Edit tour

Linux Analysis Report
vlxx.x86.elf

Overview

General Information

Sample name:	vlxx.x86.elf
Analysis ID:	1431582
MD5:	aeee41fcd4a3875eee78dc08f5b8395c
SHA1:	bbd057c01ca96e1090ec8a6e56ada39fcaf2e622
SHA256:	25309771f9e01f95a74584ac6f84426494848c9f4954729e692a92f8700f1a8d
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431582
Start date and time:	2024-04-25 13:37:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vlxx.x86.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@22/0

Runtime Messages

Command:	/tmp/vlxx.x86.elf
PID:	6249
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

vlxx.x86.elf (PID: 6249, Parent: 6173, MD5: aeee41fcd4a3875eee78dc08f5b8395c) Arguments: /tmp/vlxx.x86.elf

vlxx.x86.elf New Fork (PID: 6250, Parent: 6249)

vlxx.x86.elf New Fork (PID: 6251, Parent: 6250)

vlxx.x86.elf New Fork (PID: 6252, Parent: 6250)

dash New Fork (PID: 6254, Parent: 4331)

rm (PID: 6254, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.HhXoQJ6qvF /tmp/tmp.1ShZs8Egih /tmp/tmp.YspoCjn62m

dash New Fork (PID: 6255, Parent: 4331)

rm (PID: 6255, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.HhXoQJ6qvF /tmp/tmp.1ShZs8Egih /tmp/tmp.YspoCjn62m

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vlxx.x86.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
vlxx.x86.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
vlxx.x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
vlxx.x86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1301c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1306c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1310c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
vlxx.x86.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xebab:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
vlxx.x86.elf	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x108a9:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
vlxx.x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5032:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6249.1.0000000008048000.000000000805e000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6249.1.0000000008048000.000000000805e000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6249.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1301c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1306c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1310c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6249.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xebab:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
6249.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x108a9:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
6249.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5032:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: vlxx.x86.elf PID: 6249	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: vlxx.x86.elf PID: 6249	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: vlxx.x86.elf PID: 6249	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x89e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x902:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x916:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x952:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x966:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x97a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x98e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 4 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:03.929975
SID:	2030490
Source Port:	41224
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:40.403386
SID:	2030490
Source Port:	41256
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:36.955046
SID:	2030490
Source Port:	41234
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:44.890676
SID:	2030490
Source Port:	41236
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:00.861893
SID:	2030490
Source Port:	41222
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:10.867035
SID:	2030490
Source Port:	41226
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:35.429299
SID:	2030490
Source Port:	41254
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:47.413449
SID:	2030490
Source Port:	41258
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:03.660136
SID:	2030490
Source Port:	41244
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:15.539783
SID:	2030490
Source Port:	41248
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:22.046469
SID:	2030490
Source Port:	41228
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:30.469863
SID:	2030490
Source Port:	41252
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:58.346348
SID:	2030490
Source Port:	41262
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:26.000293
SID:	2030490
Source Port:	41230
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:35.007261
SID:	2030490
Source Port:	41232
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:47.814770
SID:	2030490
Source Port:	41238
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:00.718254
SID:	2030490
Source Port:	41242
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:26.498730
SID:	2030490
Source Port:	41250
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:38:57.764755
SID:	2030490
Source Port:	41240
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:54.386335
SID:	2030490
Source Port:	41260
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 14.225.219.252

Timestamp:	04/25/24-13:39:10.588082
SID:	2030490
Source Port:	41246
Destination Port:	42597
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vlxx.x86.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: vlxx.x86.elf	ReversingLabs: Detection: 54%
Source: vlxx.x86.elf	Virustotal: Detection: 44%			Perma Link

Machine Learning detection for sample

Source: vlxx.x86.elf

Joe Sandbox ML: detected

Source: vlxx.x86.elf

String: HTTP/1.1 200 OKcundi.armcundi.arm5cundi.arm6cundi.arm7cundi.mipscundi.mpslcundi.x86_64cundi.sh4/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverwgetcurlecho/proc/proc/%d/cmdlineabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41222 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41224 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41226 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41228 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41230 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41232 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41234 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41236 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41238 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41240 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41242 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41244 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41246 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41248 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41250 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41252 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41254 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41256 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41258 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41260 -> 14.225.219.252:42597
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:41262 -> 14.225.219.252:42597

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 14.225.219.252 ports 42597,2,4,5,7,9

Source: global traffic

TCP traffic: 192.168.2.23:41222 -> 14.225.219.252:42597

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: global traffic

DNS traffic detected: DNS query: legendsworld.cloud

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: vlxx.x86.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_start

Source: vlxx.x86.elf	ELF static info symbol of initial sample: execute_cfa_program
Source: vlxx.x86.elf	ELF static info symbol of initial sample: execute_stack_op

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKcundi.armcundi.arm5cundi.arm6cundi.arm7cundi.mipscundi.mpslcundi.x86_64cundi.sh4/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverwgetcurlecho/proc/proc/%d/cmdlineabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: vlxx.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: vlxx.x86.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@22/0

Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/vlxx.x86.elf (PID: 6252)	File opened: /proc/5833/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6254)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.HhXoQJ6qvF /tmp/tmp.1ShZs8Egih /tmp/tmp.YspoCjn62m			Jump to behavior
Source: /usr/bin/dash (PID: 6255)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.HhXoQJ6qvF /tmp/tmp.1ShZs8Egih /tmp/tmp.YspoCjn62m			Jump to behavior

Source: /tmp/vlxx.x86.elf (PID: 6249)

Queries kernel information via 'uname':

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vlxx.x86.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vlxx.x86.elf PID: 6249, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: vlxx.x86.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vlxx.x86.elf PID: 6249, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Mirai

Source: Yara match	File source: vlxx.x86.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vlxx.x86.elf PID: 6249, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: vlxx.x86.elf, type: SAMPLE
Source: Yara match	File source: 6249.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vlxx.x86.elf PID: 6249, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vlxx.x86.elf	54%	ReversingLabs	Linux.Trojan.Mirai
vlxx.x86.elf	45%	Virustotal		Browse
vlxx.x86.elf	100%	Avira	EXP/ELF.Mirai.Z.A
vlxx.x86.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
legendsworld.cloud	14.225.219.252	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
14.225.219.252	legendsworld.cloud	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
14.225.219.252	vlxx.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
109.202.202.202	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse
	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse
91.189.91.43	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse
	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse
	0ADLfPX6HX.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse
	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
legendsworld.cloud	vlxx.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	14.225.219.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	vlxx.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gCqnbN34QY.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	PylIt4izlJ.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	vlxx.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gCqnbN34QY.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	PylIt4izlJ.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
VNPT-AS-VNVNPTCorpVN	vlxx.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	14.225.219.252
	uqGHhft2DO.elf	Get hash	malicious	Mirai	Browse	14.251.73.152
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	14.186.115.237
	BM-FM_NR.24040718PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse	203.161.49.193
	PO0424024.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	203.161.46.103
	shipping document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	203.161.46.103
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	113.184.59.194
	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	113.166.126.237
	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	113.166.59.97
	sora.arm.elf	Get hash	malicious	Mirai	Browse	113.181.189.136
INIT7CH	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse	109.202.202.202

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.21996020450459
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	vlxx.x86.elf
File size:	192'060 bytes
MD5:	aeee41fcd4a3875eee78dc08f5b8395c
SHA1:	bbd057c01ca96e1090ec8a6e56ada39fcaf2e622
SHA256:	25309771f9e01f95a74584ac6f84426494848c9f4954729e692a92f8700f1a8d
SHA512:	e5b470fe0a75136b20dd755badb5e42879bb7f24f3d6eb382b6dbfbc2d6db1985039cbc69cef11267db9f8a9dcee5dd0b93d4d3efe918e7abba019cd9801bd8a
SSDEEP:	3072:bFs/9Jk8dULgnlOVTKvfLV+vR4sw6GTIC5FYHVByqqyKK:bQ9JkM7nlOVTKvYR4sw6QIC5qHv9Z
TLSH:	F9146C86E762D9B7C44A077506DB97354636E4A2032F4F02E32CAEF42E536C2F585F4A
File Content Preview:	.ELF........................4....b......4. ...(.....................lS..lS..............lS..l...l.......Dl...............g..........................Q.td............................U..S.......Ow...h.....)..[]...$.............U......=@....t..5....$......$..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048184
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	156384
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80480b4	0xb4	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480d0	0xd0	0x12a07	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x805aad7	0x12ad7	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x805ab00	0x12b00	0x286c	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x805e36c	0x1536c	0x1484	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x805f7f0	0x167f0	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x805f7f4	0x167f4	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x805f7f4	0x167f4	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x805f7fc	0x167fc	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x805f804	0x16804	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x805f808	0x16808	0x4	0x4	0x3	WA	0	0	4
.got.plt	PROGBITS	0x805f80c	0x1680c	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x805f820	0x16820	0x318	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x805fb40	0x16b38	0x5470	0x0	0x3	WA	0	0	32
.stab	PROGBITS	0x0	0x16b38	0xfc	0xc	0x0		16	0	4
.stabstr	STRTAB	0x0	0x16c34	0xdb	0x0	0x0		0	0	1
.comment	PROGBITS	0x0	0x16d0f	0xe58	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x17b67	0x40	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x17ba7	0x2f3	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x17e9a	0x4eab	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1cd45	0x9c1	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1d706	0x13df	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1eae8	0xc38	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f720	0x1ebd	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x215dd	0x3f8a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x25567	0xc70	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x261d7	0x106	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x26790	0x4980	0x10	0x0		29	543	4
.strtab	STRTAB	0x0	0x2b110	0x3d2c	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1536c	0x1536c	6.5879	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x1536c	0x805e36c	0x805e36c	0x17cc	0x6c44	4.7821	0x6	RW	0x1000	.eh_frame .tdata .tbss .ctors .dtors .jcr .got .got.plt .data .bss
TLS	0x167f0	0x805f7f0	0x805f7f0	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80480b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x805aad7	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x805ab00	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x805e36c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x805f7f0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805f7f4	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x805f7f4	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x805f7fc	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x805f804	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x805f808	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x805f80c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x805f820	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x805fb40	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
.L117	.symtab	0x80507a0	0	NOTYPE	<unknown>	DEFAULT	2
.L122	.symtab	0x805077d	0	NOTYPE	<unknown>	DEFAULT	2
.L123	.symtab	0x8050857	0	NOTYPE	<unknown>	DEFAULT	2
.L124	.symtab	0x805089a	0	NOTYPE	<unknown>	DEFAULT	2
.L125	.symtab	0x80508b9	0	NOTYPE	<unknown>	DEFAULT	2
.L126	.symtab	0x80508de	0	NOTYPE	<unknown>	DEFAULT	2
.L127	.symtab	0x80508fd	0	NOTYPE	<unknown>	DEFAULT	2
.L128	.symtab	0x805090f	0	NOTYPE	<unknown>	DEFAULT	2
.L129	.symtab	0x805092e	0	NOTYPE	<unknown>	DEFAULT	2
.L130	.symtab	0x805094d	0	NOTYPE	<unknown>	DEFAULT	2
.L131	.symtab	0x805097d	0	NOTYPE	<unknown>	DEFAULT	2
.L132	.symtab	0x80509be	0	NOTYPE	<unknown>	DEFAULT	2
.L133	.symtab	0x80509e8	0	NOTYPE	<unknown>	DEFAULT	2
.L134	.symtab	0x8050a1d	0	NOTYPE	<unknown>	DEFAULT	2
.L135	.symtab	0x8050a41	0	NOTYPE	<unknown>	DEFAULT	2
.L136	.symtab	0x8050a5e	0	NOTYPE	<unknown>	DEFAULT	2
.L137	.symtab	0x8050a87	0	NOTYPE	<unknown>	DEFAULT	2
.L138	.symtab	0x8050ab6	0	NOTYPE	<unknown>	DEFAULT	2
.L139	.symtab	0x8050ad2	0	NOTYPE	<unknown>	DEFAULT	2
.L140	.symtab	0x8050b1b	0	NOTYPE	<unknown>	DEFAULT	2
.L141	.symtab	0x8050b4a	0	NOTYPE	<unknown>	DEFAULT	2
.L142	.symtab	0x8050b83	0	NOTYPE	<unknown>	DEFAULT	2
.L143	.symtab	0x8050b9c	0	NOTYPE	<unknown>	DEFAULT	2
.L144	.symtab	0x8050bb9	0	NOTYPE	<unknown>	DEFAULT	2
.L145	.symtab	0x8050bee	0	NOTYPE	<unknown>	DEFAULT	2
.L146	.symtab	0x805081c	0	NOTYPE	<unknown>	DEFAULT	2
.L258	.symtab	0x80515cf	0	NOTYPE	<unknown>	DEFAULT	2
.L259	.symtab	0x80515c2	0	NOTYPE	<unknown>	DEFAULT	2
.L260	.symtab	0x80515b6	0	NOTYPE	<unknown>	DEFAULT	2
.L261	.symtab	0x80515a3	0	NOTYPE	<unknown>	DEFAULT	2
.L262	.symtab	0x8051595	0	NOTYPE	<unknown>	DEFAULT	2
.L264	.symtab	0x80511d0	0	NOTYPE	<unknown>	DEFAULT	2
.L266	.symtab	0x8051223	0	NOTYPE	<unknown>	DEFAULT	2
.L267	.symtab	0x8051523	0	NOTYPE	<unknown>	DEFAULT	2
.L268	.symtab	0x805150c	0	NOTYPE	<unknown>	DEFAULT	2
.L269	.symtab	0x80514e9	0	NOTYPE	<unknown>	DEFAULT	2
.L270	.symtab	0x80514c9	0	NOTYPE	<unknown>	DEFAULT	2
.L271	.symtab	0x80514a7	0	NOTYPE	<unknown>	DEFAULT	2
.L272	.symtab	0x805147f	0	NOTYPE	<unknown>	DEFAULT	2
.L273	.symtab	0x8051441	0	NOTYPE	<unknown>	DEFAULT	2
.L274	.symtab	0x80513c8	0	NOTYPE	<unknown>	DEFAULT	2
.L275	.symtab	0x805137d	0	NOTYPE	<unknown>	DEFAULT	2
.L276	.symtab	0x805133d	0	NOTYPE	<unknown>	DEFAULT	2
.L277	.symtab	0x805132e	0	NOTYPE	<unknown>	DEFAULT	2
.L278	.symtab	0x8051323	0	NOTYPE	<unknown>	DEFAULT	2
.L279	.symtab	0x80512da	0	NOTYPE	<unknown>	DEFAULT	2
.L280	.symtab	0x8051281	0	NOTYPE	<unknown>	DEFAULT	2
.L281	.symtab	0x805122d	0	NOTYPE	<unknown>	DEFAULT	2
.L282	.symtab	0x8051534	0	NOTYPE	<unknown>	DEFAULT	2
.L283	.symtab	0x80511f8	0	NOTYPE	<unknown>	DEFAULT	2
.L350	.symtab	0x80516a4	0	NOTYPE	<unknown>	DEFAULT	2
.L351	.symtab	0x80516ae	0	NOTYPE	<unknown>	DEFAULT	2
.L352	.symtab	0x80516bd	0	NOTYPE	<unknown>	DEFAULT	2
.L353	.symtab	0x80516c7	0	NOTYPE	<unknown>	DEFAULT	2
.L354	.symtab	0x80516d6	0	NOTYPE	<unknown>	DEFAULT	2
.L355	.symtab	0x80516e1	0	NOTYPE	<unknown>	DEFAULT	2
.L356	.symtab	0x80516eb	0	NOTYPE	<unknown>	DEFAULT	2
.L357	.symtab	0x80516f6	0	NOTYPE	<unknown>	DEFAULT	2
.L358	.symtab	0x8051702	0	NOTYPE	<unknown>	DEFAULT	2
.L359	.symtab	0x805170e	0	NOTYPE	<unknown>	DEFAULT	2
.L360	.symtab	0x805171a	0	NOTYPE	<unknown>	DEFAULT	2
.L361	.symtab	0x8051724	0	NOTYPE	<unknown>	DEFAULT	2
.L362	.symtab	0x8051736	0	NOTYPE	<unknown>	DEFAULT	2
.L363	.symtab	0x8051748	0	NOTYPE	<unknown>	DEFAULT	2
.L364	.symtab	0x805175a	0	NOTYPE	<unknown>	DEFAULT	2
.L365	.symtab	0x805176c	0	NOTYPE	<unknown>	DEFAULT	2
.L366	.symtab	0x805177e	0	NOTYPE	<unknown>	DEFAULT	2
.L374	.symtab	0x80511b4	0	NOTYPE	<unknown>	DEFAULT	2
.L412	.symtab	0x8051935	0	NOTYPE	<unknown>	DEFAULT	2
.L413	.symtab	0x8051a38	0	NOTYPE	<unknown>	DEFAULT	2
.L414	.symtab	0x80518dc	0	NOTYPE	<unknown>	DEFAULT	2
.L415	.symtab	0x80519f3	0	NOTYPE	<unknown>	DEFAULT	2
.L416	.symtab	0x80519b8	0	NOTYPE	<unknown>	DEFAULT	2
.L417	.symtab	0x8051961	0	NOTYPE	<unknown>	DEFAULT	2
.L64	.symtab	0x80504f0	0	NOTYPE	<unknown>	DEFAULT	2
.L66	.symtab	0x8050578	0	NOTYPE	<unknown>	DEFAULT	2
.L67	.symtab	0x8050568	0	NOTYPE	<unknown>	DEFAULT	2
.L70	.symtab	0x8050551	0	NOTYPE	<unknown>	DEFAULT	2
.L71	.symtab	0x8050560	0	NOTYPE	<unknown>	DEFAULT	2
.L72	.symtab	0x8050500	0	NOTYPE	<unknown>	DEFAULT	2
.L73	.symtab	0x805054a	0	NOTYPE	<unknown>	DEFAULT	2
.L87	.symtab	0x80527d0	0	NOTYPE	<unknown>	DEFAULT	2
.L89	.symtab	0x8052858	0	NOTYPE	<unknown>	DEFAULT	2
.L90	.symtab	0x8052848	0	NOTYPE	<unknown>	DEFAULT	2
.L93	.symtab	0x8052831	0	NOTYPE	<unknown>	DEFAULT	2
.L94	.symtab	0x8052840	0	NOTYPE	<unknown>	DEFAULT	2
.L95	.symtab	0x80527e0	0	NOTYPE	<unknown>	DEFAULT	2
.L96	.symtab	0x805282a	0	NOTYPE	<unknown>	DEFAULT	2
C.11.5136	.symtab	0x805bef8	24	OBJECT	<unknown>	DEFAULT	4
C.9.5648	.symtab	0x805b8a0	64	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x80649e4	1	OBJECT	<unknown>	DEFAULT	14
LOCAL_ADDR	.symtab	0x80649e0	4	OBJECT	<unknown>	DEFAULT	14
POPBX1	.symtab	0x80585ef	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x805864f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x80586af	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80585db	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805863b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805869b	0	NOTYPE	<unknown>	DEFAULT	2
RESTBX1	.symtab	0x8058599	0	NOTYPE	<unknown>	DEFAULT	2
SAVEBX1	.symtab	0x805858c	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x8054164	66	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x805f80c	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_L_lock_103	.symtab	0x8054be2	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1055	.symtab	0x804e86a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_12	.symtab	0x805614f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1225	.symtab	0x804e87a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1261	.symtab	0x804e89a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_140	.symtab	0x805618f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1402	.symtab	0x804e8ca	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1430	.symtab	0x804e8ea	16	FUNC	<unknown>	DEFAULT	2
_L_lock_160	.symtab	0x80561af	16	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x8055e3a	10	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x805a219	10	FUNC	<unknown>	DEFAULT	2
_L_lock_174	.symtab	0x804e7ca	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1750	.symtab	0x804e92a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_18	.symtab	0x8054ba8	13	FUNC	<unknown>	DEFAULT	2
_L_lock_191	.symtab	0x80561cf	13	FUNC	<unknown>	DEFAULT	2
_L_lock_198	.symtab	0x8054fd0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_20	.symtab	0x804fb78	16	FUNC	<unknown>	DEFAULT	2
_L_lock_205	.symtab	0x804fb98	16	FUNC	<unknown>	DEFAULT	2
_L_lock_209	.symtab	0x8054fe0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_27	.symtab	0x80584a4	16	FUNC	<unknown>	DEFAULT	2
_L_lock_29	.symtab	0x805615f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_32	.symtab	0x805a2c1	10	FUNC	<unknown>	DEFAULT	2
_L_lock_34	.symtab	0x805a88e	13	FUNC	<unknown>	DEFAULT	2
_L_lock_360	.symtab	0x804e7ea	16	FUNC	<unknown>	DEFAULT	2
_L_lock_447	.symtab	0x804efb8	14	FUNC	<unknown>	DEFAULT	2
_L_lock_470	.symtab	0x804e80a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_473	.symtab	0x804efc6	14	FUNC	<unknown>	DEFAULT	2
_L_lock_512	.symtab	0x804efd4	14	FUNC	<unknown>	DEFAULT	2
_L_lock_54	.symtab	0x8054bb5	16	FUNC	<unknown>	DEFAULT	2
_L_lock_70	.symtab	0x8058388	16	FUNC	<unknown>	DEFAULT	2
_L_lock_757	.symtab	0x804e82a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_893	.symtab	0x804e84a	16	FUNC	<unknown>	DEFAULT	2
_L_robust_lock_105	.symtab	0x804ef96	17	FUNC	<unknown>	DEFAULT	2
_L_robust_unlock_179	.symtab	0x804f3c8	17	FUNC	<unknown>	DEFAULT	2
_L_unlock_101	.symtab	0x805a89b	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_102	.symtab	0x805617f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_110	.symtab	0x804efa7	17	FUNC	<unknown>	DEFAULT	2
_L_unlock_113	.symtab	0x8054bf2	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_1234	.symtab	0x804e88a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1315	.symtab	0x804e8aa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1340	.symtab	0x804e8ba	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1406	.symtab	0x804e8da	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1434	.symtab	0x804e8fa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_152	.symtab	0x805619f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_167	.symtab	0x8058398	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_1671	.symtab	0x804e90a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_170	.symtab	0x80561bf	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1710	.symtab	0x804e91a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1820	.symtab	0x804e93a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_225	.symtab	0x8054ff0	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_232	.symtab	0x80561dc	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_235	.symtab	0x8054ffd	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_285	.symtab	0x804fba8	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_338	.symtab	0x804e7da	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_40	.symtab	0x8055e44	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_452	.symtab	0x804e7fa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_454	.symtab	0x804f3d9	11	FUNC	<unknown>	DEFAULT	2
_L_unlock_518	.symtab	0x804e81a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_57	.symtab	0x805a223	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_61	.symtab	0x805a2cb	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_64	.symtab	0x804fb88	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_66	.symtab	0x8054bc5	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_787	.symtab	0x804e83a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_83	.symtab	0x8054bd5	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_86	.symtab	0x805616f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_894	.symtab	0x804e85a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_90	.symtab	0x80584b4	13	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Backtrace	.symtab	0x8051e20	154	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x80503e0	28	FUNC	<unknown>	HIDDEN	2
_Unwind_FindEnclosingFunction	.symtab	0x80506a0	52	FUNC	<unknown>	HIDDEN	2
_Unwind_Find_FDE	.symtab	0x8053d90	489	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x8052340	184	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind_Phase2	.symtab	0x80520d0	219	FUNC	<unknown>	DEFAULT	2
_Unwind_GetCFA	.symtab	0x8050370	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x80503c0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetGR	.symtab	0x8050460	86	FUNC	<unknown>	HIDDEN	2
_Unwind_GetIP	.symtab	0x8050380	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetIPInfo	.symtab	0x80506e0	22	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x80503a0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x80503b0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x80503d0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_IteratePhdrCallback	.symtab	0x8053830	1367	FUNC	<unknown>	DEFAULT	2
_Unwind_RaiseException	.symtab	0x8051f70	342	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException_Phase2	.symtab	0x8051ec0	169	FUNC	<unknown>	DEFAULT	2
_Unwind_Resume	.symtab	0x8052280	184	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x80521b0	196	FUNC	<unknown>	HIDDEN	2
_Unwind_SetGR	.symtab	0x8050400	86	FUNC	<unknown>	HIDDEN	2
_Unwind_SetIP	.symtab	0x8050390	14	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x805f7f8	0	OBJECT	<unknown>	DEFAULT	8
__CTOR_LIST__	.symtab	0x805f7f4	0	OBJECT	<unknown>	DEFAULT	8
__C_ctype_b	.symtab	0x805fb30	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805cf94	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x805f800	0	OBJECT	<unknown>	DEFAULT	9
__DTOR_LIST__	.symtab	0x805f7fc	0	OBJECT	<unknown>	DEFAULT	9
__EH_FRAME_BEGIN__	.symtab	0x805e36c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x805f7ec	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x805fb30	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x8058580	80	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x805858a	27	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x805fb34	4	OBJECT	<unknown>	HIDDEN	13
__GI___dl_iterate_phdr	.symtab	0x8058db4	84	FUNC	<unknown>	HIDDEN	2
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x8054040	83	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x805a2d8	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x805649c	26	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x8058580	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x8054093	153	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80585d0	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x8058690	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x8058630	91	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x8059158	27	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x804fd9c	1	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x804fd9d	1	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x80585d0	91	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x80585da	33	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x805fbe8	8192	OBJECT	<unknown>	HIDDEN	14
__GI___pthread_register_cancel	.symtab	0x804fc60	27	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unregister_cancel	.symtab	0x804fc7b	10	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind	.symtab	0x804f3e4	67	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x804f427	8	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x8058690	91	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x805869a	33	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x80583e1	195	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x805fbc8	8	OBJECT	<unknown>	HIDDEN	14
__GI___uClibc_fini	.symtab	0x8058e8b	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8058eef	39	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x8058630	91	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x805863a	33	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80564b8	191	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8054164	66	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80578d8	191	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x805662c	84	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8057d08	17	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x8056680	40	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x805a63c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x8058580	80	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x805478c	130	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x80596da	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x8059706	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x8059470	618	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x80566a8	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8057e4c	93	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8054a2c	380	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x8054093	153	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8055f90	447	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x805a230	145	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x805a2d8	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8055dc4	118	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80561ec	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8054c00	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x805817c	524	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x8059810	28	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x805624c	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x805a780	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x805a798	246	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x80591a0	70	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x805627c	111	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x805a2d8	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x805926c	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x805928c	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8059294	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x805929c	8	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80541a8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80584c4	49	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x80541c4	43	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x80566fc	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80592a4	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x805660c	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x805a5a8	148	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8057bcb	155	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80592ac	139	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8056590	27	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x80541f0	43	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x805675c	32	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x805aa4c	90	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x80562ec	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x805a3a4	37	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x80563b4	30	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x805a424	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8056318	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8054024	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x8059338	59	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x80542b4	43	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8054309	61	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80585d0	91	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x8054898	132	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x80584f8	100	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80579a0	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8057acc	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x805aa38	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x8058690	91	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x8054988	127	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x80593ec	129	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x8054384	47	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x805677c	92	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x80567d8	108	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x8054c18	52	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x8059374	39	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x805939c	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80544c1	108	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8056844	92	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80568a0	108	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8054530	31	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x805690c	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8057c66	161	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8053f8b	80	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8054550	97	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x8054c4c	32	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8056944	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8054c6c	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8057b2b	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x80545b4	70	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x805a3cc	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x805a3ec	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x805634c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x805634c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x805636c	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x805a4d8	45	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8056388	19	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x805639c	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x805a584	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x805a408	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x805a508	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x80563d4	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8056578	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x805a534	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8057d1c	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8057f70	523	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x80565ac	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x80545fc	16	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x80593dc	16	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x805460c	39	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x8054634	39	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x805a180	153	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8054c8c	172	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8059734	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8059790	128	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8059774	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8058630	91	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x805f804	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x805f804	0	OBJECT	<unknown>	DEFAULT	10
__app_fini	.symtab	0x80649c0	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x805fb08	24	OBJECT	<unknown>	DEFAULT	13
__bss_start	.symtab	0x805fb38	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8058ec3	44	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x804f7b4	104	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x8058580	80	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x805858a	27	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x805fb34	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x80649cc	4	OBJECT	<unknown>	HIDDEN	14
__deallocate_stack	.symtab	0x804d9fb	127	FUNC	<unknown>	HIDDEN	2
__default_stacksize	.symtab	0x805f92c	4	OBJECT	<unknown>	HIDDEN	13
__deregister_frame	.symtab	0x8053660	53	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x8053650	9	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x8053530	284	FUNC	<unknown>	HIDDEN	2
__dl_iterate_phdr	.symtab	0x8058db4	84	FUNC	<unknown>	DEFAULT	2
__do_global_ctors_aux	.symtab	0x805aab0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x805f820	0	OBJECT	<unknown>	HIDDEN	13
__environ	.symtab	0x80649b8	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x804d458	13	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x804f817	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x8063f2c	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0x8054040	83	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x805a2d8	204	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0x804d7f9	106	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x805f7f4	0	NOTYPE	<unknown>	HIDDEN	7
__fini_array_start	.symtab	0x805f7f4	0	NOTYPE	<unknown>	HIDDEN	7
__fork	.symtab	0x804d368	5	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x8064ba4	4	OBJECT	<unknown>	DEFAULT	14
__fork_generation_pointer	.symtab	0x8064f80	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x8064f84	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x8063f30	4	OBJECT	<unknown>	HIDDEN	14
__frame_state_for	.symtab	0x8051080	206	FUNC	<unknown>	HIDDEN	2
__free_stacks	.symtab	0x804d990	107	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0x804da7a	68	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480d0	0	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x80591e8	131	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x805a668	280	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80541a8	19	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x80584c4	49	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x805649c	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x805f7f4	0	NOTYPE	<unknown>	HIDDEN	7
__init_array_start	.symtab	0x805f7f4	0	NOTYPE	<unknown>	HIDDEN	7
__init_sched_fifo_prio	.symtab	0x804f99f	27	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x8064ba0	4	OBJECT	<unknown>	HIDDEN	14
__libc_accept	.symtab	0x805662c	84	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x8058580	80	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x80566a8	84	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x80586ec	86	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x8058742	79	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	7
__libc_fcntl	.symtab	0x8054093	153	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x805817c	524	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	7
__libc_longjmp	.symtab	0x805421c	54	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8054309	61	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80585d0	91	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x80583a8	28	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x8058690	91	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x805677c	92	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x80567d8	108	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_select	.symtab	0x80544c1	108	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8056844	92	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80568a0	108	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x80587ee	513	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8053f8b	80	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x805421c	54	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80649b4	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x8058630	91	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x80583c4	29	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x804f560	41	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x804f530	40	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x804f6a0	74	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x804f6f0	194	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x804f590	65	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x804f630	112	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake	.symtab	0x804f600	33	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private	.symtab	0x804f5e0	32	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x8059158	27	FUNC	<unknown>	DEFAULT	2
__make_stacks_executable	.symtab	0x804d89a	6	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x80575b1	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x805699c	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x805fa2c	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x8064c08	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x8057534	125	FUNC	<unknown>	DEFAULT	2
__nptl_create_event	.symtab	0x804fd9c	1	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x804d8a0	240	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x804fd9d	1	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x8061bec	1	OBJECT	<unknown>	DEFAULT	14
__nptl_last_event	.symtab	0x805fbdc	4	OBJECT	<unknown>	DEFAULT	14
__nptl_nthreads	.symtab	0x805f918	4	OBJECT	<unknown>	DEFAULT	13
__nptl_setxid	.symtab	0x804d582	372	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x805fbd4	8	OBJECT	<unknown>	DEFAULT	14
__open	.symtab	0x80585d0	91	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x80585da	33	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x80649bc	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x805f7f4	0	NOTYPE	<unknown>	HIDDEN	7
__preinit_array_start	.symtab	0x805f7f4	0	NOTYPE	<unknown>	HIDDEN	7
__progname	.symtab	0x805fb28	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x805fb2c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_cleanup_pop	.symtab	0x804fcaa	32	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x804fd1c	126	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x804fc88	34	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x804fccc	80	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0x804de33	1826	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x804f8fc	163	FUNC	<unknown>	HIDDEN	2
__pthread_disable_asynccancel	.symtab	0x804fbb8	86	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x804fc0e	79	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0x804e555	196	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x804fecb	858	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x804fecb	858	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x805fbe8	8192	OBJECT	<unknown>	DEFAULT	14
__pthread_mutex_lock	.symtab	0x804ee63	307	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x804ea64	1023	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x804ee63	307	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x804f3ba	14	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x804efe4	862	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x804f3ba	14	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x804f342	120	FUNC	<unknown>	HIDDEN	2
__pthread_once	.symtab	0x804f820	201	FUNC	<unknown>	PROTECTED	2
__pthread_once_internal	.symtab	0x804f820	201	FUNC	<unknown>	DEFAULT	2
__pthread_register_cancel	.symtab	0x804fc60	27	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8058e5c	3	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x804f9ba	446	FUNC	<unknown>	HIDDEN	2
__pthread_unregister_cancel	.symtab	0x804fc7b	10	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x804f3e4	67	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x804f427	8	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x8058690	91	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x805869a	33	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x804e619	433	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x80583e1	195	FUNC	<unknown>	DEFAULT	2
__register_frame	.symtab	0x8052dd0	55	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x8052550	28	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x80524b0	153	FUNC	<unknown>	HIDDEN	2
__register_frame_info_table	.symtab	0x8053740	28	FUNC	<unknown>	HIDDEN	2
__register_frame_info_table_bases	.symtab	0x80536a0	147	FUNC	<unknown>	HIDDEN	2
__register_frame_table	.symtab	0x8053760	46	FUNC	<unknown>	HIDDEN	2
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
__restore	.symtab	0x8053f83	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8053f7c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x80649c4	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_max_prio	.symtab	0x805f934	4	OBJECT	<unknown>	HIDDEN	13
__sched_fifo_min_prio	.symtab	0x805f930	4	OBJECT	<unknown>	HIDDEN	13
__set_robust_list_avail	.symtab	0x8064bb0	4	OBJECT	<unknown>	HIDDEN	14
__sigaction	.symtab	0x804d434	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x805696c	46	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x8053fdc	33	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8059174	43	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stack_user	.symtab	0x805fbc8	8	OBJECT	<unknown>	DEFAULT	14
__static_tls_align_m1	.symtab	0x8064ba8	4	OBJECT	<unknown>	HIDDEN	14
__static_tls_size	.symtab	0x8064bac	4	OBJECT	<unknown>	HIDDEN	14
__stdin	.symtab	0x805f94c	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x805a8a8	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x805982c	139	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x805a8e8	154	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x80598b8	232	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x805a984	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x805aa08	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x805a9ac	92	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x80599a0	154	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8055118	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x805f950	4	OBJECT	<unknown>	DEFAULT	13
__syscall_error	.symtab	0x804f8ec	15	FUNC	<unknown>	HIDDEN	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x80542e0	41	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x805412c	53	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x8054488	57	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x8058e8b	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8058eef	39	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8058f16	577	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x805fb24	4	OBJECT	<unknown>	HIDDEN	13
__wait_lookup_done	.symtab	0x804d6f6	259	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x8058630	91	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x805863a	33	FUNC	<unknown>	DEFAULT	2
__xidcmd	.symtab	0x8064bb4	4	OBJECT	<unknown>	HIDDEN	14
__xpg_strerror_r	.symtab	0x80564b8	191	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x80546ff	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x805465c	163	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x8063d44	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x8055140	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x8064bb8	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x8064be0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x805fa28	4	OBJECT	<unknown>	HIDDEN	13
_dl_add_to_slotinfo	.symtab	0x8058a1d	141	FUNC	<unknown>	DEFAULT	2
_dl_allocate_static_tls	.symtab	0x8058aaa	128	FUNC	<unknown>	HIDDEN	2
_dl_allocate_tls	.symtab	0x8058ce2	21	FUNC	<unknown>	DEFAULT	2
_dl_allocate_tls_init	.symtab	0x8058bb7	220	FUNC	<unknown>	DEFAULT	2
_dl_allocate_tls_storage	.symtab	0x8058c93	79	FUNC	<unknown>	HIDDEN	2
_dl_aux_init	.symtab	0x8058d5c	18	FUNC	<unknown>	DEFAULT	2
_dl_deallocate_tls	.symtab	0x8058b2a	94	FUNC	<unknown>	DEFAULT	2
_dl_get_tls_static_info	.symtab	0x8058a00	16	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x805fb20	4	OBJECT	<unknown>	DEFAULT	13
_dl_loaded_modules	.symtab	0x80649c8	4	OBJECT	<unknown>	DEFAULT	14
_dl_memalign	.symtab	0x8058a10	13	FUNC	<unknown>	DEFAULT	2
_dl_next_tls_modid	.symtab	0x8058cf7	101	FUNC	<unknown>	HIDDEN	2
_dl_nothread_init_static_tls	.symtab	0x8058d6e	68	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x8064fa8	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x8064fac	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x8064f9c	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x8064f98	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x8064fa0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x8064f90	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x80587be	48	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x8064f8c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x8064fa4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x8064f94	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x8064f88	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x805fb38	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8064fb0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x8054164	66	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x805aad7	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8061d44	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8055175	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8059bb8	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80480b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8059a3c	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_longjmp	.symtab	0x805421c	54	FUNC	<unknown>	DEFAULT	2
_longjmp_unwind	.symtab	0x805855c	23	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x80557d0	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x80559b5	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8055838	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8055874	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x805598c	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop	.symtab	0x804fcaa	32	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x804fd1c	126	FUNC	<unknown>	PROTECTED	2
_pthread_cleanup_push	.symtab	0x804fc88	34	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x804fccc	80	FUNC	<unknown>	PROTECTED	2
_res	.symtab	0x8063d54	468	OBJECT	<unknown>	HIDDEN	14
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x8054000	34	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x8048184	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8054d38	664	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x805500c	59	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x805f954	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x8061d24	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x8055e50	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x8061d40	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x8061d30	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x8061d3c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x805f95c	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x8055047	208	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x805f958	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x8057d34	278	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8059a94	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805bfc8	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_thread_db___nptl_last_event	.symtab	0x805ba1c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db___nptl_nthreads	.symtab	0x805ba10	12	OBJECT	<unknown>	DEFAULT	4
_thread_db___pthread_keys	.symtab	0x805ba28	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_dtv_dtv	.symtab	0x805ba7c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_dtv_t_pointer_val	.symtab	0x805ba88	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_link_map_l_tls_modid	.symtab	0x805ba70	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_list_t_next	.symtab	0x805b9d4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_list_t_prev	.symtab	0x805b9e0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_cancelhandling	.symtab	0x805b974	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_dtvp	.symtab	0x805ba94	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf	.symtab	0x805b9a4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf_eventmask	.symtab	0x805b9b0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf_eventmask_event_bits	.symtab	0x805b9bc	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_data	.symtab	0x805ba58	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_level2_data	.symtab	0x805ba64	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_seq	.symtab	0x805ba4c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_struct_destr	.symtab	0x805ba40	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_struct_seq	.symtab	0x805ba34	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_list	.symtab	0x805b944	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_nextevent	.symtab	0x805b9c8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_report_events	.symtab	0x805b950	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_schedparam_sched_priority	.symtab	0x805b98c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_schedpolicy	.symtab	0x805b980	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_specific	.symtab	0x805b998	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_start_routine	.symtab	0x805b968	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_tid	.symtab	0x805b95c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_register32_thread_area	.symtab	0x805baa0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_register64_thread_area	.symtab	0x805baac	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_eventbuf_t_eventdata	.symtab	0x805ba04	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_eventbuf_t_eventnum	.symtab	0x805b9f8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_thr_events_t_event_bits	.symtab	0x805b9ec	12	OBJECT	<unknown>	DEFAULT	4
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8059ad4	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x80551d3	1530	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80578d8	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x805662c	84	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_fdes	.symtab	0x8052b60	282	FUNC	<unknown>	DEFAULT	2
adds.6870	.symtab	0x805f938	8	OBJECT	<unknown>	DEFAULT	13
allocate_dtv	.symtab	0x8058b88	47	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8057d08	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8057d08	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x80486a0	109	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x8048630	101	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0x80494a0	1243	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x8048710	848	FUNC	<unknown>	DEFAULT	2
attack_kill_all	.symtab	0x8048270	326	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0x804ada0	1350	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x805fb80	32	OBJECT	<unknown>	DEFAULT	14
attack_parse	.symtab	0x80483c0	613	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x80481b0	192	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0x8048f00	1433	FUNC	<unknown>	DEFAULT	2
attack_tcp_legit	.symtab	0x8048a60	1183	FUNC	<unknown>	DEFAULT	2
attack_tcp_sack2	.symtab	0x8049ef0	1366	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0x8049980	1391	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_plain	.symtab	0x804a460	683	FUNC	<unknown>	DEFAULT	2
attack_udp_thread	.symtab	0x804ab30	615	FUNC	<unknown>	DEFAULT	2
attack_udp_vse	.symtab	0x804a710	896	FUNC	<unknown>	DEFAULT	2
base_from_cb_data	.symtab	0x80526e0	90	FUNC	<unknown>	DEFAULT	2
base_from_object	.symtab	0x8052740	90	FUNC	<unknown>	DEFAULT	2
base_of_encoded_value	.symtab	0x80505a0	107	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x8063f28	1	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x8056680	40	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x805a63c	44	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
calloc	.symtab	0x805714c	236	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
change_stack_perm	.symtab	0x804d863	55	FUNC	<unknown>	DEFAULT	2
check_list.6872	.symtab	0x804d4a9	29	FUNC	<unknown>	DEFAULT	2
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x804b2f0	70	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x804b340	169	FUNC	<unknown>	DEFAULT	2
classify_object_over_fdes	.symtab	0x8052c80	329	FUNC	<unknown>	DEFAULT	2
cleanup	.symtab	0x804e94c	26	FUNC	<unknown>	DEFAULT	2
cleanup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cleanup_compat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cleanup_defer_compat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock	.symtab	0x8054a08	34	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clone	.symtab	0x804f7b4	104	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x8058580	80	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x805478c	130	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4963	.symtab	0x805fb40	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x80566a8	84	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
default_attr	.symtab	0x805bab8	32	OBJECT	<unknown>	DEFAULT	4
dl-core.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-iterate-phdr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl_iterate_phdr	.symtab	0x8058e08	84	FUNC	<unknown>	DEFAULT	2
do_clone	.symtab	0x804dcfe	309	FUNC	<unknown>	DEFAULT	2
dwarf_reg_size_table	.symtab	0x8061bf4	18	OBJECT	<unknown>	DEFAULT	14
entries	.symtab	0x8064a20	4	OBJECT	<unknown>	DEFAULT	14
environ	.symtab	0x80649b8	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	7
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
events.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execute_cfa_program	.symtab	0x8050700	1307	FUNC	<unknown>	DEFAULT	2
execute_stack_op	.symtab	0x8051150	1607	FUNC	<unknown>	DEFAULT	2
exit	.symtab	0x8057e4c	93	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x805d2c0	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8054a2c	380	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x8054093	153	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x805f908	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x805f90c	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x8054810	136	FUNC	<unknown>	DEFAULT	2
fde_mixed_encoding_compare	.symtab	0x8053790	146	FUNC	<unknown>	DEFAULT	2
fde_single_encoding_compare	.symtab	0x8052880	122	FUNC	<unknown>	DEFAULT	2
fde_unencoded_compare	.symtab	0x8052570	28	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x805491c	108	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8055f90	447	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x805a230	145	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x805a2d8	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8055dc4	118	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80561ec	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
first_connect	.symtab	0x805fba0	4	OBJECT	<unknown>	DEFAULT	14
fmt	.symtab	0x805d2a0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8054c00	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804d368	5	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x8063f34	1348	OBJECT	<unknown>	DEFAULT	14
fprintf	.symtab	0x8059810	28	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x805624c	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_downheap	.symtab	0x8052590	177	FUNC	<unknown>	DEFAULT	2
frame_dummy	.symtab	0x8048130	0	FUNC	<unknown>	DEFAULT	2
frame_hdr_cache	.symtab	0x8061c60	192	OBJECT	<unknown>	DEFAULT	14
frame_hdr_cache_head	.symtab	0x8061d20	4	OBJECT	<unknown>	DEFAULT	14
frame_heapsort	.symtab	0x8052650	139	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x805772c	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x805a780	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x805a780	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x805a798	246	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x80591a0	70	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x805627c	111	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_cie_encoding	.symtab	0x8052900	186	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x805a230	145	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x805a2d8	204	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x805926c	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x805928c	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8059294	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x805929c	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x80541a8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80584c4	49	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x80541bc	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x80541c4	43	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x80566fc	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8056724	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80592a4	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x8	4	TLS	<unknown>	DEFAULT	7
httpd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
httpd_pid	.symtab	0x805f828	4	OBJECT	<unknown>	DEFAULT	13
httpd_port	.symtab	0x805fba8	4	OBJECT	<unknown>	DEFAULT	14
httpd_serve	.symtab	0x804b450	552	FUNC	<unknown>	DEFAULT	2
httpd_start	.symtab	0x804b680	456	FUNC	<unknown>	DEFAULT	2
httpd_started	.symtab	0x805fbac	4	OBJECT	<unknown>	DEFAULT	14
id_buf	.symtab	0x8064a00	32	OBJECT	<unknown>	DEFAULT	14
in_flight_stack	.symtab	0x805fbe4	4	OBJECT	<unknown>	DEFAULT	14
index	.symtab	0x805a3cc	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x805660c	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x805a5a8	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_dwarf_reg_size_table	.symtab	0x8050610	129	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x8058794	42	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initialized.6260	.symtab	0x8061be8	4	OBJECT	<unknown>	DEFAULT	14
initstate	.symtab	0x8057a39	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8057bcb	155	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80592ac	139	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8056590	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
jmp-unwind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x80541f0	43	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_malware	.symtab	0x804b850	312	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x804b990	50	FUNC	<unknown>	DEFAULT	2
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc_pthread_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
linear_search_fdes	.symtab	0x8052a20	306	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x805675c	32	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lockdown	.symtab	0x80649e8	4	OBJECT	<unknown>	DEFAULT	14
locker.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
locker_condi	.symtab	0x804b9d0	439	FUNC	<unknown>	DEFAULT	2
locker_init	.symtab	0x804bb90	28	FUNC	<unknown>	DEFAULT	2
longjmp	.symtab	0x805421c	54	FUNC	<unknown>	DEFAULT	2
longjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x805aa4c	90	FUNC	<unknown>	DEFAULT	2
madvise	.symtab	0x8054254	47	FUNC	<unknown>	DEFAULT	2
madvise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
main	.symtab	0x804bc40	2937	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
main_pid	.symtab	0x8064a24	4	OBJECT	<unknown>	DEFAULT	14
malloc	.symtab	0x80569c2	1928	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x80578bb	29	FUNC	<unknown>	DEFAULT	2
marker.6373	.symtab	0x8061c38	4	OBJECT	<unknown>	DEFAULT	14
memcpy	.symtab	0x80562ec	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x805a3a4	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x80563b4	30	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x805a424	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8056318	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
methods	.symtab	0x805fb60	4	OBJECT	<unknown>	DEFAULT	14
methods_len	.symtab	0x805fb5c	1	OBJECT	<unknown>	DEFAULT	14
mmap	.symtab	0x8054024	27	FUNC	<unknown>	DEFAULT	2
mprotect	.symtab	0x8054284	47	FUNC	<unknown>	DEFAULT	2
mprotect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x8059338	59	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x80542b4	43	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x805fa44	24	OBJECT	<unknown>	DEFAULT	13
mylock	.symtab	0x805fa5c	24	OBJECT	<unknown>	DEFAULT	13
nanosleep	.symtab	0x8054309	61	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x8063d50	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x8057eac	196	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
object.4975	.symtab	0x805fb44	24	OBJECT	<unknown>	DEFAULT	14
object_mutex	.symtab	0x8061c20	24	OBJECT	<unknown>	DEFAULT	14
once_regsizes.7294	.symtab	0x8061bf0	4	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x80585d0	91	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x8054898	132	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.4961	.symtab	0x805f824	0	OBJECT	<unknown>	DEFAULT	13
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
parse_request	.symtab	0x804b3f0	95	FUNC	<unknown>	DEFAULT	2
pending_connection	.symtab	0x805fbb0	1	OBJECT	<unknown>	DEFAULT	14
pgid	.symtab	0x805fbb4	4	OBJECT	<unknown>	DEFAULT	14
prctl	.symtab	0x8054348	59	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6454	.symtab	0x805bf20	12	OBJECT	<unknown>	DEFAULT	4
program_invocation_name	.symtab	0x805fb2c	4	OBJECT	<unknown>	DEFAULT	13
program_invocation_short_name	.symtab	0x805fb28	4	OBJECT	<unknown>	DEFAULT	13
pseudo_cancel	.symtab	0x80585a5	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x80585fb	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805865b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x80586bb	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80585cf	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805862a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805868a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80586ea	0	NOTYPE	<unknown>	DEFAULT	2
pt-__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_cancel	.symtab	0x8050228	152	FUNC	<unknown>	DEFAULT	2
pthread_cancel.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_create	.symtab	0x804de33	1826	FUNC	<unknown>	DEFAULT	2
pthread_create.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_getspecific.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_join	.symtab	0x804e966	252	FUNC	<unknown>	DEFAULT	2
pthread_join.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_key_create.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_key_delete.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_lock	.symtab	0x804ee63	307	FUNC	<unknown>	DEFAULT	2
pthread_mutex_lock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_trylock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_unlock	.symtab	0x804f3ba	14	FUNC	<unknown>	DEFAULT	2
pthread_mutex_unlock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_once	.symtab	0x804f820	201	FUNC	<unknown>	DEFAULT	2
pthread_setspecific.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.6463	.symtab	0x805bf34	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x80584f8	100	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8057998	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_init	.symtab	0x804c800	63	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x804c7c0	64	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x804c840	218	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80579a0	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x805cb24	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8057acc	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x805fa88	128	OBJECT	<unknown>	DEFAULT	13
rawmemchr	.symtab	0x805aa38	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x8058690	91	FUNC	<unknown>	DEFAULT	2
read_encoded_value_with_base	.symtab	0x80504c0	213	FUNC	<unknown>	DEFAULT	2
read_encoded_value_with_base	.symtab	0x80527a0	213	FUNC	<unknown>	DEFAULT	2
read_sleb128	.symtab	0x8050300	109	FUNC	<unknown>	DEFAULT	2
read_sleb128	.symtab	0x8052440	109	FUNC	<unknown>	DEFAULT	2
read_uleb128	.symtab	0x80502c0	59	FUNC	<unknown>	DEFAULT	2
read_uleb128	.symtab	0x8052400	59	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x8054988	127	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x80593ec	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x8054384	47	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8057238	763	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x805677c	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x80567d8	108	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
remove	.symtab	0x8054c18	52	FUNC	<unknown>	DEFAULT	2
remove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
res_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_entries_free	.symtab	0x804c920	52	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x804c960	1192	FUNC	<unknown>	DEFAULT	2
resolve_cnc_addr	.symtab	0x804bbb0	135	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x805f910	4	OBJECT	<unknown>	DEFAULT	13
rindex	.symtab	0x805a408	26	FUNC	<unknown>	DEFAULT	2
rmdir	.symtab	0x8059374	39	FUNC	<unknown>	DEFAULT	2
rmdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sbrk	.symtab	0x805939c	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_get_priority_max	.symtab	0x80543b4	39	FUNC	<unknown>	DEFAULT	2
sched_get_priority_max.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_get_priority_min	.symtab	0x80543dc	39	FUNC	<unknown>	DEFAULT	2
sched_get_priority_min.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_getparam	.symtab	0x8054404	43	FUNC	<unknown>	DEFAULT	2
sched_getparam.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_getscheduler	.symtab	0x8054430	39	FUNC	<unknown>	DEFAULT	2
sched_getscheduler.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_setscheduler	.symtab	0x8054458	47	FUNC	<unknown>	DEFAULT	2
sched_setscheduler.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
search_object	.symtab	0x8052e10	1817	FUNC	<unknown>	DEFAULT	2
seen_objects	.symtab	0x8061c4c	4	OBJECT	<unknown>	DEFAULT	14

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-13:38:03.929975	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41224	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:40.403386	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41256	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:36.955046	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41234	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:44.890676	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41236	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:00.861893	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41222	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:10.867035	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41226	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:35.429299	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41254	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:47.413449	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41258	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:03.660136	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41244	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:15.539783	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41248	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:22.046469	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41228	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:30.469863	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41252	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:58.346348	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41262	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:26.000293	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41230	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:35.007261	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41232	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:47.814770	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41238	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:00.718254	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41242	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:26.498730	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41250	42597	192.168.2.23	14.225.219.252
04/25/24-13:38:57.764755	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41240	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:54.386335	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41260	42597	192.168.2.23	14.225.219.252
04/25/24-13:39:10.588082	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	41246	42597	192.168.2.23	14.225.219.252

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 13:37:59.910603046 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 13:38:00.443023920 CEST	41222	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:00.861777067 CEST	42597	41222	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:00.861845016 CEST	41222	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:00.861892939 CEST	41222	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:01.282907963 CEST	42597	41222	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:01.283236027 CEST	42597	41222	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:03.516498089 CEST	41224	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:03.929753065 CEST	42597	41224	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:03.929898977 CEST	41224	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:03.929975033 CEST	41224	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:04.342967033 CEST	42597	41224	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:04.343058109 CEST	42597	41224	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:04.343394995 CEST	41224	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:04.756227970 CEST	42597	41224	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:05.541802883 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 13:38:05.541817904 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 25, 2024 13:38:10.454857111 CEST	41226	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:10.866894007 CEST	42597	41226	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:10.866926908 CEST	42597	41226	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:10.866986990 CEST	41226	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:10.866986990 CEST	41226	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:10.867034912 CEST	41226	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:11.278752089 CEST	42597	41226	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:11.278789043 CEST	42597	41226	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:21.155790091 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 13:38:21.633574009 CEST	41228	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:22.046236038 CEST	42597	41228	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:22.046468973 CEST	41228	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:22.046468973 CEST	41228	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:22.458568096 CEST	42597	41228	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:22.458587885 CEST	42597	41228	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:22.458647013 CEST	42597	41228	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:25.569555044 CEST	41230	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:26.000082016 CEST	42597	41230	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:26.000292063 CEST	41230	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:26.000293016 CEST	41230	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:26.430485964 CEST	42597	41230	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:26.430587053 CEST	42597	41230	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:31.394277096 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 13:38:34.587204933 CEST	41232	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:35.007010937 CEST	42597	41232	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:35.007164001 CEST	41232	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:35.007261038 CEST	41232	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:35.426433086 CEST	42597	41232	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:35.426506042 CEST	42597	41232	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:35.489676952 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 25, 2024 13:38:35.546806097 CEST	42597	41232	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:36.537278891 CEST	41234	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:36.954863071 CEST	42597	41234	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:36.954994917 CEST	41234	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:36.955045938 CEST	41234	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:37.372308016 CEST	42597	41234	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:37.372343063 CEST	42597	41234	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:44.484528065 CEST	41236	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:44.890461922 CEST	42597	41236	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:44.890614986 CEST	41236	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:44.890676022 CEST	41236	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:45.296185970 CEST	42597	41236	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:45.296242952 CEST	42597	41236	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:47.407022953 CEST	41238	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:47.814589977 CEST	42597	41238	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:47.814769983 CEST	41238	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:47.814769983 CEST	41238	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:48.220271111 CEST	42597	41238	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:48.220362902 CEST	42597	41238	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:57.346262932 CEST	41240	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:57.764545918 CEST	42597	41240	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:57.764676094 CEST	41240	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:57.764755011 CEST	41240	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:58.182096004 CEST	42597	41240	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:58.182404041 CEST	42597	41240	14.225.219.252	192.168.2.23
Apr 25, 2024 13:38:58.182522058 CEST	41240	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:38:58.600080013 CEST	42597	41240	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:00.293169022 CEST	41242	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:00.718089104 CEST	42597	41242	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:00.718143940 CEST	42597	41242	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:00.718252897 CEST	41242	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:00.718254089 CEST	41242	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:00.718254089 CEST	41242	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:01.143079042 CEST	42597	41242	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:01.143161058 CEST	42597	41242	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:01.143311024 CEST	41242	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:01.568130016 CEST	42597	41242	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:02.110045910 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 13:39:03.253829002 CEST	41244	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:03.659867048 CEST	42597	41244	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:03.660068035 CEST	41244	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:03.660135984 CEST	41244	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:04.065907001 CEST	42597	41244	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:04.066000938 CEST	42597	41244	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:04.066128969 CEST	41244	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:04.472594023 CEST	42597	41244	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:10.176374912 CEST	41246	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:10.587874889 CEST	42597	41246	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:10.588023901 CEST	41246	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:10.588082075 CEST	41246	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:10.999387980 CEST	42597	41246	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:10.999414921 CEST	42597	41246	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:10.999538898 CEST	41246	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:11.410777092 CEST	42597	41246	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:15.110060930 CEST	41248	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:15.539551020 CEST	42597	41248	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:15.539783001 CEST	41248	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:15.539783001 CEST	41248	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:15.968991041 CEST	42597	41248	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:15.969156027 CEST	42597	41248	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:15.969393015 CEST	41248	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:16.398567915 CEST	42597	41248	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:22.587213993 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 13:39:26.078918934 CEST	41250	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:26.498586893 CEST	42597	41250	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:26.498728991 CEST	41250	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:26.498729944 CEST	41250	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:26.918256044 CEST	42597	41250	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:26.918361902 CEST	42597	41250	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:26.918478012 CEST	41250	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:27.337647915 CEST	42597	41250	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:30.033231020 CEST	41252	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:30.469657898 CEST	42597	41252	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:30.469862938 CEST	41252	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:30.469862938 CEST	41252	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:30.905545950 CEST	42597	41252	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:30.905703068 CEST	42597	41252	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:30.905836105 CEST	41252	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:31.341249943 CEST	42597	41252	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:35.016341925 CEST	41254	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:35.429116964 CEST	42597	41254	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:35.429299116 CEST	41254	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:35.429299116 CEST	41254	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:35.841000080 CEST	42597	41254	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:35.841099977 CEST	42597	41254	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:35.841291904 CEST	41254	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:36.252886057 CEST	42597	41254	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:39.952001095 CEST	41256	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:40.403172016 CEST	42597	41256	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:40.403322935 CEST	41256	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:40.403386116 CEST	41256	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:40.854434013 CEST	42597	41256	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:40.854491949 CEST	42597	41256	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:40.854644060 CEST	41256	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:41.305190086 CEST	42597	41256	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:46.964754105 CEST	41258	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:47.413291931 CEST	42597	41258	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:47.413341999 CEST	42597	41258	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:47.413449049 CEST	41258	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:47.413449049 CEST	41258	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:47.413449049 CEST	41258	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:47.861876011 CEST	42597	41258	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:47.861905098 CEST	42597	41258	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:47.862061024 CEST	41258	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:48.310343027 CEST	42597	41258	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:53.972207069 CEST	41260	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:54.386193037 CEST	42597	41260	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:54.386334896 CEST	41260	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:54.386334896 CEST	41260	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:54.799911022 CEST	42597	41260	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:54.799967051 CEST	42597	41260	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:54.800085068 CEST	41260	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:55.213727951 CEST	42597	41260	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:57.910461903 CEST	41262	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:58.346168995 CEST	42597	41262	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:58.346348047 CEST	41262	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:58.346348047 CEST	41262	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:58.781909943 CEST	42597	41262	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:58.782016039 CEST	42597	41262	14.225.219.252	192.168.2.23
Apr 25, 2024 13:39:58.782131910 CEST	41262	42597	192.168.2.23	14.225.219.252
Apr 25, 2024 13:39:59.217670918 CEST	42597	41262	14.225.219.252	192.168.2.23
Apr 25, 2024 13:40:06.892128944 CEST	41264	42597	192.168.2.23	14.225.219.252

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 13:38:00.323928118 CEST	57479	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:00.442882061 CEST	53	57479	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:03.283171892 CEST	55634	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:03.516320944 CEST	53	55634	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:10.342489958 CEST	33620	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:10.453058958 CEST	53	33620	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:21.277717113 CEST	51095	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:21.633260965 CEST	53	51095	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:25.458525896 CEST	47575	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:25.569289923 CEST	53	47575	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:34.429682016 CEST	35483	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:34.587060928 CEST	53	35483	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:36.426568985 CEST	47798	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:36.537137985 CEST	53	47798	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:44.371654034 CEST	42652	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:44.484380007 CEST	53	42652	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:47.296294928 CEST	33980	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:47.406867981 CEST	53	33980	8.8.8.8	192.168.2.23
Apr 25, 2024 13:38:57.219362974 CEST	43966	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:38:57.346086979 CEST	53	43966	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:00.182384968 CEST	50135	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:00.293035030 CEST	53	50135	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:03.143153906 CEST	53726	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:03.253674984 CEST	53	53726	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:10.065421104 CEST	52409	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:10.176228046 CEST	53	52409	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:14.999279022 CEST	59267	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:15.109803915 CEST	53	59267	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:25.968039989 CEST	41239	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:26.078762054 CEST	53	41239	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:29.918534994 CEST	40172	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:30.033102989 CEST	53	40172	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:34.905445099 CEST	38409	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:35.016129017 CEST	53	38409	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:39.840878963 CEST	53274	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:39.951806068 CEST	53	53274	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:46.853976965 CEST	44905	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:46.964602947 CEST	53	44905	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:53.861346006 CEST	46941	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:53.972059965 CEST	53	46941	8.8.8.8	192.168.2.23
Apr 25, 2024 13:39:57.799801111 CEST	38546	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:39:57.910298109 CEST	53	38546	8.8.8.8	192.168.2.23
Apr 25, 2024 13:40:06.781186104 CEST	33499	53	192.168.2.23	8.8.8.8
Apr 25, 2024 13:40:06.891877890 CEST	53	33499	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 13:38:00.323928118 CEST	192.168.2.23	8.8.8.8	0x360a	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:03.283171892 CEST	192.168.2.23	8.8.8.8	0xb304	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:10.342489958 CEST	192.168.2.23	8.8.8.8	0xe31d	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:21.277717113 CEST	192.168.2.23	8.8.8.8	0x6900	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:25.458525896 CEST	192.168.2.23	8.8.8.8	0xd4ef	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:34.429682016 CEST	192.168.2.23	8.8.8.8	0x8902	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:36.426568985 CEST	192.168.2.23	8.8.8.8	0x74e0	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:44.371654034 CEST	192.168.2.23	8.8.8.8	0xfd69	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:47.296294928 CEST	192.168.2.23	8.8.8.8	0xe8ea	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:57.219362974 CEST	192.168.2.23	8.8.8.8	0x99b6	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:00.182384968 CEST	192.168.2.23	8.8.8.8	0xae69	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:03.143153906 CEST	192.168.2.23	8.8.8.8	0xa930	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:10.065421104 CEST	192.168.2.23	8.8.8.8	0x590d	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:14.999279022 CEST	192.168.2.23	8.8.8.8	0x8ad3	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:25.968039989 CEST	192.168.2.23	8.8.8.8	0x9bb8	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:29.918534994 CEST	192.168.2.23	8.8.8.8	0x7510	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:34.905445099 CEST	192.168.2.23	8.8.8.8	0xaf3f	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:39.840878963 CEST	192.168.2.23	8.8.8.8	0x314d	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:46.853976965 CEST	192.168.2.23	8.8.8.8	0x99c6	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:53.861346006 CEST	192.168.2.23	8.8.8.8	0x4e14	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:57.799801111 CEST	192.168.2.23	8.8.8.8	0xe9ad	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:40:06.781186104 CEST	192.168.2.23	8.8.8.8	0x30c6	Standard query (0)	legendsworld.cloud	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 13:38:00.442882061 CEST	8.8.8.8	192.168.2.23	0x360a	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:03.516320944 CEST	8.8.8.8	192.168.2.23	0xb304	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:10.453058958 CEST	8.8.8.8	192.168.2.23	0xe31d	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:21.633260965 CEST	8.8.8.8	192.168.2.23	0x6900	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:25.569289923 CEST	8.8.8.8	192.168.2.23	0xd4ef	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:34.587060928 CEST	8.8.8.8	192.168.2.23	0x8902	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:36.537137985 CEST	8.8.8.8	192.168.2.23	0x74e0	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:44.484380007 CEST	8.8.8.8	192.168.2.23	0xfd69	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:47.406867981 CEST	8.8.8.8	192.168.2.23	0xe8ea	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:38:57.346086979 CEST	8.8.8.8	192.168.2.23	0x99b6	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:00.293035030 CEST	8.8.8.8	192.168.2.23	0xae69	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:03.253674984 CEST	8.8.8.8	192.168.2.23	0xa930	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:10.176228046 CEST	8.8.8.8	192.168.2.23	0x590d	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:15.109803915 CEST	8.8.8.8	192.168.2.23	0x8ad3	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:26.078762054 CEST	8.8.8.8	192.168.2.23	0x9bb8	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:30.033102989 CEST	8.8.8.8	192.168.2.23	0x7510	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:35.016129017 CEST	8.8.8.8	192.168.2.23	0xaf3f	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:39.951806068 CEST	8.8.8.8	192.168.2.23	0x314d	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:46.964602947 CEST	8.8.8.8	192.168.2.23	0x99c6	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:53.972059965 CEST	8.8.8.8	192.168.2.23	0x4e14	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:39:57.910298109 CEST	8.8.8.8	192.168.2.23	0xe9ad	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:40:06.891877890 CEST	8.8.8.8	192.168.2.23	0x30c6	No error (0)	legendsworld.cloud	14.225.219.252	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: vlxx.x86.elf PID: 6249, Parent PID: 6173

General

Start time (UTC):	11:37:59
Start date (UTC):	25/04/2024
Path:	/tmp/vlxx.x86.elf
Arguments:	/tmp/vlxx.x86.elf
File size:	192060 bytes
MD5 hash:	aeee41fcd4a3875eee78dc08f5b8395c

Start time (UTC):	11:37:59
Start date (UTC):	25/04/2024
Path:	/tmp/vlxx.x86.elf
Arguments:	-
File size:	192060 bytes
MD5 hash:	aeee41fcd4a3875eee78dc08f5b8395c

Start time (UTC):	11:37:59
Start date (UTC):	25/04/2024
Path:	/tmp/vlxx.x86.elf
Arguments:	-
File size:	192060 bytes
MD5 hash:	aeee41fcd4a3875eee78dc08f5b8395c

Start time (UTC):	11:37:59
Start date (UTC):	25/04/2024
Path:	/tmp/vlxx.x86.elf
Arguments:	-
File size:	192060 bytes
MD5 hash:	aeee41fcd4a3875eee78dc08f5b8395c

Start time (UTC):	11:38:01
Start date (UTC):	25/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:38:01
Start date (UTC):	25/04/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.HhXoQJ6qvF /tmp/tmp.1ShZs8Egih /tmp/tmp.YspoCjn62m
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	11:38:01
Start date (UTC):	25/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:38:01
Start date (UTC):	25/04/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.HhXoQJ6qvF /tmp/tmp.1ShZs8Egih /tmp/tmp.YspoCjn62m
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vlxx.x86.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: vlxx.x86.elf PID: 6249, Parent PID: 6173

General

Chronological Activities

Analysis Process: vlxx.x86.elf PID: 6250, Parent PID: 6249

General

Chronological Activities

Analysis Process: vlxx.x86.elf PID: 6251, Parent PID: 6250

General

Chronological Activities

Analysis Process: vlxx.x86.elf PID: 6252, Parent PID: 6250

General

Chronological Activities

Analysis Process: dash PID: 6254, Parent PID: 4331

General

Chronological Activities

Linux Analysis Report
vlxx.x86.elf