Edit tour

Linux Analysis Report
WFBNzzTxxT

Overview

General Information

Sample Name:	WFBNzzTxxT
Analysis ID:	632637
MD5:	dd5788b38bce25aaab473296fd932357
SHA1:	dcc08bec8b7b257b5fe53c12acb50f09e3f9e882
SHA256:	ed6f9f27804d4690271012bcf4b5e79db40dced6502811440d47881733d2d093
Tags:	32armelfgafgyt
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Connects to many ports of the same IP (likely port scanning)

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632637
Start date and time: 23/05/202220:59:21	2022-05-23 20:59:21 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	WFBNzzTxxT
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal56.troj.lin@0/0@0/0

Runtime Messages

Command:	/tmp/WFBNzzTxxT
PID:	6226
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	$UICIDEBOY$
Standard Error:

Process Tree

system is lnxubuntu20

WFBNzzTxxT (PID: 6226, Parent: 6126, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/WFBNzzTxxT

WFBNzzTxxT New Fork (PID: 6228, Parent: 6226)

WFBNzzTxxT New Fork (PID: 6230, Parent: 6228)

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: WFBNzzTxxT	Virustotal: Detection: 24%			Perma Link
Source: WFBNzzTxxT	ReversingLabs: Detection: 29%

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 149.57.210.157 ports 57468,4,5,6,7,8

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:36864 -> 149.57.210.157:57468

Source: /tmp/WFBNzzTxxT (PID: 6226)

Socket: 0.0.0.0::57461

Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: attack_checksum

Source: classification engine

Classification label: mal56.troj.lin@0/0@0/0

Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memmove.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memset.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crtn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/sigrestorer.S

Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2078/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2033/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2077/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2275/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2195/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1656/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1654/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2226/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/3236/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2025/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2146/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2080/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2242/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2285/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2084/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2083/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2281/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1668/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1623/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1622/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1389/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1664/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2038/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2114/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2235/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1661/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2079/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2156/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1629/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1627/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2637/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2294/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2009/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2129/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1633/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2128/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1632/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1599/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1477/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2289/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1639/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1638/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2208/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2180/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1809/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1890/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1888/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/2018/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1489/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1642/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/WFBNzzTxxT (PID: 6230)	File opened: /proc/1648/fd	Jump to behavior

Source: /tmp/WFBNzzTxxT (PID: 6226)

Queries kernel information via 'uname':

Jump to behavior

Source: WFBNzzTxxT, 6226.1.00000000e84561c4.000000005ff99cbb.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: WFBNzzTxxT, 6226.1.00000000e84561c4.000000005ff99cbb.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: WFBNzzTxxT, 6226.1.00000000fb4123d0.000000002a09aed4.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: WFBNzzTxxT, 6226.1.00000000fb4123d0.000000002a09aed4.rw-.sdmp	Binary or memory string: Fx86_64/usr/bin/qemu-arm/tmp/WFBNzzTxxTSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/WFBNzzTxxT

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WFBNzzTxxT	24%	Virustotal		Browse
WFBNzzTxxT	29%	ReversingLabs	Linux.Trojan.Gafgyt

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.57.210.157	unknown	United States	174	COGENT-174US	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
149.57.210.157	2VhAznm1AF	Get hash	malicious	Browse
	3ZTjdgUHOh	Get hash	malicious	Browse
	VfI6kqTt8F	Get hash	malicious	Browse
	WSm0NI8ucm	Get hash	malicious	Browse
	eVkuV6pQqm	Get hash	malicious	Browse
	AS3x2NXpRx	Get hash	malicious	Browse
	5SLPAIuyvr	Get hash	malicious	Browse
	7xVNWpJNgy	Get hash	malicious	Browse
	1vaDiWhpt0	Get hash	malicious	Browse
	GkXN7yM1Ps	Get hash	malicious	Browse
	mdCyx5iw09	Get hash	malicious	Browse
	mirai.x86	Get hash	malicious	Browse
	mirai.arm7	Get hash	malicious	Browse
	mirai.arm	Get hash	malicious	Browse
109.202.202.202	2VhAznm1AF	Get hash	malicious	Browse
	3ZTjdgUHOh	Get hash	malicious	Browse
	VfI6kqTt8F	Get hash	malicious	Browse
	WSm0NI8ucm	Get hash	malicious	Browse
	eVkuV6pQqm	Get hash	malicious	Browse
	Cmwh0feOl1	Get hash	malicious	Browse
	x86-20220523-1450	Get hash	malicious	Browse
	arm7-20220523-1450	Get hash	malicious	Browse
	arm-20220523-1450	Get hash	malicious	Browse
	YZgmL60j1V	Get hash	malicious	Browse
	SecuriteInfo.com.Linux.Mirai.4306.8972.10599	Get hash	malicious	Browse
	4QtSKXBf5I	Get hash	malicious	Browse
	jew.arm5	Get hash	malicious	Browse
	ifGutwDp6m	Get hash	malicious	Browse
	0OQ9YF6Boh	Get hash	malicious	Browse
	percarm7-20220523-0050	Get hash	malicious	Browse
	percx86-20220523-0050	Get hash	malicious	Browse
	percarm-20220523-0050	Get hash	malicious	Browse
	beamer.arm-20220522-1850	Get hash	malicious	Browse
	sora.arm-20220522-1650	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
COGENT-174US	2VhAznm1AF	Get hash	malicious	Browse	149.57.210.157
	3ZTjdgUHOh	Get hash	malicious	Browse	149.57.210.157
	VfI6kqTt8F	Get hash	malicious	Browse	149.57.210.157
	WSm0NI8ucm	Get hash	malicious	Browse	149.57.210.157
	eVkuV6pQqm	Get hash	malicious	Browse	149.57.210.157
	WzQMbTbCs4	Get hash	malicious	Browse	38.220.172.152
	c1tJWZUE5t.exe	Get hash	malicious	Browse	38.63.202.106
	7Lb8rwvldF	Get hash	malicious	Browse	38.148.251.19
	IulEEy7dnR	Get hash	malicious	Browse	154.21.136.144
	wC4Wh49AUn	Get hash	malicious	Browse	136.161.34.94
	Josho.x86	Get hash	malicious	Browse	38.104.23.160
	SecuriteInfo.com.Linux.Mirai.2522.4585.13450	Get hash	malicious	Browse	38.148.226.29
	3iy1HRKlrm	Get hash	malicious	Browse	38.25.43.106
	pXbH0Ync6e	Get hash	malicious	Browse	161.82.37.46
	Pkbs8NK2gS	Get hash	malicious	Browse	216.28.163.224
	jew.arm7	Get hash	malicious	Browse	38.83.35.30
	jew.x86	Get hash	malicious	Browse	38.9.223.22
	B2CP7Anrdz	Get hash	malicious	Browse	38.63.117.229
	XukPw5trx0	Get hash	malicious	Browse	149.6.31.140
	G56U7GPUOd	Get hash	malicious	Browse	38.15.250.110
INIT7CH	2VhAznm1AF	Get hash	malicious	Browse	109.202.202.202
	3ZTjdgUHOh	Get hash	malicious	Browse	109.202.202.202
	VfI6kqTt8F	Get hash	malicious	Browse	109.202.202.202
	WSm0NI8ucm	Get hash	malicious	Browse	109.202.202.202
	eVkuV6pQqm	Get hash	malicious	Browse	109.202.202.202
	Cmwh0feOl1	Get hash	malicious	Browse	109.202.202.202
	x86-20220523-1450	Get hash	malicious	Browse	109.202.202.202
	arm7-20220523-1450	Get hash	malicious	Browse	109.202.202.202
	arm-20220523-1450	Get hash	malicious	Browse	109.202.202.202
	YZgmL60j1V	Get hash	malicious	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Mirai.4306.8972.10599	Get hash	malicious	Browse	109.202.202.202
	4QtSKXBf5I	Get hash	malicious	Browse	109.202.202.202
	jew.arm5	Get hash	malicious	Browse	109.202.202.202
	ifGutwDp6m	Get hash	malicious	Browse	109.202.202.202
	0OQ9YF6Boh	Get hash	malicious	Browse	109.202.202.202
	percarm7-20220523-0050	Get hash	malicious	Browse	109.202.202.202
	percx86-20220523-0050	Get hash	malicious	Browse	109.202.202.202
	percarm-20220523-0050	Get hash	malicious	Browse	109.202.202.202
	beamer.arm-20220522-1850	Get hash	malicious	Browse	109.202.202.202
	sora.arm-20220522-1650	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.635649000084672
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	WFBNzzTxxT
File size:	45838
MD5:	dd5788b38bce25aaab473296fd932357
SHA1:	dcc08bec8b7b257b5fe53c12acb50f09e3f9e882
SHA256:	ed6f9f27804d4690271012bcf4b5e79db40dced6502811440d47881733d2d093
SHA512:	adf22c3b4a9febba115dc47332fe120ec5904829ca2270885d8fdd8b13bf66ca8c1d2237133989b5f968f0ccac5d691bd0af6270ed224b73003cbf690c2b77ca
SSDEEP:	768:/NKcMkhV7kQc19nGuP/y7wA7oT1JSd/cP6jYnrR+F:FKY7kQcKGy7wqoT1XPBnu
TLSH:	9723FA41ED84871BC2D377FBA79F439D37326D159B9B330166397DB42B827AC2629210
File Content Preview:	.ELF...a..........(.........4....p......4. ...(.....................X_..X_...............`...`...`..P...xD..........Q.td..................................-...L."...j...........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	28872
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x59e0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0xda90	0x5a90	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0xdaa4	0x5aa4	0x4b0	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0xdf54	0x5f54	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x16000	0x6000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x16008	0x6008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x16010	0x6010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x16014	0x6014	0x23c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x16250	0x6250	0x4228	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x6250	0x634	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x6888	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x6928	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x6c34	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x6c98	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x6f80	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x7020	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x73e8	0x2a30	0x10	0x0		19	373	4
.strtab	STRTAB	0x0	0x9e18	0x14f6	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x5f58	0x5f58	3.2515	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x6000	0x16000	0x16000	0x250	0x4478	1.6377	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0xda90	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0xdaa4	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0xdf54	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x16000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x16008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x16010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x16014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x16250	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0xda90	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda9c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0xda54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0xdaa0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x882c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x92e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x94b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xad40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb0f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb1cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb1f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb3c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb3ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb59c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb66c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb7e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb83c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb94c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbcc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbdb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc25c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcaac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xccf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcde4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd26c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd78c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x16008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x1601c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16270	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x16024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x86b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x875c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x88dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8acc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8bdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8cac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8d90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8f10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16374	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8fc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x92d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x94a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x955c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9a0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1604c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x9cf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb65c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xba2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16054	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xbd9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc0a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1615c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xc120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc1ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc244	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc2c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16174	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xc394	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc424	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc4e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc5b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc1c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc764	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc7e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16228	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xc99c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xccc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16240	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xcdd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16244	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1a3b4	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0xd788	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd7c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd800	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
Q	.symtab	0x1637c	16384	OBJECT	<unknown>	DEFAULT	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__CTOR_END__	.symtab	0x16004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x16000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x16244	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0xdc54	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x1600c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x16008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0xdf54	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0xdf54	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x16244	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0xdc54	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x16248	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0xb66c	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xb084	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0xb0f8	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0xb274	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0xc9a0	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0xca50	92	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xce10	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0xbf70	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0xc5bc	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0xc5bc	12	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0xb7e4	44	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0xd7c8	60	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xb148	44	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0xb3ec	180	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0xb810	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x1a3b4	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0xc768	148	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xb084	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0xb0f8	80	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xb174	44	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0xce38	80	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0xd080	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0xd0ac	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0xd0d8	44	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xb1a0	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0xb83c	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0xd104	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x1a3b8	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0xb7c0	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0xd6a0	236	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0xc4f4	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xb1f8	80	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xb248	44	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0xb898	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0xd130	100	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xd680	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0xd690	4	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xb6b0	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0xd194	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xb274	92	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0xb4a0	252	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0xd78c	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0xc0bc	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0xc398	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xb310	44	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0xb59c	208	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0xb33c	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0xb8c4	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0xd1c0	88	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0xb8f0	44	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xb368	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0xb91c	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0xc2d8	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0xccf8	228	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0xb978	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0xd218	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0xc7fc	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0xb94c	44	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0xc428	204	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0xc5c8	8	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xb394	44	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0xd26c	44	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xb3c0	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x16010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x16010	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0xd914	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0xb030	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0xda3c	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0xb030	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0xd804	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0xd8fc	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x1a3a8	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x16228	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0xb978	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x1a478	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x16250	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x16250	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0xca18	56	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x16248	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x1a3bc	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x16014	0	NOTYPE	<unknown>	DEFAULT	9
__default_rt_sa_restorer	.symtab	0xcde0	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0xcddc	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xb030	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0xd914	296	FUNC	<unknown>	DEFAULT	2
__do_global_ctors_aux	.symtab	0xda54	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x16018	0	OBJECT	<unknown>	HIDDEN	9
__end__	.symtab	0x1a478	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x1a3a0	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0xb66c	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x1a398	4	OBJECT	<unknown>	HIDDEN	10
__fini_array_end	.symtab	0x16000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x16000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__getdents	.symtab	0xce88	148	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0xcf1c	356	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__heap_alloc	.symtab	0xbdb4	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0xbe7c	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0xbe48	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0xbe68	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x16000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x16000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0xb148	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0xb810	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0xb2d0	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xb084	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0xb0f8	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xb174	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0xb1a0	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0xd130	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0xd194	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xb274	92	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xb310	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0xb8c4	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0xb8f0	44	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0xccf8	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x1a39c	4	OBJECT	<unknown>	DEFAULT	10
__libc_write	.symtab	0xb3c0	44	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x16054	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x1a37c	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x1a458	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0xaf4c	228	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0xb034	80	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x1a3a4	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x16000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x16000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0xca0c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0xca0c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0xca0c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0xca0c	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0xca0c	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0xca14	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0xd78c	24	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__rtld_fini	.symtab	0x1a3ac	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0xba54	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0xba78	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0xba30	36	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0xcde4	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__sysv_signal	.symtab	0xba9c	124	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0xc9a0	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0xca50	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0xcaac	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x16240	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0xd804	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0xae80	204	FUNC	<unknown>	DEFAULT	2
__xstat64_conv	.symtab	0xd298	784	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0xd5a8	204	FUNC	<unknown>	HIDDEN	2
_atoi	.symtab	0xad40	136	FUNC	<unknown>	DEFAULT	2
_bss_end__	.symtab	0x1a478	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0xd7a4	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x1a470	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x1a474	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x16250	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x1a478	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x1a3b4	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0xce10	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0xda90	4	FUNC	<unknown>	DEFAULT	3
_h_errno	.symtab	0x1a3b8	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_memcpy	.symtab	0x9e28	120	FUNC	<unknown>	DEFAULT	2
_memmove	.symtab	0x9ea0	156	FUNC	<unknown>	DEFAULT	2
_memset	.symtab	0x9f3c	100	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0xca14	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0xca14	4	FUNC	<unknown>	DEFAULT	2
_read	.symtab	0xac74	176	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x1a3d8	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_startswith	.symtab	0xa1c8	144	FUNC	<unknown>	DEFAULT	2
_stdio_init	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_stdio_term	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_stdlib_strto_l	.symtab	0xc5d0	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strcat	.symtab	0xa018	144	FUNC	<unknown>	DEFAULT	2
_strcmp	.symtab	0x9d58	208	FUNC	<unknown>	DEFAULT	2
_strcpy	.symtab	0x9fa0	120	FUNC	<unknown>	DEFAULT	2
_strdup	.symtab	0xa0a8	84	FUNC	<unknown>	DEFAULT	2
_strlen	.symtab	0x9d04	84	FUNC	<unknown>	DEFAULT	2
_strstr	.symtab	0xa0fc	204	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0xbf70	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_to_kill	.symtab	0x8cb0	228	FUNC	<unknown>	DEFAULT	2
add_to_list	.symtab	0x8f20	164	FUNC	<unknown>	DEFAULT	2
alphanum	.symtab	0xdbb0	63	OBJECT	<unknown>	DEFAULT	4
atoi	.symtab	0xc5bc	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0xc5bc	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_checksum	.symtab	0xa570	260	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x1a394	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x1a3b0	4	OBJECT	<unknown>	DEFAULT	10
bind	.symtab	0xb7e4	44	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0xd7c8	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0xb978	184	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x1604c	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0xda88	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0xbc6c	88	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
check_connection	.symtab	0xa32c	144	FUNC	<unknown>	DEFAULT	2
check_fds	.symtab	0x88e4	368	FUNC	<unknown>	DEFAULT	2
check_for_contraband	.symtab	0x882c	184	FUNC	<unknown>	DEFAULT	2
check_pid	.symtab	0x9084	132	FUNC	<unknown>	DEFAULT	2
check_realpath	.symtab	0x8764	200	FUNC	<unknown>	DEFAULT	2
check_whitelisted	.symtab	0x86b8	172	FUNC	<unknown>	DEFAULT	2
checksum_generic	.symtab	0xa7fc	228	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xa8e0	440	FUNC	<unknown>	DEFAULT	2
clear_and_set_fd	.symtab	0xa3bc	144	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0xb678	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xb148	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close_fds	.symtab	0xa304	40	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0xb3ec	180	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
compare_realpaths	.symtab	0x8ad0	280	FUNC	<unknown>	DEFAULT	2
completed.2555	.symtab	0x16250	1	OBJECT	<unknown>	DEFAULT	10
confails.2103	.symtab	0x1626c	4	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0xb810	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connection	.symtab	0x82c4	544	FUNC	<unknown>	DEFAULT	2
connection.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connection_failed	.symtab	0xa44c	84	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0xb2d0	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xa740	188	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x16020	0	NOTYPE	<unknown>	DEFAULT	9
delete_list	.symtab	0x8a54	124	FUNC	<unknown>	DEFAULT	2
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ensure	.symtab	0x81cc	248	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x1a3a0	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x1a3b4	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0xc768	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xb084	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0xb0f8	80	FUNC	<unknown>	DEFAULT	2
flood.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x16014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x1624c	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0xb174	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0xbcc4	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0xce38	80	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0xd080	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0xd0ac	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0xd0d8	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xb1a0	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0xb1cc	44	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0xb83c	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0xb868	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0xd104	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x1a3b8	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0xb788	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0xb7ac	20	FUNC	<unknown>	DEFAULT	2
i.3050	.symtab	0x16050	4	OBJECT	<unknown>	DEFAULT	9
inet_addr	.symtab	0xb7c0	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0xd6a0	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x16058	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0xc1c4	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0xc4f4	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0xb1f8	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
k_head	.symtab	0x16270	4	OBJECT	<unknown>	DEFAULT	10
kill	.symtab	0xb248	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_list	.symtab	0x8be8	200	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x8e9c	132	FUNC	<unknown>	DEFAULT	2
killer_kill	.symtab	0x8690	40	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x1a3c4	4	OBJECT	<unknown>	DEFAULT	10
killer_send_result	.symtab	0x8678	24	FUNC	<unknown>	DEFAULT	2
killer_that_kills	.symtab	0x8d94	264	FUNC	<unknown>	DEFAULT	2
l_head	.symtab	0x16374	4	OBJECT	<unknown>	DEFAULT	10
last.1245	.symtab	0x16378	4	OBJECT	<unknown>	DEFAULT	10
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listen	.symtab	0xb898	44	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
locker.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
locker_init	.symtab	0x91dc	28	FUNC	<unknown>	DEFAULT	2
locker_that_locks	.symtab	0x9108	212	FUNC	<unknown>	DEFAULT	2
lseek64	.symtab	0xd130	100	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x91f8	236	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0xbb18	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0xd680	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0xd690	4	FUNC	<unknown>	DEFAULT	2
memset	.symtab	0xb6b0	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x1615c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x16174	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0xd194	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohl	.symtab	0xb750	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0xb774	20	FUNC	<unknown>	DEFAULT	2
object.2636	.symtab	0x16254	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0xb274	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0xb4a0	252	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2553	.symtab	0x1601c	0	OBJECT	<unknown>	DEFAULT	9
parser	.symtab	0x92e4	460	FUNC	<unknown>	DEFAULT	2
parser.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ping_watchdog	.symtab	0xadc8	184	FUNC	<unknown>	DEFAULT	2
prctl	.symtab	0xb2e0	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
raise	.symtab	0xd78c	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0xc0b8	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alphanum	.symtab	0x94b0	176	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0xab3c	312	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x9c7c	136	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0xa674	204	FUNC	<unknown>	DEFAULT	2
random	.symtab	0xc0bc	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0xdc1c	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0xc398	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x161a8	128	OBJECT	<unknown>	DEFAULT	9
read	.symtab	0xb310	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0xb59c	208	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0xb33c	44	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0xb8c4	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
remove_newline	.symtab	0xaa98	164	FUNC	<unknown>	DEFAULT	2
return_arch	.symtab	0xad24	28	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0xd1c0	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
search_list	.symtab	0x8fc4	192	FUNC	<unknown>	DEFAULT	2
self_name	.symtab	0x1a3c0	4	OBJECT	<unknown>	DEFAULT	10
self_realpath	.symtab	0x16274	256	OBJECT	<unknown>	DEFAULT	10
send	.symtab	0xb8f0	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
set_signals	.symtab	0xa2d0	52	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0xb368	44	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0xb91c	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0xc138	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0xc2d8	192	FUNC	<unknown>	DEFAULT	2
setup_connection	.symtab	0xa258	120	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0xccf8	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0xb978	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0xd218	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0xc7fc	420	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0xb94c	44	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0xc25c	124	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0xc25c	124	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0xc428	204	FUNC	<unknown>	DEFAULT	2
strtol	.symtab	0xc5c8	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysv_signal	.symtab	0xba9c	124	FUNC	<unknown>	DEFAULT	2
sysv_signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0xb394	44	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0xd26c	44	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
udp	.symtab	0x8534	324	FUNC	<unknown>	DEFAULT	2
unsafe_state	.symtab	0x1618c	28	OBJECT	<unknown>	DEFAULT	9
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_isalpha	.symtab	0x9bbc	108	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x9c28	84	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0xa4a0	208	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x96b8	128	FUNC	<unknown>	DEFAULT	2
util_memset	.symtab	0x97cc	108	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x9780	76	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x95e8	208	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x9738	72	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x9560	136	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x9a10	188	FUNC	<unknown>	DEFAULT	2
util_strstr	.symtab	0x9acc	240	FUNC	<unknown>	DEFAULT	2
util_strtok	.symtab	0x99d4	60	FUNC	<unknown>	DEFAULT	2
util_strtok_r	.symtab	0x9838	412	FUNC	<unknown>	DEFAULT	2
utils.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x1a3cc	4	OBJECT	<unknown>	DEFAULT	10
watch	.symtab	0x84e4	80	FUNC	<unknown>	DEFAULT	2
whitlistpaths	.symtab	0x16024	40	OBJECT	<unknown>	DEFAULT	9
write	.symtab	0xb3c0	44	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x1a3c8	4	OBJECT	<unknown>	DEFAULT	10
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x1a3d4	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x1a3d0	4	OBJECT	<unknown>	DEFAULT	10

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 21:00:09.161564112 CEST	42836	443	192.168.2.23	91.189.91.43
May 23, 2022 21:00:09.564892054 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:00:09.706414938 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:00:09.706502914 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:00:09.930169106 CEST	42516	80	192.168.2.23	109.202.202.202
May 23, 2022 21:00:10.569564104 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:00:10.710223913 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:00:10.710338116 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:00:10.710794926 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:00:10.848000050 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:00:24.778058052 CEST	43928	443	192.168.2.23	91.189.91.42
May 23, 2022 21:00:32.692651987 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:00:32.692862988 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:00:32.693440914 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:00:32.831026077 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:00:35.018115044 CEST	42836	443	192.168.2.23	91.189.91.43
May 23, 2022 21:00:41.162348986 CEST	42516	80	192.168.2.23	109.202.202.202
May 23, 2022 21:01:05.739021063 CEST	43928	443	192.168.2.23	91.189.91.42
May 23, 2022 21:01:26.219319105 CEST	42836	443	192.168.2.23	91.189.91.43
May 23, 2022 21:01:32.698990107 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:01:32.699187040 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:01:32.699282885 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:01:32.836998940 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:02:32.702836037 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:02:32.702969074 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:02:32.703066111 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:02:32.840145111 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:03:32.713033915 CEST	57468	36864	149.57.210.157	192.168.2.23
May 23, 2022 21:03:32.713578939 CEST	36864	57468	192.168.2.23	149.57.210.157
May 23, 2022 21:03:32.850825071 CEST	57468	36864	149.57.210.157	192.168.2.23

System Behavior

Analysis Process: WFBNzzTxxT PID: 6226, Parent PID: 6126

General

Start time:	21:00:08
Start date:	23/05/2022
Path:	/tmp/WFBNzzTxxT
Arguments:	/tmp/WFBNzzTxxT
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: WFBNzzTxxT PID: 6228, Parent PID: 6226

General

Start time:	21:00:08
Start date:	23/05/2022
Path:	/tmp/WFBNzzTxxT
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: WFBNzzTxxT PID: 6230, Parent PID: 6228

General

Start time:	21:00:08
Start date:	23/05/2022
Path:	/tmp/WFBNzzTxxT
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report WFBNzzTxxT

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: WFBNzzTxxT PID: 6226, Parent PID: 6126

General

Chronological Activities

Analysis Process: WFBNzzTxxT PID: 6228, Parent PID: 6226

General

Chronological Activities

Analysis Process: WFBNzzTxxT PID: 6230, Parent PID: 6228

General

Chronological Activities

Linux Analysis Report
WFBNzzTxxT