, 2024 01:30:19.359400034 CEST	1486	32788	185.150.26.226	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 01:29:40.783232927 CEST	52428	53	192.168.2.14	1.1.1.1
Apr 18, 2024 01:29:40.783232927 CEST	36249	53	192.168.2.14	1.1.1.1
Apr 18, 2024 01:29:40.888124943 CEST	53	36249	1.1.1.1	192.168.2.14
Apr 18, 2024 01:29:40.981172085 CEST	53	52428	1.1.1.1	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 01:29:40.783232927 CEST	192.168.2.14	1.1.1.1	0xa3d8	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 01:29:40.783232927 CEST	192.168.2.14	1.1.1.1	0x5ec7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 01:29:40.981172085 CEST	1.1.1.1	192.168.2.14	0xa3d8	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 01:29:40.981172085 CEST	1.1.1.1	192.168.2.14	0xa3d8	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: 0P0xPHw37E.elf PID: 5493, Parent PID: 5417

General

Start time (UTC):	23:26:56
Start date (UTC):	17/04/2024
Path:	/tmp/0P0xPHw37E.elf
Arguments:	/tmp/0P0xPHw37E.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: 0P0xPHw37E.elf PID: 5495, Parent PID: 5493

General

Start time (UTC):	23:26:56
Start date (UTC):	17/04/2024
Path:	/tmp/0P0xPHw37E.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: 0P0xPHw37E.elf PID: 5497, Parent PID: 5493

General

Start time (UTC):	23:26:56
Start date (UTC):	17/04/2024
Path:	/tmp/0P0xPHw37E.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: 0P0xPHw37E.elf PID: 5499, Parent PID: 5497

General

Start time (UTC):	23:26:56
Start date (UTC):	17/04/2024
Path:	/tmp/0P0xPHw37E.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 0P0xPHw37E.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: 0P0xPHw37E.elf PID: 5493, Parent PID: 5417

General

Chronological Activities

Analysis Process: 0P0xPHw37E.elf PID: 5495, Parent PID: 5493

General

Chronological Activities

Analysis Process: 0P0xPHw37E.elf PID: 5497, Parent PID: 5493

General

Chronological Activities

Analysis Process: 0P0xPHw37E.elf PID: 5499, Parent PID: 5497

General

Linux Analysis Report
0P0xPHw37E.elf