Edit tour

Linux Analysis Report
armv4l.elf

Overview

General Information

Sample name:	armv4l.elf
Analysis ID:	1597834
MD5:	7ac95846e616db9270429042626fb6eb
SHA1:	971a1a48fb0128be14125216135c796d28c47785
SHA256:	8d51dfdc4738b2b620434e28a94135adeaf3d7d7ed50f1af34f099b786a7d151
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1597834
Start date and time:	2025-01-23 18:15:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	armv4l.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/armv4l.elf
PID:	5548
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

armv4l.elf (PID: 5548, Parent: 5466, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/armv4l.elf

armv4l.elf New Fork (PID: 5550, Parent: 5548)

armv4l.elf New Fork (PID: 5551, Parent: 5548)

armv4l.elf New Fork (PID: 5554, Parent: 5551)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
armv4l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
armv4l.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
armv4l.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5550.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5550.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5548.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5548.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5551.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5551.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: armv4l.elf PID: 5548	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: armv4l.elf PID: 5548	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13549:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1355d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13571:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13585:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13599:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13611:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13625:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13639:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1364d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13661:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13675:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13689:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1369d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x136b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x136c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x136d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: armv4l.elf PID: 5550	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: armv4l.elf PID: 5550	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x195a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x196e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1982:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1996:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: armv4l.elf PID: 5551	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: armv4l.elf PID: 5551	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5746:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x575a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x576e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5782:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5796:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x580e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5822:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5836:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x584a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x585e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5872:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5886:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x589a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: armv4l.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: armv4l.elf	Virustotal: Detection: 65%			Perma Link
Source: armv4l.elf	ReversingLabs: Detection: 68%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/armv4l.elf (PID: 5548)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.15:45658 -> 37.114.46.230:616

Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	TCP traffic detected without corresponding DNS query: 37.114.46.230
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: armv4l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5550.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5548.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5551.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: armv4l.elf PID: 5548, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: armv4l.elf PID: 5550, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: armv4l.elf PID: 5551, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: armv4l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5550.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5548.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5551.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: armv4l.elf PID: 5548, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: armv4l.elf PID: 5550, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: armv4l.elf PID: 5551, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@2/0

Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/armv4l.elf (PID: 5548)

Queries kernel information via 'uname':

Jump to behavior

Source: armv4l.elf, 5548.1.000055c48d594000.000055c48d6e3000.rw-.sdmp, armv4l.elf, 5550.1.000055c48d594000.000055c48d6e3000.rw-.sdmp, armv4l.elf, 5551.1.000055c48d594000.000055c48d6e3000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: armv4l.elf, 5548.1.00007ffd92834000.00007ffd92855000.rw-.sdmp, armv4l.elf, 5550.1.00007ffd92834000.00007ffd92855000.rw-.sdmp, armv4l.elf, 5551.1.00007ffd92834000.00007ffd92855000.rw-.sdmp	Binary or memory string: tx86_64/usr/bin/qemu-arm/tmp/armv4l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv4l.elf
Source: armv4l.elf, 5548.1.000055c48d594000.000055c48d6e3000.rw-.sdmp, armv4l.elf, 5550.1.000055c48d594000.000055c48d6e3000.rw-.sdmp, armv4l.elf, 5551.1.000055c48d594000.000055c48d6e3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: armv4l.elf, 5548.1.00007ffd92834000.00007ffd92855000.rw-.sdmp, armv4l.elf, 5550.1.00007ffd92834000.00007ffd92855000.rw-.sdmp, armv4l.elf, 5551.1.00007ffd92834000.00007ffd92855000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: armv4l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv4l.elf, type: SAMPLE
Source: Yara match	File source: 5550.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5548.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5551.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5550, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5551, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: armv4l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv4l.elf, type: SAMPLE
Source: Yara match	File source: 5550.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5548.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5551.1.00007ff9f4017000.00007ff9f402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5550, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5551, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
armv4l.elf	65%	Virustotal		Browse
armv4l.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
armv4l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
37.114.46.230	unknown	Germany		44066	DE-FIRSTCOLOwwwfirst-colonetDE	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
37.114.46.230	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	37.114.46.230-sparc-2025-01-23T05_56_53.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	telnet.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	b0JFmbQbZ6	Get hash	malicious	Unknown	Browse	162.213.35.25
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DE-FIRSTCOLOwwwfirst-colonetDE	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230
	37.114.46.230-sparc-2025-01-23T05_56_53.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.114.46.230

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	6.061117004372924
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	armv4l.elf
File size:	129'899 bytes
MD5:	7ac95846e616db9270429042626fb6eb
SHA1:	971a1a48fb0128be14125216135c796d28c47785
SHA256:	8d51dfdc4738b2b620434e28a94135adeaf3d7d7ed50f1af34f099b786a7d151
SHA512:	d16ef66707bb697ff6898667c9b8f7597e43b0301540dac8ab26faac8584adf57cb07a1457972c4c874e771647366df56057aea179ad7543fa872d626cfc554d
SSDEEP:	3072:6jVlyaL5JCrIpv04sJbstiEiJmP46aQyfPluesNb:yoCJCN4sJb8YmP46aQyfPluesNb
TLSH:	5EC3F730E8044B1BC2D223F6A75A469E3F351E9797E733115A387DB06FF27992E29520
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................e...e...............e...e...e..@....h..........Q.td..................................-...L."....H..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	100108
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x1204c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1a0fc	0x120fc	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1a110	0x12110	0x4490	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1e5a0	0x165a0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x265a4	0x165a4	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x265ac	0x165ac	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x265b4	0x165b4	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x265b8	0x165b8	0x42c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x269e4	0x169e4	0x6458	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x169e4	0xbd4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x175b8	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x176d8	0x578	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x17c50	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x17d04	0x8bd	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x185c4	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x18664	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x18a2c	0x4a00	0x10	0x0		19	647	4
.strtab	STRTAB	0x0	0x1d42c	0x273f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x165a4	0x165a4	6.1609	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x165a4	0x265a4	0x265a4	0x440	0x6898	3.1123	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1a0fc	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1a110	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1e5a0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x265a4	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x265ac	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x265b4	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x265b8	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x269e4	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a0fc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a108	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a10c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x884c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x979c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1173c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1195c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1260c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1318c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1326c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1348c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1358c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1399c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1409c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1439c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1453c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1489c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1519c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1529c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1534c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1556c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1584c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1599c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1672c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1759c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1771c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x186e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1927c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1941c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a06c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x265a4	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x265ac	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x265c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x265c4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x265c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8774	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x89ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8adc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x978c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x991c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae04	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x9a6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa02c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc48c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf3a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf51c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2667c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x10318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10690	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26680	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x26688	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26690	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1d548	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x125f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13264	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13928	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13be4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x267cc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x13ed8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14388	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x268d4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1448c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x268ec	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14704	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e174	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269a0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14b6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15194	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1531c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2cc54	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x15380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1bc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1752c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1756c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x186e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19154	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x191d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.151.5663	.symtab	0x1c524	40	OBJECT	<unknown>	DEFAULT	4
C.182.5957	.symtab	0x1c590	16	OBJECT	<unknown>	DEFAULT	4
C.183.5958	.symtab	0x1c564	20	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x26a00	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x2666c	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x2cc7c	4	OBJECT	<unknown>	DEFAULT	10
Laligned	.symtab	0x12f78	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x12f94	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x26a1c	16384	OBJECT	<unknown>	DEFAULT	10
UserAgents	.symtab	0x265dc	144	OBJECT	<unknown>	DEFAULT	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x265a8	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x265a4	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x26680	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1cf48	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x269d8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1e2a0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x26688	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1d248	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x265b0	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x265ac	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1e5a0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1e5a0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x26680	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1cf48	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x269d8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1e2a0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x26688	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1d248	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x26684	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x269dc	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x2668c	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x11cbc	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13364	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x15378	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x117c0	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x11834	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x11ab0	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14d60	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14e10	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x13378	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x11884	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x14250	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1489c	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x1489c	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17534	60	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x118d8	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13944	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x11904	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2cc54	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x14adc	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x151ec	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x14a48	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1759c	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x117c0	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x11834	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17e2c	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17c58	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x18010	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1771c	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x11930	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12d88	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17728	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17734	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12dbc	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1195c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15218	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x11984	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x15244	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1358c	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x135d0	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x119b0	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11a08	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x13970	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x15270	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2cc58	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x13568	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x168e4	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x186e8	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x18374	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x147d4	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11a34	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1346c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11a84	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18f90	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16630	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x12e80	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x16620	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1672c	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16744	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x12e90	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1529c	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x11ab0	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x11b1c	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x17570	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x174f8	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1439c	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x14678	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x180a8	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x11b78	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x139cc	44	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x139f8	52	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x152c8	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11ba4	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13a2c	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13a58	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13a8c	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x145b8	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x150b8	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x13ae8	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x13b18	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13b30	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11bd4	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14b70	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13abc	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11cfc	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x14708	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x19158	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x12fb0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x12f30	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x12f30	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x130b8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x18278	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x12f50	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x18160	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x130d4	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1318c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x168a4	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x18228	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1326c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13460	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16830	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x148a8	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1348c	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11c28	44	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x15320	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x18ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11c88	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x11790	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11d30	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1534c	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11c54	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x15384	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x153f4	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x153d4	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x11c5c	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x265b4	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x265b4	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x19624	736	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmpeq	.symtab	0x19ff4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmple	.symtab	0x19ff4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdrcmple	.symtab	0x19fd8	48	FUNC	<unknown>	DEFAULT	2
__aeabi_d2uiz	.symtab	0x1a06c	84	FUNC	<unknown>	DEFAULT	2
__aeabi_dadd	.symtab	0x19624	736	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpeq	.symtab	0x1a008	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpge	.symtab	0x1a044	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpgt	.symtab	0x1a058	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmple	.symtab	0x1a030	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmplt	.symtab	0x1a01c	20	FUNC	<unknown>	DEFAULT	2
__aeabi_ddiv	.symtab	0x19d40	516	FUNC	<unknown>	DEFAULT	2
__aeabi_dmul	.symtab	0x19a18	808	FUNC	<unknown>	DEFAULT	2
__aeabi_drsub	.symtab	0x19618	0	FUNC	<unknown>	DEFAULT	2
__aeabi_dsub	.symtab	0x19620	740	FUNC	<unknown>	DEFAULT	2
__aeabi_f2d	.symtab	0x19958	64	FUNC	<unknown>	DEFAULT	2
__aeabi_i2d	.symtab	0x1992c	44	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv	.symtab	0x194d8	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x11738	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x19600	24	FUNC	<unknown>	DEFAULT	2
__aeabi_l2d	.symtab	0x199ac	108	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x11738	4	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x19904	40	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x11478	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x11570	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ul2d	.symtab	0x19998	128	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2cc48	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x269a0	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x13b30	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x269e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x269e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14dd8	56	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x19f54	132	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x26684	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x269dc	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x2668c	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2cc78	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x265b8	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x18b58	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x1927c	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18a30	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x151bc	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x151b8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x11738	4	FUNC	<unknown>	DEFAULT	2
__divdf3	.symtab	0x19d40	516	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x194d8	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x169d0	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1a0c0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x265bc	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x191d4	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x18948	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x18ae8	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2cc40	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x19f54	132	FUNC	<unknown>	DEFAULT	2
__errno_location	.symtab	0x11cbc	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x117b4	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2cc38	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x19958	64	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fixunsdfsi	.symtab	0x1a06c	84	FUNC	<unknown>	DEFAULT	2
__floatdidf	.symtab	0x199ac	108	FUNC	<unknown>	DEFAULT	2
__floatsidf	.symtab	0x1992c	44	FUNC	<unknown>	DEFAULT	2
__floatundidf	.symtab	0x19998	128	FUNC	<unknown>	DEFAULT	2
__floatunsidf	.symtab	0x19904	40	FUNC	<unknown>	DEFAULT	2
__gedf2	.symtab	0x19f44	148	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x174b0	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x13364	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x19f44	148	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x15378	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x14008	148	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x1409c	140	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1415c	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x14128	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x14148	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__ledf2	.symtab	0x19f4c	140	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x19348	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x18b44	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x118d8	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13944	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x11b0c	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x117c0	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x11834	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x11930	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x119b0	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x18f90	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1529c	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x11ab0	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x17570	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x11b78	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x139cc	44	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x139f8	52	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11ba4	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13a2c	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13a58	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x150b8	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2cc3c	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x11c54	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x11c5c	44	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x19f4c	140	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x267cc	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x2cc1c	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x2cdf8	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x11654	228	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x19a18	808	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x1173c	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x2ce20	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2ce2c	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x19f54	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x18c34	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x171dc	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2cc44	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x14dd4	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x174f8	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x18c68	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x269c0	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2cc4c	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2ce10	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2ce30	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x13c0c	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13c30	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13be8	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2669c	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x19394	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x154b0	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17864	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1556c	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x11e50	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1d548	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x193f0	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17c28	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1941c	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x156a4	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x11f18	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x266a0	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x19620	740	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1519c	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x151c0	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x14d60	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14e10	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14e6c	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x269b8	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x11478	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x11588	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x11790	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x13378	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x11f48	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x17510	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2ce34	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2ce38	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x269e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2cc54	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x11884	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1a0fc	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2aa38	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x11f94	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1599c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2cc58	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x157a8	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16190	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x1260c	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x128c4	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x126a4	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x126dc	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x12878	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x14dd4	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14dd4	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2cd78	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x17930	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x11de0	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x266a4	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x266a8	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x17cec	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x2aa34	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x266c0	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x2aa30	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x266dc	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x11e60	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x266d8	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x148b0	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15818	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1d618	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1584c	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x12018	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x14250	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x118ac	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0xc490	220	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x10478	144	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x1489c	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1489c	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x12e70	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2cc34	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x2cc50	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x17534	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x13b30	184	FUNC	<unknown>	DEFAULT	2
buf.4901	.symtab	0x2ca3c	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x26674	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1a0f4	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x13da8	88	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x81cc	228	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x82b0	448	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x8470	448	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x11cc8	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x118d8	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2555	.symtab	0x269e4	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x13944	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0xa030	640	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x11b0c	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xa4a8	344	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x265c4	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x11904	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2cc40	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2cc54	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x14adc	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x151ec	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x14a48	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1e1bc	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1759c	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x117c0	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x11834	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x9920	208	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x2aa1c	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x979c	388	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x9514	648	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x17e2c	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17c58	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x18010	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0xa448	96	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x1e1a8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1771c	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x265b8	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x269e0	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x11930	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x12d88	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x13e00	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x17728	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x17728	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17734	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x12dbc	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0xea94	16	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x9c18	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0xe7b0	740	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x1195c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x15218	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x11984	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x15244	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1358c	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x135d0	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x119b0	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x119dc	44	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x11a08	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x13970	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1399c	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x15270	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4900	.symtab	0x2cc08	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2cc58	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x265c8	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x265cc	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x265d0	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x265d4	4	OBJECT	<unknown>	DEFAULT	9
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x1ae04	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x13530	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x13554	20	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0xc6b8	980	FUNC	<unknown>	DEFAULT	2
i.4419	.symtab	0x26678	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x12fb0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x13568	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x168e4	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x186e8	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x18584	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x18374	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x182a8	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xe58c	548	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8778	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x267d0	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x144a4	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x147d4	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x11a34	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1346c	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x11a84	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x26a10	4	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0xa2b0	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x18f90	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x26a14	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xeaa4	2356	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0xa710	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x9cd4	136	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0xbc30	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x13c54	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x16630	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x12e80	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x16620	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x1672c	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x16744	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x12e90	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x268d4	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x268ec	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2cc5c	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x1529c	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x2ca38	4	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x2cc84	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x134f8	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1351c	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x26a08	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x269e8	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x11ab0	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2cc80	4	OBJECT	<unknown>	DEFAULT	10
p.2553	.symtab	0x265c0	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x99f0	128	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x2cc8c	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x11b1c	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x17570	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x11b48	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x1d570	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8fd8	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8c00	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8df0	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8c6c	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xca8c	6912	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x1d584	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x174f8	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x14398	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0xf52c	232	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0xf614	172	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x8ae8	280	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x89b0	312	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0xf3d8	136	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0xf460	204	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1439c	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1e174	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x14678	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x26920	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x180a8	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x11b78	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x13ef0	280	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x139cc	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x9d5c	724	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 23, 2025 18:16:15.414167881 CET	45658	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:16:15.419032097 CET	616	45658	37.114.46.230	192.168.2.15
Jan 23, 2025 18:16:15.419107914 CET	45658	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:16:15.419712067 CET	45658	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:16:15.424473047 CET	616	45658	37.114.46.230	192.168.2.15
Jan 23, 2025 18:16:36.783602953 CET	616	45658	37.114.46.230	192.168.2.15
Jan 23, 2025 18:16:36.784446955 CET	45658	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:16:36.789546013 CET	616	45658	37.114.46.230	192.168.2.15
Jan 23, 2025 18:16:51.793973923 CET	45660	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:16:51.798820972 CET	616	45660	37.114.46.230	192.168.2.15
Jan 23, 2025 18:16:51.798930883 CET	45660	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:16:51.798930883 CET	45660	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:16:51.803889036 CET	616	45660	37.114.46.230	192.168.2.15
Jan 23, 2025 18:17:13.331484079 CET	616	45660	37.114.46.230	192.168.2.15
Jan 23, 2025 18:17:13.331974030 CET	45660	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:17:13.336805105 CET	616	45660	37.114.46.230	192.168.2.15
Jan 23, 2025 18:17:28.339540958 CET	45662	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:17:28.344480038 CET	616	45662	37.114.46.230	192.168.2.15
Jan 23, 2025 18:17:28.344544888 CET	45662	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:17:28.344602108 CET	45662	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:17:28.349400043 CET	616	45662	37.114.46.230	192.168.2.15
Jan 23, 2025 18:17:49.772706985 CET	616	45662	37.114.46.230	192.168.2.15
Jan 23, 2025 18:17:49.773089886 CET	45662	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:17:49.777920008 CET	616	45662	37.114.46.230	192.168.2.15
Jan 23, 2025 18:18:04.780641079 CET	45664	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:18:04.785450935 CET	616	45664	37.114.46.230	192.168.2.15
Jan 23, 2025 18:18:04.785536051 CET	45664	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:18:04.785563946 CET	45664	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:18:04.790316105 CET	616	45664	37.114.46.230	192.168.2.15
Jan 23, 2025 18:18:26.160815954 CET	616	45664	37.114.46.230	192.168.2.15
Jan 23, 2025 18:18:26.161128044 CET	45664	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:18:26.165996075 CET	616	45664	37.114.46.230	192.168.2.15
Jan 23, 2025 18:18:41.167911053 CET	45666	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:18:41.173072100 CET	616	45666	37.114.46.230	192.168.2.15
Jan 23, 2025 18:18:41.173154116 CET	45666	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:18:41.173249960 CET	45666	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:18:41.178037882 CET	616	45666	37.114.46.230	192.168.2.15
Jan 23, 2025 18:19:02.579725027 CET	616	45666	37.114.46.230	192.168.2.15
Jan 23, 2025 18:19:02.580142021 CET	45666	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:19:02.584944963 CET	616	45666	37.114.46.230	192.168.2.15
Jan 23, 2025 18:19:17.585772991 CET	45668	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:19:17.591031075 CET	616	45668	37.114.46.230	192.168.2.15
Jan 23, 2025 18:19:17.591109037 CET	45668	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:19:17.591130972 CET	45668	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:19:17.596005917 CET	616	45668	37.114.46.230	192.168.2.15
Jan 23, 2025 18:19:38.959669113 CET	616	45668	37.114.46.230	192.168.2.15
Jan 23, 2025 18:19:38.960237026 CET	45668	616	192.168.2.15	37.114.46.230
Jan 23, 2025 18:19:38.965147972 CET	616	45668	37.114.46.230	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 23, 2025 18:18:57.697457075 CET	54302	53	192.168.2.15	1.1.1.1
Jan 23, 2025 18:18:57.697567940 CET	34471	53	192.168.2.15	1.1.1.1
Jan 23, 2025 18:18:58.083764076 CET	53	34471	1.1.1.1	192.168.2.15
Jan 23, 2025 18:18:58.083794117 CET	53	54302	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 23, 2025 18:18:57.697457075 CET	192.168.2.15	1.1.1.1	0xe0d1	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2025 18:18:57.697567940 CET	192.168.2.15	1.1.1.1	0xa7f0	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 23, 2025 18:18:58.083794117 CET	1.1.1.1	192.168.2.15	0xe0d1	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 23, 2025 18:18:58.083794117 CET	1.1.1.1	192.168.2.15	0xe0d1	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: armv4l.elf PID: 5548, Parent PID: 5466

General

Start time (UTC):	17:16:14
Start date (UTC):	23/01/2025
Path:	/tmp/armv4l.elf
Arguments:	/tmp/armv4l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: armv4l.elf PID: 5550, Parent PID: 5548

General

Start time (UTC):	17:16:14
Start date (UTC):	23/01/2025
Path:	/tmp/armv4l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: armv4l.elf PID: 5551, Parent PID: 5548

General

Start time (UTC):	17:16:14
Start date (UTC):	23/01/2025
Path:	/tmp/armv4l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: armv4l.elf PID: 5554, Parent PID: 5551

General

Start time (UTC):	17:16:14
Start date (UTC):	23/01/2025
Path:	/tmp/armv4l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report armv4l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: armv4l.elf PID: 5548, Parent PID: 5466

General

Chronological Activities

Analysis Process: armv4l.elf PID: 5550, Parent PID: 5548

General

Chronological Activities

Analysis Process: armv4l.elf PID: 5551, Parent PID: 5548

General

Chronological Activities

Analysis Process: armv4l.elf PID: 5554, Parent PID: 5551

General

Chronological Activities

Linux Analysis Report
armv4l.elf