Edit tour

Linux Analysis Report
rubix.arm7-20220514-0500

Overview

General Information

Sample Name:	rubix.arm7-20220514-0500
Analysis ID:	626516
MD5:	a4e3a4990f81cd4d51a5641cdc891e9f
SHA1:	a1a56aa4bee86f64cb408ef12b1683873e0c1a72
SHA256:	8bf8a96bf64539b242fb0d3a0902b683b9c871a0d3fa64a9871f4b1503336121
Infos:

Detection

Mirai

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Sample contains symbols with suspicious names

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Exit code information suggests that the sample terminated abnormally, try to lookup the sample's target architecture.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Non-zero exit code suggests an error during the execution. Lookup the error code for hints.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626516
Start date and time: 14/05/202207:06:03	2022-05-14 07:06:03 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	rubix.arm7-20220514-0500
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal60.troj.linARM7-20220514-0500@0/0@0/0

Runtime Messages

Command:	/tmp/rubix.arm7-20220514-0500
PID:	6234
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

rubix.arm7-20220514-0500 (PID: 6234, Parent: 6125, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/rubix.arm7-20220514-0500

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
rubix.arm7-20220514-0500	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: rubix.arm7-20220514-0500

Virustotal: Detection: 50%

Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: /tmp/rubix.arm7-20220514-0500 (PID: 6234)

Socket: 127.0.0.1::9473

Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_std
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcpack

Source: ELF static info symbol of initial sample

Name: hexPayload

Source: classification engine

Classification label: mal60.troj.linARM7-20220514-0500@0/0@0/0

Source: /tmp/rubix.arm7-20220514-0500 (PID: 6234)

Queries kernel information via 'uname':

Jump to behavior

Source: rubix.arm7-20220514-0500, 6234.1.00000000b763ca26.0000000073530d75.rw-.sdmp	Binary or memory string: Fx86_64/usr/bin/qemu-arm/tmp/rubix.arm7-20220514-0500SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/rubix.arm7-20220514-0500
Source: rubix.arm7-20220514-0500, 6234.1.00000000624627ff.0000000053a2855b.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: rubix.arm7-20220514-0500, 6234.1.00000000b763ca26.0000000073530d75.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: rubix.arm7-20220514-0500, 6234.1.00000000624627ff.0000000053a2855b.rw-.sdmp	Binary or memory string: O&V!/etc/qemu-binfmt/arm
Source: rubix.arm7-20220514-0500, 6234.1.00000000b763ca26.0000000073530d75.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: rubix.arm7-20220514-0500, type: SAMPLE

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: rubix.arm7-20220514-0500, type: SAMPLE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rubix.arm7-20220514-0500	50%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
109.202.202.202	e6rqKp2zzr	Get hash	malicious	Browse
	RNheGvIjUs	Get hash	malicious	Browse
	0M0fRzyviG	Get hash	malicious	Browse
	V1v1xgFjJ3	Get hash	malicious	Browse
	3Y83X81sIz	Get hash	malicious	Browse
	sora.x86-20220513-1950	Get hash	malicious	Browse
	sora.arm7-20220513-1950	Get hash	malicious	Browse
	sora.arm-20220513-1950	Get hash	malicious	Browse
	5WzsVxb11w	Get hash	malicious	Browse
	vmBqliEohe	Get hash	malicious	Browse
	percarm7	Get hash	malicious	Browse
	percx86	Get hash	malicious	Browse
	jew.arm7-20220513-1750	Get hash	malicious	Browse
	jew.x86-20220513-1750	Get hash	malicious	Browse
	jew.arm5-20220513-1750	Get hash	malicious	Browse
	dEXRZQ8e8d	Get hash	malicious	Browse
	GOkc9SGf1u	Get hash	malicious	Browse
	KG4e8Vwjak	Get hash	malicious	Browse
	sVWfH148z2	Get hash	malicious	Browse
	47yqmMly0R	Get hash	malicious	Browse
91.189.91.43	e6rqKp2zzr	Get hash	malicious	Browse
	RNheGvIjUs	Get hash	malicious	Browse
	0M0fRzyviG	Get hash	malicious	Browse
	V1v1xgFjJ3	Get hash	malicious	Browse
	3Y83X81sIz	Get hash	malicious	Browse
	sora.x86-20220513-1950	Get hash	malicious	Browse
	sora.arm7-20220513-1950	Get hash	malicious	Browse
	sora.arm-20220513-1950	Get hash	malicious	Browse
	5WzsVxb11w	Get hash	malicious	Browse
	vmBqliEohe	Get hash	malicious	Browse
	percarm7	Get hash	malicious	Browse
	percx86	Get hash	malicious	Browse
	jew.arm7-20220513-1750	Get hash	malicious	Browse
	jew.x86-20220513-1750	Get hash	malicious	Browse
	jew.arm5-20220513-1750	Get hash	malicious	Browse
	dEXRZQ8e8d	Get hash	malicious	Browse
	GOkc9SGf1u	Get hash	malicious	Browse
	KG4e8Vwjak	Get hash	malicious	Browse
	sVWfH148z2	Get hash	malicious	Browse
	47yqmMly0R	Get hash	malicious	Browse
91.189.91.42	e6rqKp2zzr	Get hash	malicious	Browse
	RNheGvIjUs	Get hash	malicious	Browse
	0M0fRzyviG	Get hash	malicious	Browse
	V1v1xgFjJ3	Get hash	malicious	Browse
	3Y83X81sIz	Get hash	malicious	Browse
	sora.x86-20220513-1950	Get hash	malicious	Browse
	sora.arm7-20220513-1950	Get hash	malicious	Browse
	sora.arm-20220513-1950	Get hash	malicious	Browse
	5WzsVxb11w	Get hash	malicious	Browse
	vmBqliEohe	Get hash	malicious	Browse
	percarm7	Get hash	malicious	Browse
	percx86	Get hash	malicious	Browse
	jew.arm7-20220513-1750	Get hash	malicious	Browse
	jew.x86-20220513-1750	Get hash	malicious	Browse
	jew.arm5-20220513-1750	Get hash	malicious	Browse
	dEXRZQ8e8d	Get hash	malicious	Browse
	GOkc9SGf1u	Get hash	malicious	Browse
	KG4e8Vwjak	Get hash	malicious	Browse
	sVWfH148z2	Get hash	malicious	Browse
	47yqmMly0R	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CANONICAL-ASGB	e6rqKp2zzr	Get hash	malicious	Browse	91.189.91.42
	RNheGvIjUs	Get hash	malicious	Browse	91.189.91.42
	0M0fRzyviG	Get hash	malicious	Browse	91.189.91.42
	V1v1xgFjJ3	Get hash	malicious	Browse	91.189.91.42
	3Y83X81sIz	Get hash	malicious	Browse	91.189.91.42
	sora.x86-20220513-1950	Get hash	malicious	Browse	91.189.91.42
	sora.arm7-20220513-1950	Get hash	malicious	Browse	91.189.91.42
	sora.arm-20220513-1950	Get hash	malicious	Browse	91.189.91.42
	5WzsVxb11w	Get hash	malicious	Browse	91.189.91.42
	vmBqliEohe	Get hash	malicious	Browse	91.189.91.42
	percarm7	Get hash	malicious	Browse	91.189.91.42
	percx86	Get hash	malicious	Browse	91.189.91.42
	jew.arm7-20220513-1750	Get hash	malicious	Browse	91.189.91.42
	jew.x86-20220513-1750	Get hash	malicious	Browse	91.189.91.42
	jew.arm5-20220513-1750	Get hash	malicious	Browse	91.189.91.42
	dEXRZQ8e8d	Get hash	malicious	Browse	91.189.91.42
	GOkc9SGf1u	Get hash	malicious	Browse	91.189.91.42
	KG4e8Vwjak	Get hash	malicious	Browse	91.189.91.42
	sVWfH148z2	Get hash	malicious	Browse	91.189.91.42
	47yqmMly0R	Get hash	malicious	Browse	91.189.91.42
CANONICAL-ASGB	e6rqKp2zzr	Get hash	malicious	Browse	91.189.91.42
	RNheGvIjUs	Get hash	malicious	Browse	91.189.91.42
	0M0fRzyviG	Get hash	malicious	Browse	91.189.91.42
	V1v1xgFjJ3	Get hash	malicious	Browse	91.189.91.42
	3Y83X81sIz	Get hash	malicious	Browse	91.189.91.42
	sora.x86-20220513-1950	Get hash	malicious	Browse	91.189.91.42
	sora.arm7-20220513-1950	Get hash	malicious	Browse	91.189.91.42
	sora.arm-20220513-1950	Get hash	malicious	Browse	91.189.91.42
	5WzsVxb11w	Get hash	malicious	Browse	91.189.91.42
	vmBqliEohe	Get hash	malicious	Browse	91.189.91.42
	percarm7	Get hash	malicious	Browse	91.189.91.42
	percx86	Get hash	malicious	Browse	91.189.91.42
	jew.arm7-20220513-1750	Get hash	malicious	Browse	91.189.91.42
	jew.x86-20220513-1750	Get hash	malicious	Browse	91.189.91.42
	jew.arm5-20220513-1750	Get hash	malicious	Browse	91.189.91.42
	dEXRZQ8e8d	Get hash	malicious	Browse	91.189.91.42
	GOkc9SGf1u	Get hash	malicious	Browse	91.189.91.42
	KG4e8Vwjak	Get hash	malicious	Browse	91.189.91.42
	sVWfH148z2	Get hash	malicious	Browse	91.189.91.42
	47yqmMly0R	Get hash	malicious	Browse	91.189.91.42
INIT7CH	e6rqKp2zzr	Get hash	malicious	Browse	109.202.202.202
	RNheGvIjUs	Get hash	malicious	Browse	109.202.202.202
	0M0fRzyviG	Get hash	malicious	Browse	109.202.202.202
	V1v1xgFjJ3	Get hash	malicious	Browse	109.202.202.202
	3Y83X81sIz	Get hash	malicious	Browse	109.202.202.202
	sora.x86-20220513-1950	Get hash	malicious	Browse	109.202.202.202
	sora.arm7-20220513-1950	Get hash	malicious	Browse	109.202.202.202
	sora.arm-20220513-1950	Get hash	malicious	Browse	109.202.202.202
	5WzsVxb11w	Get hash	malicious	Browse	109.202.202.202
	vmBqliEohe	Get hash	malicious	Browse	109.202.202.202
	percarm7	Get hash	malicious	Browse	109.202.202.202
	percx86	Get hash	malicious	Browse	109.202.202.202
	jew.arm7-20220513-1750	Get hash	malicious	Browse	109.202.202.202
	jew.x86-20220513-1750	Get hash	malicious	Browse	109.202.202.202
	jew.arm5-20220513-1750	Get hash	malicious	Browse	109.202.202.202
	dEXRZQ8e8d	Get hash	malicious	Browse	109.202.202.202
	GOkc9SGf1u	Get hash	malicious	Browse	109.202.202.202
	KG4e8Vwjak	Get hash	malicious	Browse	109.202.202.202
	sVWfH148z2	Get hash	malicious	Browse	109.202.202.202
	47yqmMly0R	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.932069841658106
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	rubix.arm7-20220514-0500
File size:	117185
MD5:	a4e3a4990f81cd4d51a5641cdc891e9f
SHA1:	a1a56aa4bee86f64cb408ef12b1683873e0c1a72
SHA256:	8bf8a96bf64539b242fb0d3a0902b683b9c871a0d3fa64a9871f4b1503336121
SHA512:	e592c9132a4708a78e6afdd2add3d3b3084a98baf3c2c0d9e640980d2213a0ab469c84a50e54073337c5c2f3f24c6152288396a5f4ddf280ba36aa248cfddcab
SSDEEP:	1536:8InU/Lj68zQoroHqohCsxY25rllKpiyRoGYFGiuzS4xokpUah0zw/9SnpWDn84yh:a/EbqohCsxY5FRonFZu9xz0M/9UIDnbI
TLSH:	F3B32A56E7818B13C0D62779BAEF42453323AB9193D7730695287FF43F8679A0E13906
File Content Preview:	.ELF..............(.........4...._......4. ...(........p.....s...s.......................................................................2..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	90032
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0xe3ac	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1649c	0xe49c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x164ac	0xe4ac	0xeec	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x17398	0xf398	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x173b0	0xf3b0	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x1f4c8	0xf4c8	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x1f4cc	0xf4cc	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x1f4cc	0xf4cc	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x1f4d0	0xf4d0	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x1f4d4	0xf4d4	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x1f4d8	0xf4d8	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x1f580	0xf580	0x208	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x1f788	0xf788	0x3010	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0xf788	0xb9e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x10328	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x10468	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1067b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x126be	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x12da0	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x13c18	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x13ed0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1479a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x15929	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x15e81	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x15e97	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16438	0x4320	0x10	0x0		28	636	4
.strtab	STRTAB	0x0	0x1a758	0x2269	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0xf3b0	0x173b0	0x173b0	0x118	0x118	1.5600	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0xf4c8	0xf4c8	3.2629	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0xf4c8	0x1f4c8	0x1f4c8	0x2c0	0x32d0	2.4169	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
TLS	0xf4cc	0x1f4cc	0x1f4cc	0x0	0x8	0.0000	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1649c	SECTION	<unknown>	DEFAULT	3
	.symtab	0x164ac	SECTION	<unknown>	DEFAULT	4
	.symtab	0x17398	SECTION	<unknown>	DEFAULT	5
	.symtab	0x173b0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x1f4c8	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1f4cc	SECTION	<unknown>	DEFAULT	8
	.symtab	0x1f4cc	SECTION	<unknown>	DEFAULT	9
	.symtab	0x1f4d0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1f4d4	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1f4d8	SECTION	<unknown>	DEFAULT	12
	.symtab	0x1f580	SECTION	<unknown>	DEFAULT	13
	.symtab	0x1f788	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1649c	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x164a8	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82cc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84e8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8554	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x85c4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8950	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8c04	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ea4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9144	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9424	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a40	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f2c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa364	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xab18	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2cc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb9c4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc048	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc098	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc13c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc154	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc19c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc2f8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcab4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb10	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb78	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc48	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd24	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd48	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcde8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce88	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4e4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd50c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd554	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd578	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd59c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6d8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd76c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd880	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd894	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd92c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda20	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda34	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda6c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdab0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdaf4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb78	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdbb8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc44	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc74	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd84	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde54	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf18	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfc8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfe8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe020	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe030	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0d0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe130	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe154	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe17c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1c0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe234	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe278	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2bc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe330	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe374	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3bc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3fc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe440	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4b0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4f8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe580	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5c4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe634	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe680	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe708	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe750	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe794	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7e4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7f8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8bc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe928	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2d8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf418	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7d8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc78	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfcb8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfde0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfdf8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe9c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff54	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10014	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100b8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10148	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10220	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10318	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10404	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104c8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10614	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c38	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c88	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11054	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110ec	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11134	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11224	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11354	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113ac	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113b4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113e4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1143c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11444	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11474	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114cc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114d4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11504	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1155c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11564	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11590	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11618	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116f4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117b4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11808	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11860	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c4c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cc8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cf4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d7c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d84	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d90	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11da0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11db0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11df0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e58	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ebc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ee8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11efc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f10	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f24	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f4c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f84	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fc4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fd8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1201c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1205c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1209c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120fc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12168	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1217c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122f4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123e0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12784	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ab4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ad4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f34	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fb4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13118	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13148	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1328c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133a8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13658	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a04	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b30	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bd0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14060	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14080	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14170	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1425c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142a0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142f0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1433c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14360	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143dc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144d4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1454c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145b4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14808	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14814	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1484c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148a4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148fc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14908	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149e8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b30	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b88	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c64	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c94	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d38	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d5c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d9c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e0c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f50	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f9c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fe8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ff0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ff4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15020	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1502c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15038	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15258	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153c4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15424	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15490	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15548	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15568	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156ac	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bf4	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bfc	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c04	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c0c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cc8	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d0c	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16420	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16468	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f4d0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f4cc	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82c4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x891c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8c00	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9420	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9a3c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f28	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa360	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xab14	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2c8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb9c0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbff0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f580	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xc14c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc198	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc2ec	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca7c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f584	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f588	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f58c	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f590	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xcb00	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb68	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc38	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd14	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd44	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcde0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce80	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd43c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f594	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xd924	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda10	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda68	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdaac	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdaf0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdb70	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdbb4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc40	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd68	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde4c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf0c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdfc0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fbc	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xdfe4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe018	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1b8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe22c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe270	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe2b4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe328	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe36c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3b4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3f8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe438	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4a8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4f4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe578	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5bc	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe62c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe678	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe700	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe748	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe78c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe7e0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe8b0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2b4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f598	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xf3fc	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7b8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc5c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfcb0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfdcc	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f5b0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xfe80	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff38	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfff8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1009c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f5c8	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f660	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x10144	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10214	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10308	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103f8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fd4	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x104a8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f674	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x105f0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c0c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c84	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1102c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11218	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11344	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11350	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113e0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11470	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11500	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116ec	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117a0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11800	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11854	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c00	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f68c	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11cc0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11cf0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d70	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11dec	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e50	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11eb8	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f44	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f80	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11fc0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12018	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12058	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12098	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x120f4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12160	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x123cc	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1277c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12aa4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f00	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12fa4	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130fc	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f6a4	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f6a0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1363c	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x139ec	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b28	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14168	NOTYPE

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report rubix.arm7-20220514-0500

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Linux Analysis Report
rubix.arm7-20220514-0500