Edit tour

Linux Analysis Report
Okjv4RjEoF.elf

Overview

General Information

Sample name:	Okjv4RjEoF.elf renamed because original name is a hash value
Original sample name:	88709fe05e8900f4f1b48ccf0ae3c7f1.elf
Analysis ID:	1427715
MD5:	88709fe05e8900f4f1b48ccf0ae3c7f1
SHA1:	fe6661c30748e6b66d83d1e85a1bdd3e09be4423
SHA256:	68f0d4011f606ff57f7fc04e03aee497c29ff2d2640a3cee6e65df8f830e0d0a
Tags:	32elfgafgytsparc
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427715
Start date and time:	2024-04-18 01:32:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Okjv4RjEoF.elf renamed because original name is a hash value
Original Sample Name:	88709fe05e8900f4f1b48ccf0ae3c7f1.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/1@2/0

Warnings

VT rate limit hit for: Okjv4RjEoF.elf

Runtime Messages

Command:	/tmp/Okjv4RjEoF.elf
PID:	5533
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

Okjv4RjEoF.elf (PID: 5533, Parent: 5453, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/Okjv4RjEoF.elf

Okjv4RjEoF.elf New Fork (PID: 5535, Parent: 5533)

Okjv4RjEoF.elf New Fork (PID: 5536, Parent: 5533)

Okjv4RjEoF.elf New Fork (PID: 5539, Parent: 5536)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Okjv4RjEoF.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
Okjv4RjEoF.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Okjv4RjEoF.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x184a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1852c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1861c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5535.1.00007fc028011000.00007fc02802d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5535.1.00007fc028011000.00007fc02802d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x184a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1852c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1861c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5536.1.00007fc028011000.00007fc02802d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5536.1.00007fc028011000.00007fc02802d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x184a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1852c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1861c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5533.1.00007fc028011000.00007fc02802d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5533.1.00007fc028011000.00007fc02802d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x184a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1852c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1861c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Okjv4RjEoF.elf PID: 5533	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xbcca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbda6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbde2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdf6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Okjv4RjEoF.elf PID: 5535	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1995:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Okjv4RjEoF.elf PID: 5536	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa81c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa86c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa90c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa95c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa9ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 4 entries

Snort Signatures

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:33:47.014208
SID:	2839489
Source Port:	1486
Destination Port:	41112
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:34:48.763089
SID:	2839489
Source Port:	1486
Destination Port:	41120
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:33:31.597692
SID:	2839489
Source Port:	1486
Destination Port:	41110
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:35:04.178054
SID:	2839489
Source Port:	1486
Destination Port:	41122
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:34:02.429258
SID:	2839489
Source Port:	1486
Destination Port:	41114
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:35:19.642641
SID:	2839489
Source Port:	1486
Destination Port:	41124
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:36:05.894019
SID:	2839489
Source Port:	1486
Destination Port:	41130
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:36:21.306914
SID:	2839489
Source Port:	1486
Destination Port:	41132
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:33:10.661260
SID:	2839489
Source Port:	1486
Destination Port:	60996
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:35:50.478244
SID:	2839489
Source Port:	1486
Destination Port:	41128
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:32:55.204030
SID:	2839489
Source Port:	1486
Destination Port:	60994
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:35:35.060088
SID:	2839489
Source Port:	1486
Destination Port:	41126
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:33:26.121128
SID:	2839489
Source Port:	1486
Destination Port:	60998
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:34:33.302369
SID:	2839489
Source Port:	1486
Destination Port:	41118
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:33:58.052753
SID:	2839489
Source Port:	1486
Destination Port:	32770
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:34:17.838935
SID:	2839489
Source Port:	1486
Destination Port:	41116
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.14

Timestamp:	04/18/24-01:33:41.581090
SID:	2839489
Source Port:	1486
Destination Port:	32768
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 185.150.26.226 - Destination IP: 192.168.2.15

Timestamp:	04/18/24-01:33:16.136970
SID:	2839489
Source Port:	1486
Destination Port:	41108
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Okjv4RjEoF.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Okjv4RjEoF.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/Okjv4RjEoF.elf (PID: 5533)

Opens: /proc/net/route

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:60994
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:60996
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:60998
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32768
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.14:32770
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41108
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41110
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41112
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41114
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41116
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41118
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41120
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41122
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41124
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41126
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41128
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41130
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 185.150.26.226:1486 -> 192.168.2.15:41132

Source: global traffic

TCP traffic: 192.168.2.15:41106 -> 185.150.26.226:1486

Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.150.26.226

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: Okjv4RjEoF.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5535.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5536.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5533.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Okjv4RjEoF.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Okjv4RjEoF.elf PID: 5535, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Okjv4RjEoF.elf PID: 5536, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: Okjv4RjEoF.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5535.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5536.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5533.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Okjv4RjEoF.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Okjv4RjEoF.elf PID: 5535, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Okjv4RjEoF.elf PID: 5536, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/1@2/0

Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/string/sparc/memchr.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/string/sparc/memcpy.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/string/sparc/memset.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/string/sparc/strchr.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/string/sparc/strcmp.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/string/sparc/strcpy.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/string/sparc/strlen.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crt1.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crti.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crtn.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/fork.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/pipe.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/rem.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/udiv.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/umul.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/urem.S
Source: Okjv4RjEoF.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/vfork.S

Source: /tmp/Okjv4RjEoF.elf (PID: 5533)

Queries kernel information via 'uname':

Jump to behavior

Source: Okjv4RjEoF.elf, 5533.1.0000557a3ca15000.0000557a3ca9d000.rw-.sdmp, Okjv4RjEoF.elf, 5535.1.0000557a3ca15000.0000557a3ca9d000.rw-.sdmp, Okjv4RjEoF.elf, 5536.1.0000557a3ca15000.0000557a3ca9d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: Okjv4RjEoF.elf, 5533.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp	Binary or memory string: \G%:zU/tmp/qemu-open.oI5NVB\
Source: Okjv4RjEoF.elf, 5533.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp, Okjv4RjEoF.elf, 5535.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp, Okjv4RjEoF.elf, 5536.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/Okjv4RjEoF.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Okjv4RjEoF.elf
Source: Okjv4RjEoF.elf, 5533.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.oI5NVB
Source: Okjv4RjEoF.elf, 5533.1.0000557a3ca15000.0000557a3ca9d000.rw-.sdmp, Okjv4RjEoF.elf, 5535.1.0000557a3ca15000.0000557a3ca9d000.rw-.sdmp, Okjv4RjEoF.elf, 5536.1.0000557a3ca15000.0000557a3ca9d000.rw-.sdmp	Binary or memory string: <zU!/etc/qemu-binfmt/sparc
Source: Okjv4RjEoF.elf, 5533.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp, Okjv4RjEoF.elf, 5535.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp, Okjv4RjEoF.elf, 5536.1.00007ffdca088000.00007ffdca0a9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: Okjv4RjEoF.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: Okjv4RjEoF.elf, type: SAMPLE
Source: Yara match	File source: 5535.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: Okjv4RjEoF.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: Okjv4RjEoF.elf, type: SAMPLE
Source: Yara match	File source: 5535.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007fc028011000.00007fc02802d000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Okjv4RjEoF.elf	66%	ReversingLabs	Linux.Trojan.LnxGafgyt
Okjv4RjEoF.elf	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.150.26.226	unknown	Netherlands		44592	SKYLINKNL	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.150.26.226	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	PwP4tXNi4a.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	0P0xPHw37E.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	8xnQBClhg7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	PwP4tXNi4a.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	0P0xPHw37E.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	8xnQBClhg7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	ClPVG70TmC.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	5VaGSbWdTq.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	n3l6rOHrCy.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Ag0lD8sQ2M.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	64ZOedXgZ1.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ZNmO15OLbB.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	p83YQKCH5M.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYLINKNL	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.150.26.226
	PwP4tXNi4a.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.150.26.226
	0P0xPHw37E.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.150.26.226
	8xnQBClhg7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.150.26.226
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.150.26.226
	wXKNYp2Oz7.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	u03NaKUcTE.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	OxijfIfpE4.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	iohvlkX3du.elf	Get hash	malicious	Unknown	Browse	185.150.26.199
	3c5LsY4PK6.elf	Get hash	malicious	Unknown	Browse	185.150.26.199

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.oI5NVB (deleted)

Download File

Process:	/tmp/Okjv4RjEoF.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.022685018834161
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Okjv4RjEoF.elf
File size:	145'317 bytes
MD5:	88709fe05e8900f4f1b48ccf0ae3c7f1
SHA1:	fe6661c30748e6b66d83d1e85a1bdd3e09be4423
SHA256:	68f0d4011f606ff57f7fc04e03aee497c29ff2d2640a3cee6e65df8f830e0d0a
SHA512:	d6604e0dd7c0d0908c899e0d8488fe225d2c24f71964dc78324a782d4588f150049a42ca41a618cf7dc2009457e3e23e96b4d9c929e4b44c93220148f7a5e2e0
SSDEEP:	1536:/IOHljrVnQR65FV9X1sgQe+wkxf92qRtYRptC+LJ7WyMguRHysMpJ6UmUwMtiIbH:g8vz7t2le+9Ryl7WnAJ9mUwMtrwBNu
TLSH:	D9E3E83727270A23C0D9507002E74333AEB5DF8724B85297AAA07E9C6F375943996BDD
File Content Preview:	.ELF...........................4.........4. ...(..........................................................l.........dt.Q................................@..(....@.\.................#.....a...`.....!.....!...@.....".........`......$!...!...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	120488
Section Header Size:	40
Number of Section Headers:	25
Header String Table Index:	22

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100b0	0xb0	0x1725c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x2730c	0x1730c	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x27320	0x17320	0x46ec	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x3c000	0x1c000	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x3c004	0x1c004	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x3c00c	0x1c00c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x3c014	0x1c014	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x3c018	0x1c018	0x1d0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x3c1e8	0x1c1e8	0x320	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x3c508	0x1c508	0x67b8	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1c508	0xc06	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1d10e	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x1d12e	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1d14d	0x17b	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d2c8	0x102	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1d3ca	0x85	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1d450	0x2c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1d47c	0xe5	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1d561	0x4e	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1d5af	0x18	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1d5c7	0xe1	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1da90	0x34e0	0x10	0x0		24	335	4
.strtab	STRTAB	0x0	0x20f70	0x2835	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x1ba0c	0x1ba0c	6.0551	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1c000	0x3c000	0x3c000	0x508	0x6cc0	4.4135	0x6	RW	0x10000	.eh_frame .ctors .dtors .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x2730c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x27320	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x3c000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x3c004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x3c00c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x3c014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x3c018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x3c1e8	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x3c508	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
.LLC3	.symtab	0x2b590	0	NOTYPE	<unknown>	DEFAULT	4
.rem	.symtab	0x1a5e4	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x1a5c4	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x1a5d8	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x1a5a4	32	FUNC	<unknown>	DEFAULT	2
C.1.3483	.symtab	0x2b5a4	24	OBJECT	<unknown>	DEFAULT	4
C.147.6073	.symtab	0x297b8	40	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x3c528	4	OBJECT	<unknown>	DEFAULT	11
KHserverHACKER	.symtab	0x3c298	4	OBJECT	<unknown>	DEFAULT	10
LOCAL_ADDR	.symtab	0x427d8	4	OBJECT	<unknown>	DEFAULT	11
Q	.symtab	0x3c548	16384	OBJECT	<unknown>	DEFAULT	11
UserAgents	.symtab	0x3c208	144	OBJECT	<unknown>	DEFAULT	10
_Exit	.symtab	0x1abd4	64	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x3c018	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x3c008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x3c004	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x3c2ac	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x2a230	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x3c500	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x2b70c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x3c2b4	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x2a530	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x3c010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x3c00c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x3c000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x3c000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x3c2ac	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower	.symtab	0x3c500	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper	.symtab	0x3c2b4	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_b	.symtab	0x3c2b0	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x3c504	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x3c2b8	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x1acf4	36	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x1aa78	172	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x23e18	344	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1e89c	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x222bc	36	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1a9cc	172	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1edd4	44	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1ee00	44	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1edac	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x214f8	168	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x215f4	120	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1e8f4	300	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1abd4	64	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x201cc	280	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x20874	24	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x24ab8	80	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x21c48	72	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1ac64	68	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x21ef8	196	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x2263c	64	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x22684	80	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x222e0	860	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1eb6c	36	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x1a6c4	72	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x427ac	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x213bc	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x21b54	76	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x20a70	164	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x227f4	368	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1a9cc	172	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x23c54	444	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x239b4	184	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x23e18	344	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x23a74	124	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x23f70	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x22964	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a65c	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1c188	60	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x24e54	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x24e80	296	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x24b08	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1c1c4	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x23e18	344	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1a95c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x21cd8	32	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1a840	32	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x21dc4	32	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1eafc	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x1eb18	84	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x247c8	648	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x26898	680	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x26b8c	100	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x21bf0	56	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1a7a4	32	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x21c90	72	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1eb90	36	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x21c28	32	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x427b0	4	OBJECT	<unknown>	HIDDEN	11
__GI_htonl	.symtab	0x1eac0	8	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x1eac8	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1ead4	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x246d4	244	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x25674	696	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x252cc	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x20780	244	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1ab70	100	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1ea20	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1a984	72	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x26c54	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x24090	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1d53c	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1cf58	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x2446c	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x24318	256	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1c2a8	416	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x21d6c	88	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x21e74	84	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x21de4	72	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x21e2c	72	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x1eaac	8	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x1eab4	12	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1a72c	120	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x22074	228	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x1a610	76	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x26b40	76	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x24a50	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x202fc	108	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x20600	152	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x2425c	188	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1a910	76	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x221f8	188	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1ebe0	32	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1ec00	36	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x21d00	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1a8bc	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1ec24	32	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1ec44	36	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1ec68	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x204d0	304	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x219b0	256	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1ecb8	56	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1ecf0	16	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1ed08	164	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1ac14	80	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x20b14	188	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1ec94	36	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1ad50	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x20698	232	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x26bf0	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x271ac	116	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1c4bc	524	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x2448c	260	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1c8fc	648	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1c8fc	648	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1cbec	804	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x24220	60	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x26cc0	56	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1c7f0	120	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x24590	244	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1e7c4	216	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1e6d0	244	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x24684	72	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1c6c8	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x24418	84	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1e5b0	288	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1e8c4	40	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x241a8	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x2088c	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x20f9c	1048	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1ea40	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1a7c4	40	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x21ec8	40	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1acb0	60	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x27160	68	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x1a690	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1ad84	160	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x21b04	80	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1a860	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x226d4	76	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x2273c	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x22720	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1ab24	76	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x3c014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x3c014	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x427a4	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x3c4d8	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x3c508	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x215a0	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x267b4	172	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x3c2b0	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x3c504	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x3c2b8	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x427b4	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x3c1f0	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x2592c	232	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x26e14	200	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x25a1c	1960	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x272c4	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x3c1e8	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x27220	164	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x26cf8	284	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x26edc	120	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x4279c	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x1acf4	36	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x42754	4	OBJECT	<unknown>	HIDDEN	11
__fcntl_nocancel	.symtab	0x1aa78	172	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x23e18	344	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x3c004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x3c004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x26860	56	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x24d30	292	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x21bf0	56	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1e89c	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x222bc	36	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x3c004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x3c004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x1ac64	68	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1eb6c	36	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1a9cc	172	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a65c	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x26c54	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x21e2c	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1a72c	120	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1a910	76	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1ebe0	32	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1ec00	36	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1a8bc	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1ec24	32	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1ec44	36	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x219b0	256	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x42798	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x1a860	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1ab24	76	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x2b6dc	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x1fda4	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1ee2c	144	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x3c3fc	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x4292c	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x1fcf4	176	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x1a4d4	208	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x42cb4	4	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x42cb8	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x26f5c	40	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x26298	1300	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x427a0	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x3c004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x3c004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x3c4f4	4	OBJECT	<unknown>	DEFAULT	10
__progname_full	.symtab	0x3c4f8	4	OBJECT	<unknown>	DEFAULT	10
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x214b8	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x214b0	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x214b0	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x214b0	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x214b0	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x26f84	476	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x42cac	4	OBJECT	<unknown>	HIDDEN	11
__resolv_attempts	.symtab	0x3c4ff	1	OBJECT	<unknown>	HIDDEN	10
__resolv_lock	.symtab	0x427bc	24	OBJECT	<unknown>	DEFAULT	11
__resolv_timeout	.symtab	0x3c4fe	1	OBJECT	<unknown>	HIDDEN	10
__rt_sigreturn_stub	.symtab	0x21988	16	FUNC	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x427a8	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x42cb0	4	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x42cbc	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x1edd4	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1ee00	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1edac	40	FUNC	<unknown>	DEFAULT	2
__sigreturn_stub	.symtab	0x21998	16	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x21ba0	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__sparc32_atomic_locks	.symtab	0x42758	64	OBJECT	<unknown>	HIDDEN	11
__stdin	.symtab	0x3c2fc	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x24fa8	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x2297c	196	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x25010	236	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x22d74	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1aea8	40	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4504	.symtab	0x2a830	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x250fc	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x251cc	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x25134	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x22eb4	256	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1afa4	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x3c300	4	OBJECT	<unknown>	DEFAULT	10
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x214f8	168	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x215f4	120	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x2166c	796	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x24090	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x3c4f0	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x1a690	52	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1e8f4	300	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x24bf8	132	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x24b6c	140	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x24c7c	180	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x42568	10	OBJECT	<unknown>	DEFAULT	11
_charpad	.symtab	0x1afdc	64	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x428d4	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_handler	.symtab	0x428fc	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_spec	.symtab	0x3c3f8	4	OBJECT	<unknown>	HIDDEN	10
_dl_aux_init	.symtab	0x24a70	64	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x42ca4	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x42ca8	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x3c508	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x42cc0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x427ac	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x1abd4	64	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x2730c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x40568	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1b01c	116	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x231bc	2032	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x427b0	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x10094	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x22fb4	140	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1b804	156	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1bb44	1604	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1b8a0	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1b8dc	492	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1bad0	116	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x214cc	36	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x214c0	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x42924	8	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x101a4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x22a48	812	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1ae2c	124	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x3c304	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x3c2bc	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x23af8	348	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x40564	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x3c2d4	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x40560	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x3c308	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x1aed0	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x3c2ec	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x208a8	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x23040	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x2a990	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x2307c	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1b098	1900	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x201cc	280	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x1a874	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x148a4	236	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x19304	140	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x20874	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x20874	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
axis_bp	.symtab	0x3c204	4	OBJECT	<unknown>	DEFAULT	10
bcopy	.symtab	0x1cf4c	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x42750	4	OBJECT	<unknown>	DEFAULT	11
brk	.symtab	0x24ab8	80	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1ed08	164	FUNC	<unknown>	DEFAULT	2
buf.5350	.symtab	0x42580	440	OBJECT	<unknown>	DEFAULT	11
bzero	.symtab	0x1c274	52	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x3c2a0	4	OBJECT	<unknown>	DEFAULT	10
call___do_global_ctors_aux	.symtab	0x27300	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1012c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x10198	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1f840	280	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x101dc	224	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x102bc	468	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x10490	468	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x1ad18	56	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x21c48	72	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1ac64	68	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x21ef8	196	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4607	.symtab	0x3c508	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x1eb6c	36	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x123f4	684	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x128b4	312	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x3c1f0	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x1a6c4	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x4279c	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x427ac	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x2a900	126	OBJECT	<unknown>	DEFAULT	4
execl	.symtab	0x213bc	172	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x21b54	76	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x20a70	164	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x2b620	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x227f4	368	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1a9cc	172	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x21fc4	176	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x11c4c	224	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x40548	4	OBJECT	<unknown>	DEFAULT	11
fdopendir	.symtab	0x22158	152	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0x11a7c	464	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x11748	820	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x23c54	444	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x239b4	184	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x23e18	344	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x23a74	124	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x23f70	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x12854	96	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x2b608	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x22964	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1a65c	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked	.symtab	0x1c188	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10138	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1ff60	564	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x24e54	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x24e54	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x24e80	296	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x24b08	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1c1c4	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x1756c	16	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x11fbc	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x171f8	884	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x239b4	184	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x23e18	344	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1a95c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x21cd8	32	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1a840	32	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x21dc4	32	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1eafc	20	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x1eb18	84	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x247c8	648	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x26898	680	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x26b8c	100	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x21bf0	56	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1a7a4	32	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1a70c	32	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x21c90	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1eb90	36	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1ebb4	44	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x21c28	32	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x427b0	4	OBJECT	<unknown>	DEFAULT	11
hacks	.symtab	0x3c1f4	4	OBJECT	<unknown>	DEFAULT	10
hacks2	.symtab	0x3c1f8	4	OBJECT	<unknown>	DEFAULT	10
hacks3	.symtab	0x3c1fc	4	OBJECT	<unknown>	DEFAULT	10
hacks4	.symtab	0x3c200	4	OBJECT	<unknown>	DEFAULT	10
hextable	.symtab	0x28064	1024	OBJECT	<unknown>	DEFAULT	4
hoste.5349	.symtab	0x42738	20	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x1eac0	8	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1eac8	12	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0x14adc	1028	FUNC	<unknown>	DEFAULT	2
i.4849	.symtab	0x3c2a4	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x1c4bc	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1ead4	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x246d4	244	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x25674	696	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x254f4	384	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x252cc	552	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x25200	196	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x16f48	688	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x107ec	228	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x203e4	124	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x20780	244	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1ab70	100	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1ea20	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x1a984	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x3c538	4	OBJECT	<unknown>	DEFAULT	11
last_id.5407	.symtab	0x3c4fc	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.5406	.symtab	0x427b8	4	OBJECT	<unknown>	DEFAULT	11
libc/string/sparc/memchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/fork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/pipe.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/rem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/udiv.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/umul.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/urem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x126a0	436	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x26c54	108	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x3c540	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x1757c	2864	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x12ad0	220	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x12088	128	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x14064	244	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1eec4	2420	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x20194	48	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x24090	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x1d53c	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x1cf58	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x2446c	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x24318	256	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1c2a8	416	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x21d6c	88	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x21e74	84	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x21de4	72	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x3c414	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x3c42c	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x21e2c	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1332	.symtab	0x42578	4	OBJECT	<unknown>	DEFAULT	11
ngPid	.symtab	0x427e0	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x1eaac	8	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1eab4	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x3c530	8	OBJECT	<unknown>	DEFAULT	11
object.4622	.symtab	0x3c50c	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x1a72c	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x22074	228	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x427dc	4	OBJECT	<unknown>	DEFAULT	11
p.4605	.symtab	0x3c1ec	0	OBJECT	<unknown>	DEFAULT	10
parseHex	.symtab	0x11d2c	136	FUNC	<unknown>	DEFAULT	2
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x427e8	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x1a610	76	FUNC	<unknown>	DEFAULT	2
poll	.symtab	0x26b40	76	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x1a7ec	84	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4724	.symtab	0x2a858	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x11140	1144	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x10d00	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10f28	536	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10d6c	444	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x14ee0	8296	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x3c4f8	4	OBJECT	<unknown>	DEFAULT	10
program_invocation_short_name	.symtab	0x3c4f4	4	OBJECT	<unknown>	DEFAULT	10
qual_chars.4733	.symtab	0x2a870	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x24a50	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x202e4	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x18238	232	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x18320	188	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x10bbc	324	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x10a58	356	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x180ac	160	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x1814c	236	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x202fc	108	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x2b508	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x20600	152	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x3c444	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x2425c	188	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x1a910	76	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x221f8	188	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1f960	916	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x1ebe0	32	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x12108	748	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x1ec00	36	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5392	.symtab	0x427d4	4	OBJECT	<unknown>	DEFAULT	11
resolv_domain_to_hostname	.symtab	0x183dc	292	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x18f74	88	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x18604	2416	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x18500	260	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x1c6c8	192	FUNC	<unknown>	DEFAULT	2
rt_sigaction	.symtab	0x21ab0	84	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x13984	1296	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x21d00	108	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x427e4	4	OBJECT	<unknown>	DEFAULT	11
select	.symtab	0x1a8bc	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1ec24	32	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x13e94	464	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1ec44	36	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1ec68	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x20368	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x204d0	304	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x219b0	256	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x1ecb8	56	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x1ecf0	16	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x1ed08	164	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x1ac14	80	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x26230	104	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x261cc	100	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x20b14	188	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1ec94	36	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x14990	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x1165c	236	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4732	.symtab	0x2a884	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4723	.symtab	0x2a868	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4729	.symtab	0x2a8e0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4728	.symtab	0x2a8f8	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4731	.symtab	0x2a894	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4730	.symtab	0x2a8a8	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x1ad50	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x20460	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x20460	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x20698	232	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x26bf0	100	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stderr	.symtab	0x3c2f8	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x3c2f0	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x3c2f4	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x271ac	116	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x1c4bc	524	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x2448c	260	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x1c8fc	648	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1c8fc	648	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1cbec	804	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x24220	60	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x26cc0	56	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1e8f4	300	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1c7f0	120	FUNC	<unknown>	DEFAULT	2
strncmp	.symtab	0x24590	244	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1e7c4	216	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1e6d0	244	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x24684	72	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1c6c8	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x24418	84	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x1e5b0	288	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1e8c4	40	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x241a8	120	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x2088c	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x20f9c	1048	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x11608	84	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x427ec	232	OBJECT	<unknown>	DEFAULT	11
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x18fcc	568	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x3c2a8	4	OBJECT	<unknown>	DEFAULT	10
table_lock_val	.symtab	0x19250	76	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x1929c	104	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x19204	76	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1ea40	108	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x132a4	1760	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x129ec	228	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x1a7c4	40	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x21ec8	40	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x19390	384	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x1acb0	60	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x108d0	392	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x2a8b2	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x2a8d0	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x12bac	1784	FUNC	<unknown>	DEFAULT	2
uname	.symtab	0x27160	68	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1355	.symtab	0x2a980	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x3c4c4	20	OBJECT	<unknown>	DEFAULT	10
uppercase	.symtab	0x12020	104	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x3c29c	4	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x21468	72	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x19924	832	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x1a1e8	252	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x1a348	148	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x1a470	100	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x1a3dc	148	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x1a2e4	100	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x19c64	472	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x1a100	232	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x19854	120	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x19e3c	260	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x197c8	140	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x19688	240	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x19778	80	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x19f40	448	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x19510	112	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x19580	264	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x198cc	88	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x1a690	52	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x14158	1868	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x1ad84	160	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x4055c	4	OBJECT	<unknown>	DEFAULT	11
wait4	.symtab	0x21b04	80	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x1a860	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x10664	392	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x3c52c	4	OBJECT	<unknown>	DEFAULT	11
wcrtomb	.symtab	0x226d4	76	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x2273c	176	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x22720	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x11db4	520	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x1ab24	76	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x40550	4	OBJECT	<unknown>	DEFAULT	11
xdigits.3377	.symtab	0x2b670	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x40554	4	OBJECT	<unknown>	DEFAULT	11
z	.symtab	0x40558	4	OBJECT	<unknown>	DEFAULT	11
zprintf	.symtab	0x115b8	80	FUNC	<unknown>	DEFAULT	2

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/18/24-01:33:47.014208	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41112	185.150.26.226	192.168.2.15
04/18/24-01:34:48.763089	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41120	185.150.26.226	192.168.2.15
04/18/24-01:33:31.597692	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41110	185.150.26.226	192.168.2.15
04/18/24-01:35:04.178054	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41122	185.150.26.226	192.168.2.15
04/18/24-01:34:02.429258	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41114	185.150.26.226	192.168.2.15
04/18/24-01:35:19.642641	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41124	185.150.26.226	192.168.2.15
04/18/24-01:36:05.894019	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41130	185.150.26.226	192.168.2.15
04/18/24-01:36:21.306914	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41132	185.150.26.226	192.168.2.15
04/18/24-01:33:10.661260	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	60996	185.150.26.226	192.168.2.14
04/18/24-01:35:50.478244	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41128	185.150.26.226	192.168.2.15
04/18/24-01:32:55.204030	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	60994	185.150.26.226	192.168.2.14
04/18/24-01:35:35.060088	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41126	185.150.26.226	192.168.2.15
04/18/24-01:33:26.121128	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	60998	185.150.26.226	192.168.2.14
04/18/24-01:34:33.302369	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41118	185.150.26.226	192.168.2.15
04/18/24-01:33:58.052753	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32770	185.150.26.226	192.168.2.14
04/18/24-01:34:17.838935	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41116	185.150.26.226	192.168.2.15
04/18/24-01:33:41.581090	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	32768	185.150.26.226	192.168.2.14
04/18/24-01:33:16.136970	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	1486	41108	185.150.26.226	192.168.2.15

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 01:32:59.035537958 CEST	41106	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:32:59.244210005 CEST	1486	41106	185.150.26.226	192.168.2.15
Apr 18, 2024 01:32:59.244337082 CEST	41106	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:32:59.245548964 CEST	41106	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:32:59.866245031 CEST	41106	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:00.506263971 CEST	41106	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:00.715087891 CEST	1486	41106	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:15.716373920 CEST	41108	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:15.926376104 CEST	1486	41108	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:15.926570892 CEST	41108	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:15.926865101 CEST	41108	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:16.136926889 CEST	1486	41108	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:16.136970043 CEST	1486	41108	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:16.137006044 CEST	1486	41108	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:16.137382984 CEST	41108	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:16.347269058 CEST	1486	41108	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:31.141066074 CEST	41110	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:31.369260073 CEST	1486	41110	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:31.369551897 CEST	41110	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:31.369801998 CEST	41110	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:31.597692013 CEST	1486	41110	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:31.597745895 CEST	1486	41110	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:31.597779989 CEST	1486	41110	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:31.597831011 CEST	41110	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:31.598143101 CEST	41110	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:31.825994968 CEST	1486	41110	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:31.826018095 CEST	1486	41110	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:46.598629951 CEST	41112	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:46.806128979 CEST	1486	41112	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:46.806476116 CEST	41112	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:46.806543112 CEST	41112	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:47.014164925 CEST	1486	41112	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:47.014208078 CEST	1486	41112	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:47.014245033 CEST	1486	41112	185.150.26.226	192.168.2.15
Apr 18, 2024 01:33:47.014367104 CEST	41112	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:33:47.222120047 CEST	1486	41112	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:02.015064001 CEST	41114	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:02.222215891 CEST	1486	41114	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:02.222510099 CEST	41114	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:02.222510099 CEST	41114	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:02.429197073 CEST	1486	41114	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:02.429258108 CEST	1486	41114	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:02.429292917 CEST	1486	41114	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:02.429425001 CEST	41114	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:02.636022091 CEST	1486	41114	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:17.430146933 CEST	41116	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:17.634394884 CEST	1486	41116	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:17.634670973 CEST	41116	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:17.634752035 CEST	41116	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:17.838896036 CEST	1486	41116	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:17.838934898 CEST	1486	41116	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:17.838968992 CEST	1486	41116	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:17.839049101 CEST	41116	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:18.043107986 CEST	1486	41116	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:32.839786053 CEST	41118	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:33.071031094 CEST	1486	41118	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:33.071427107 CEST	41118	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:33.071631908 CEST	41118	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:33.302318096 CEST	1486	41118	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:33.302369118 CEST	1486	41118	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:33.302406073 CEST	1486	41118	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:33.302500963 CEST	41118	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:33.533250093 CEST	1486	41118	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:48.303385973 CEST	41120	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:48.533257961 CEST	1486	41120	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:48.533607960 CEST	41120	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:48.533608913 CEST	41120	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:48.763029099 CEST	1486	41120	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:48.763088942 CEST	1486	41120	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:48.763107061 CEST	1486	41120	185.150.26.226	192.168.2.15
Apr 18, 2024 01:34:48.763257027 CEST	41120	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:34:48.993449926 CEST	1486	41120	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:03.764172077 CEST	41122	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:03.970902920 CEST	1486	41122	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:03.971210957 CEST	41122	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:03.971381903 CEST	41122	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:04.178025007 CEST	1486	41122	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:04.178054094 CEST	1486	41122	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:04.178073883 CEST	1486	41122	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:04.178369045 CEST	41122	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:04.385126114 CEST	1486	41122	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:19.179119110 CEST	41124	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:19.410613060 CEST	1486	41124	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:19.411142111 CEST	41124	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:19.411242008 CEST	41124	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:19.642576933 CEST	1486	41124	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:19.642641068 CEST	1486	41124	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:19.642664909 CEST	1486	41124	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:19.642949104 CEST	41124	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:19.874406099 CEST	1486	41124	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:34.643681049 CEST	41126	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:34.851680040 CEST	1486	41126	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:34.851825953 CEST	41126	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:34.851869106 CEST	41126	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:35.060028076 CEST	1486	41126	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:35.060087919 CEST	1486	41126	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:35.060177088 CEST	41126	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:35.060204983 CEST	1486	41126	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:35.268263102 CEST	1486	41126	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:50.061335087 CEST	41128	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:50.269586086 CEST	1486	41128	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:50.269961119 CEST	41128	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:50.269962072 CEST	41128	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:50.478226900 CEST	1486	41128	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:50.478244066 CEST	1486	41128	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:50.478255033 CEST	1486	41128	185.150.26.226	192.168.2.15
Apr 18, 2024 01:35:50.478480101 CEST	41128	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:35:50.686642885 CEST	1486	41128	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:05.479360104 CEST	41130	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:05.687144041 CEST	1486	41130	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:05.687364101 CEST	41130	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:05.687402010 CEST	41130	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:05.893990040 CEST	1486	41130	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:05.894018888 CEST	1486	41130	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:05.894038916 CEST	1486	41130	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:05.894282103 CEST	41130	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:06.102157116 CEST	1486	41130	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:20.895143032 CEST	41132	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:21.100879908 CEST	1486	41132	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:21.101094007 CEST	41132	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:21.101264000 CEST	41132	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:21.306914091 CEST	1486	41132	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:21.306946039 CEST	1486	41132	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:21.306966066 CEST	1486	41132	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:21.307135105 CEST	41132	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:21.307183981 CEST	41132	1486	192.168.2.15	185.150.26.226
Apr 18, 2024 01:36:21.513160944 CEST	1486	41132	185.150.26.226	192.168.2.15
Apr 18, 2024 01:36:21.513190031 CEST	1486	41132	185.150.26.226	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 01:35:41.323929071 CEST	40456	53	192.168.2.15	1.1.1.1
Apr 18, 2024 01:35:41.323987961 CEST	60736	53	192.168.2.15	1.1.1.1
Apr 18, 2024 01:35:41.430233002 CEST	53	60736	1.1.1.1	192.168.2.15
Apr 18, 2024 01:35:41.430339098 CEST	53	40456	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 01:35:41.323929071 CEST	192.168.2.15	1.1.1.1	0x242	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 01:35:41.323987961 CEST	192.168.2.15	1.1.1.1	0xf86a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 01:35:41.430339098 CEST	1.1.1.1	192.168.2.15	0x242	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Apr 18, 2024 01:35:41.430339098 CEST	1.1.1.1	192.168.2.15	0x242	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Okjv4RjEoF.elf PID: 5533, Parent PID: 5453

General

Start time (UTC):	23:32:57
Start date (UTC):	17/04/2024
Path:	/tmp/Okjv4RjEoF.elf
Arguments:	/tmp/Okjv4RjEoF.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Okjv4RjEoF.elf PID: 5535, Parent PID: 5533

General

Start time (UTC):	23:32:58
Start date (UTC):	17/04/2024
Path:	/tmp/Okjv4RjEoF.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Okjv4RjEoF.elf PID: 5536, Parent PID: 5533

General

Start time (UTC):	23:32:58
Start date (UTC):	17/04/2024
Path:	/tmp/Okjv4RjEoF.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Okjv4RjEoF.elf PID: 5539, Parent PID: 5536

General

Start time (UTC):	23:32:58
Start date (UTC):	17/04/2024
Path:	/tmp/Okjv4RjEoF.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Okjv4RjEoF.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.oI5NVB (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Okjv4RjEoF.elf PID: 5533, Parent PID: 5453

General

Chronological Activities

Analysis Process: Okjv4RjEoF.elf PID: 5535, Parent PID: 5533

General

Chronological Activities

Analysis Process: Okjv4RjEoF.elf PID: 5536, Parent PID: 5533

General

Chronological Activities

Analysis Process: Okjv4RjEoF.elf PID: 5539, Parent PID: 5536

General

Linux Analysis Report
Okjv4RjEoF.elf