Edit tour

Linux Analysis Report
bash

Overview

General Information

Sample Name:	bash
Analysis ID:	635360
MD5:	e64c10e496d39e9d20786ff0df2f7d59
SHA1:	25d85c14f468ae6875c33934d57c12f1d3c3d8ce
SHA256:	a4ea9b6e8713da4804c10f4869208a1cada3122b906581358fc1bb2cce92ddca
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Opens /proc/net/* files useful for finding connected devices and routers

Machine Learning detection for sample

Sample contains symbols with suspicious names

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635360
Start date and time: 27/05/202220:17:25	2022-05-27 20:17:25 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	bash
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal72.spre.lin@0/0@0/0

Runtime Messages

Command:	/tmp/bash
PID:	6227
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	BUILD DONGS BUILD DONGS buf: BUILD DONGS buf: PROBING buf: PING buf: PONG buf: PING
Standard Error:

Process Tree

system is lnxubuntu20

bash (PID: 6227, Parent: 6125, MD5: e64c10e496d39e9d20786ff0df2f7d59) Arguments: /tmp/bash

bash New Fork (PID: 6228, Parent: 6227)

bash New Fork (PID: 6229, Parent: 6228)

bash New Fork (PID: 6230, Parent: 6229)

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

ETPRO TROJAN ELF/BASHLITE Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 45.95.55.12

Timestamp:	192.168.2.2345.95.55.1257822232840333 05/27/22-20:18:13.150637
SID:	2840333
Source Port:	57822
Destination Port:	23
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bash

Avira: detected

Multi AV Scanner detection for submitted file

Source: bash	Virustotal: Detection: 63%			Perma Link
Source: bash	ReversingLabs: Detection: 75%

Machine Learning detection for sample

Source: bash

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/bash (PID: 6227)

Opens: /proc/net/route

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2840333 ETPRO TROJAN ELF/BASHLITE Variant CnC Activity 192.168.2.23:57822 -> 45.95.55.12:23

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.55.12
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.55.12
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.55.12
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.55.12
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.2.2.2
Source: unknown	TCP traffic detected without corresponding DNS query: 3.3.3.3
Source: unknown	TCP traffic detected without corresponding DNS query: 4.4.4.4
Source: unknown	TCP traffic detected without corresponding DNS query: 6.6.6.6
Source: unknown	TCP traffic detected without corresponding DNS query: 5.5.5.5
Source: unknown	TCP traffic detected without corresponding DNS query: 7.7.7.7
Source: unknown	TCP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	TCP traffic detected without corresponding DNS query: 11.11.11.11
Source: unknown	TCP traffic detected without corresponding DNS query: 12.12.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 13.13.13.13
Source: unknown	TCP traffic detected without corresponding DNS query: 14.14.14.14
Source: unknown	TCP traffic detected without corresponding DNS query: 15.15.15.15
Source: unknown	TCP traffic detected without corresponding DNS query: 16.16.16.16
Source: unknown	TCP traffic detected without corresponding DNS query: 17.17.17.17
Source: unknown	TCP traffic detected without corresponding DNS query: 18.18.18.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.20.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 19.19.19.19
Source: unknown	TCP traffic detected without corresponding DNS query: 21.21.21.21
Source: unknown	TCP traffic detected without corresponding DNS query: 22.22.22.22
Source: unknown	TCP traffic detected without corresponding DNS query: 23.23.23.23
Source: unknown	TCP traffic detected without corresponding DNS query: 24.24.24.24
Source: unknown	TCP traffic detected without corresponding DNS query: 25.25.25.25
Source: unknown	TCP traffic detected without corresponding DNS query: 26.26.26.26
Source: unknown	TCP traffic detected without corresponding DNS query: 27.27.27.27
Source: unknown	TCP traffic detected without corresponding DNS query: 28.28.28.28
Source: unknown	TCP traffic detected without corresponding DNS query: 29.29.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 30.30.30.30
Source: unknown	TCP traffic detected without corresponding DNS query: 31.31.31.31
Source: unknown	TCP traffic detected without corresponding DNS query: 32.32.32.32
Source: unknown	TCP traffic detected without corresponding DNS query: 33.33.33.33
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.34.34
Source: unknown	TCP traffic detected without corresponding DNS query: 35.35.35.35
Source: unknown	TCP traffic detected without corresponding DNS query: 36.36.36.36
Source: unknown	TCP traffic detected without corresponding DNS query: 38.38.38.38
Source: unknown	TCP traffic detected without corresponding DNS query: 37.37.37.37
Source: unknown	TCP traffic detected without corresponding DNS query: 40.40.40.40
Source: unknown	TCP traffic detected without corresponding DNS query: 39.39.39.39
Source: unknown	TCP traffic detected without corresponding DNS query: 41.41.41.41
Source: unknown	TCP traffic detected without corresponding DNS query: 42.42.42.42
Source: unknown	TCP traffic detected without corresponding DNS query: 43.43.43.43
Source: unknown	TCP traffic detected without corresponding DNS query: 44.44.44.44
Source: unknown	TCP traffic detected without corresponding DNS query: 45.45.45.45
Source: unknown	TCP traffic detected without corresponding DNS query: 46.46.46.46

Source: bash

String found in binary or memory: http://45.95.55.12/bins.sh;

Source: ELF static info symbol of initial sample	Name: passwords
Source: ELF static info symbol of initial sample	Name: usernames

Source: classification engine

Classification label: mal72.spre.lin@0/0@0/0

Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/mempcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/memset.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strcat.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strchr.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strlen.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strpbrk.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strspn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/x86_64/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/x86_64/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/x86_64/crtn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/x86_64/vfork.S

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bash	64%	Virustotal		Browse
bash	75%	ReversingLabs	Linux.Trojan.Gafgyt
bash	100%	Avira	LINUX/Gafgyt.vka
bash	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://45.95.55.12/bins.sh;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.95.55.12/bins.sh;	bash	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.109.109.109	unknown	Netherlands	30925	SPEEDXS-ASNL	false
192.177.189.95	unknown	United States	18779	EGIHOSTINGUS	false
194.130.207.176	unknown	United Kingdom	702	UUNETUS	false
155.202.56.76	unknown	United Kingdom	8698	NationwideBuildingSocietyGB	false
207.207.207.207	unknown	United States	10823	NETCARRIERUS	false
168.215.69.89	unknown	United States	10753	LVLT-10753US	false
191.127.204.173	unknown	Chile	7418	TELEFONICACHILESACL	false
122.122.122.122	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
118.165.19.39	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
155.90.193.199	unknown	United States	4010	DNIC-AS-04010US	false
129.64.167.173	unknown	United States	10561	BRANDEISUS	false
59.59.59.59	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
146.146.146.146	unknown	United States	197938	TRAVIANGAMESDE	false
220.220.220.220	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
110.110.110.110	unknown	China	38341	CNNIC-HCENET-APHEXIEInformationtechnologyCoLtdCN	false
181.116.219.225	unknown	Argentina	11664	TechtelLMDSComunicacionesInteractivasSAAR	false
138.73.176.182	unknown	Canada	611	NECN-1-611CA	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
120.167.21.41	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
72.72.72.72	unknown	United States	701	UUNETUS	false
158.158.158.158	unknown	Singapore	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
171.171.171.171	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
188.235.89.109	unknown	Russian Federation	50498	LIPETSK-ASRU	false
91.27.104.73	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
152.199.53.73	unknown	United States	15133	EDGECASTUS	false
147.82.185.191	unknown	Saudi Arabia	1761	TDIR-CAPNETUS	false
183.183.183.183	unknown	Japan	45684	MIRAINETKyoceraCommunicationSystemsCoLtdJP	false
200.135.238.244	unknown	Brazil	10715	UniversidadeFederaldeSantaCatarinaBR	false
134.119.131.37	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	false
168.153.165.71	unknown	Australia	2764	AAPTAAPTLimitedAU	false
50.50.50.50	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
130.115.127.33	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
174.221.75.95	unknown	United States	22394	CELLCOUS	false
119.54.157.163	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
137.72.175.181	unknown	United States	37440	Airtel-MW	false
145.80.183.189	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
169.104.207.213	unknown	United States	37611	AfrihostZA	false
176.112.189.158	unknown	Slovakia (SLOVAK Republic)	58044	ASFREEZONASK	false
122.107.119.25	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
135.120.132.38	unknown	United States	10455	LUCENT-CIOUS	false
139.124.136.42	unknown	France	2457	FR-RAIMU-2ReseaudecollectedesUniversitesdAixMarseill	false
248.233.245.151	unknown	Reserved	unknown	unknown	false
87.87.87.87	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
170.217.71.91	unknown	United States	8103	STATE-OF-FLAUS	false
128.63.166.172	unknown	United States	13	DNIC-AS-00013US	false
37.37.37.37	unknown	Kuwait	42961	GPRS-ASZAINKW	false
199.246.100.120	unknown	Canada	23251	BFRCUS	false
164.100.177.146	unknown	India	4758	NICNET-VSNL-BOARDER-APNationalInformaticsCentreIN	false
192.239.93.113	unknown	United States	36143	IW-AWI-ASNUS	false
146.81.184.190	unknown	Finland	41648	RUUKKIFI	false
15.15.15.15	unknown	United States	13979	ATT-IPFRUS	false
219.219.219.219	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
185.185.185.185	unknown	Netherlands	52165	BALTSPORT-ASRU	false
83.18.121.127	unknown	Poland	5617	TPNETPL	false
173.173.173.173	unknown	United States	11427	TWC-11427-TEXASUS	false
246.231.243.149	unknown	Reserved	unknown	unknown	false
92.27.130.136	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
243.228.240.146	unknown	Reserved	unknown	unknown	false
143.190.44.64	unknown	United States	17477	MCT-SYDNEYMacquarieTelecomAU	false
200.136.213.182	unknown	Brazil	52888	UNIVERSIDADEFEDERALDESAOCARLOSBR	false
203.188.200.106	unknown	Taiwan; Republic of China (ROC)	24506	YAHOO-TP2YAHOOTAIWANTW	false
106.42.119.88	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
206.191.203.109	unknown	United States	53340	FIBERHUBUS	false
139.74.177.183	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
222.222.222.222	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
250.235.247.153	unknown	Reserved	unknown	unknown	false
151.136.148.54	unknown	Germany	205881	MANDE	false
112.112.112.112	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.197.197.197	unknown	Egypt	36992	ETISALAT-MISREG	false
208.193.205.111	unknown	United States	701	UUNETUS	false
99.34.137.143	unknown	United States	7018	ATT-INTERNET4US	false
119.119.119.119	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
137.184.38.58	unknown	United States	11003	PANDGUS	false
217.217.217.217	unknown	Spain	12357	COMUNITELSPAINES	false
210.210.210.210	unknown	Korea Republic of	9756	CHEONANVITSSEN-AS-KRTbroadChungbuBroadcastingCoKR	false
71.71.71.71	unknown	United States	11426	TWC-11426-CAROLINASUS	false
107.107.107.107	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
100.100.100.100	unknown	Reserved	701	UUNETUS	false
191.126.229.235	unknown	Chile	7418	TELEFONICACHILESACL	false
82.17.120.126	unknown	United Kingdom	5089	NTLGB	false
163.148.160.66	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
210.195.207.113	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
94.94.94.94	unknown	Italy	3269	ASN-IBSNAZIT	false
148.83.186.192	unknown	Norway	2116	ASN-CATCHCOMNO	false
149.84.187.193	unknown	United States	13513	ALFRED-UNIVERSITYUS	false
168.168.168.168	unknown	United States	38027	MOST-AS-APInformationCenterMinistryofSciandTechCN	false
190.237.91.111	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
98.33.136.142	unknown	United States	7922	COMCAST-7922US	false
144.191.45.65	unknown	United States	19773	MOTOROLAUS	false
189.174.186.92	unknown	Mexico	8151	UninetSAdeCVMX	false
93.93.93.93	unknown	Russian Federation	34879	CCT-ASNGENIXRU	false
210.145.248.254	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
161.161.161.161	unknown	United States	263740	CorporacionLaceibanetsocietyHN	false
205.205.205.205	unknown	United States	701	UUNETUS	false
124.171.25.45	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
89.24.127.133	unknown	Czech Republic	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
36.36.36.36	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
73.73.73.73	unknown	United States	7922	COMCAST-7922US	false
112.47.150.156	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
116.51.154.160	unknown	Singapore	17645	NTT-SG-APASN-NTTSINGAPOREPTELTDSG	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.822909214549378
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bash
File size:	88523
MD5:	e64c10e496d39e9d20786ff0df2f7d59
SHA1:	25d85c14f468ae6875c33934d57c12f1d3c3d8ce
SHA256:	a4ea9b6e8713da4804c10f4869208a1cada3122b906581358fc1bb2cce92ddca
SHA512:	690dcc666f367124bc44544f8dd424b51cacaaa7b21256007fd517e805abf835cc3fe35438832426c9c1560c8336a19edd0b43a5c6c519a6fb008466068857ef
SSDEEP:	1536:q6u1g3LMtD2qtAoaEeo6GJ+NPyJax67m4fkr66dnjtwOUeIpnKJRU:q71gBq2Ljo6hPyo67zCbdnjtwOFIp
TLSH:	0983082B9251C1BEC08346B52ADB9961AC73FC390B3662067395BE6C3F36CDC5D99342
File Content Preview:	.ELF..............>.......@.....@.......p...........@.8...@.......................@.......@...............................................P.......P.....P.......Hn..............Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	65136
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xc6f8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40c7f8	0xc7f8	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40c820	0xc820	0x24b0	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x40ecd0	0xecd0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x50f000	0xf000	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x50f010	0xf010	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x50f020	0xf020	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x50f040	0xf040	0x510	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x50f560	0xf550	0x68e8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0xf550	0x8b8	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xfe08	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x10230	0x3a98	0x18	0x0		14	219	8
.strtab	STRTAB	0x0	0x13cc8	0x1d03	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xecd4	0xecd4	3.2826	0x5	R E	0x100000	.init .text .fini .rodata .eh_frame
LOAD	0xf000	0x50f000	0x50f000	0x550	0x6e48	1.3178	0x6	RW	0x100000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40c7f8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40c820	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x40ecd0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x50f000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x50f010	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x50f020	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x50f040	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x50f560	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
Q	.symtab	0x50f5e0	16384	OBJECT	<unknown>	DEFAULT	10
StartTheLelz	.symtab	0x402699	5079	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x50f008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x50f000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x50f138	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40d460	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x50f148	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40d760	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x50f018	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x50f010	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x40ecd0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x40ecd0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x50f138	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x40d460	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x50f148	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x40d760	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x50f140	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x50f150	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x4070f8	6	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x408cf4	14	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x406c88	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_lseek	.symtab	0x40c790	45	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x406ec8	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x40aab0	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40ab2f	67	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x408d04	194	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x406cec	42	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x409e74	276	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x40a4a8	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x40c3f4	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x406d18	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x40aea4	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x406d40	41	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x408ef0	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x406d6c	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x5156bc	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x40a690	287	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x40aed0	38	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x40a634	92	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x40b158	259	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x406c88	100	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x406c88	100	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x40b25c	54	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40bf4c	329	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x406d98	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x4083a8	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40c420	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40c428	218	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x4083e0	134	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x406dc0	35	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x40aef8	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x40af20	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x40af48	38	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x40af70	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x406de4	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x406e0c	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x408f1c	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x40af84	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x5156c0	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x408ed4	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40c33c	137	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x408ec9	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x408e7c	77	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x40a29f	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x406e34	104	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x408dd4	25	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x406e9c	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40c790	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40c788	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40c0fc	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x408470	102	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40c0a0	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40c1ec	237	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x4084e0	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x40ae74	48	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40afac	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x40afd4	38	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x406ec8	106	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x406f40	38	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x407100	157	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40c3c8	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x409f94	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x40a19c	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40c6c8	190	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x406f94	39	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x408f7c	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x408f88	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40affc	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x406fbc	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x408fb8	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x408fc4	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x406fe8	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x408ff4	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x40a0f4	168	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x40ad65	247	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x40905c	35	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x409080	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x409094	168	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x407010	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x40a7b0	415	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x40902c	47	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x40a1f6	169	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x4085c0	428	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x408770	417	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x408920	213	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x408a00	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x408ae4	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x408b68	206	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40c5b0	140	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40c640	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x408c38	187	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x408dc8	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40c2dc	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40a4bc	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x40a4bc	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x40a950	351	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x408df0	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x407068	39	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x4070d8	30	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x406c70	21	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x407570	143	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40b048	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x407090	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40b078	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40b0cc	140	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40b0bc	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x407098	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x50f020	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x50f020	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x5156a8	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x50f520	40	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x409094	168	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x50f550	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40aafa	53	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x50f140	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x50f150	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x5156c8	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x50f050	0	NOTYPE	<unknown>	DEFAULT	9
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x40c7c0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x50f040	0	OBJECT	<unknown>	HIDDEN	9
__environ	.symtab	0x515698	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x4070f8	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x515688	8	OBJECT	<unknown>	HIDDEN	10
__fini_array_end	.symtab	0x50f000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x50f000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__getpagesize	.symtab	0x40af70	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x408cf4	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x50f000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x50f000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x406d40	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x408ef0	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x406f32	14	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x406c88	100	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x406c88	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x406d98	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x406de4	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40c790	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40c788	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x40afd4	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x406ec8	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x406f94	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x408f7c	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x408f88	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x406fbc	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x408fb8	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x408fc4	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x40ad65	247	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x515690	8	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x40a358	335	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x407090	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x407098	42	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x409af9	410	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x409198	96	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x50f3a0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x515760	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x409a60	153	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x5156a0	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x50f000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x50f000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40aaf6	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x40aaf6	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x40aaf6	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x40aaf6	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x40aaf6	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x40aaf9	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x40c3c8	18	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_rt	.symtab	0x40ad5c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x5156b0	8	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x40915c	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x409178	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x40913c	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x50f178	8	OBJECT	<unknown>	DEFAULT	9
__stdio_WRITE	.symtab	0x40b294	147	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40c504	133	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40b550	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x4074af	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4280	.symtab	0x40da80	40	OBJECT	<unknown>	DEFAULT	4
__stdio_seek	.symtab	0x40c58c	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40b654	148	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x407548	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x50f180	8	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x40ae5c	22	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x40aab0	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40ab2f	67	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x40ab72	489	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x50f548	8	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x406c70	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x408d04	194	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x407600	68	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x40c3dc	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x515e38	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x515e40	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x50f550	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x515e48	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x5156bc	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x406cec	42	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40c7f8	5	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x513660	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x407644	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40b82c	1608	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x5156c0	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	5	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x40b6e8	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x407cf8	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x407faa	1022	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x407d6c	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x407db0	457	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x407f7c	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x40aaf9	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40aaf9	1	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x5156e0	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40b328	551	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x407444	107	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x50f188	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x50f1a0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40be74	216	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x513644	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x50f1e0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x513640	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x50f220	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x4074be	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x50f208	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40a4c8	362	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40b740	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40db80	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40b770	187	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x4076bc	1595	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x409e74	276	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x40a4a8	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x515680	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.3160	.symtab	0x5156b8	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x40c3f4	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x409094	168	FUNC	<unknown>	DEFAULT	2
buf.2989	.symtab	0x515670	16	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x50f130	4	OBJECT	<unknown>	DEFAULT	9
chdir	.symtab	0x406d18	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x40aea4	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x406d40	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x50f068	8	OBJECT	<unknown>	DEFAULT	9
completed.2761	.symtab	0x50f560	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x408ef0	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4018ed	572	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x406f32	14	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x4024a0	115	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x50f070	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x50f050	0	NOTYPE	<unknown>	DEFAULT	9
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x406d6c	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x515698	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x5156bc	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x40a690	287	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x40aed0	38	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x40a634	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x40ec00	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x40b158	259	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x406c88	100	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x406c88	100	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x40113e	128	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x40b25c	54	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fdopen_pids	.symtab	0x5135e0	8	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x400fce	368	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x400df2	476	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x40bf4c	329	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x40ebe0	20	OBJECT	<unknown>	DEFAULT	4
fork	.symtab	0x406d98	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x4083a8	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x409c93	452	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40c420	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40c420	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40c428	218	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x4083e0	134	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBogos	.symtab	0x4013c2	470	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x4064de	11	FUNC	<unknown>	DEFAULT	2
getCores	.symtab	0x401598	153	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x401346	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x4062fa	484	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x402471	47	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x4020b3	958	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x406dc0	35	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x40aef8	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x40af20	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40af48	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x40af70	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x406de4	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x406e0c	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x406e0c	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x408f1c	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x408f48	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40af84	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x50f5c4	4	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x5156c0	4	OBJECT	<unknown>	DEFAULT	10
hextable	.symtab	0x40ca40	2048	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x408e68	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x408e60	8	FUNC	<unknown>	DEFAULT	2
i.4537	.symtab	0x50f134	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x408770	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x408ed4	28	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40c33c	137	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x408ec9	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x408e7c	77	FUNC	<unknown>	DEFAULT	2
infectline	.symtab	0x50f060	8	OBJECT	<unknown>	DEFAULT	9
initConnection	.symtab	0x4061d0	298	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001c0	125	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x40a03e	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x40a29f	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x406e34	104	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState	.symtab	0x5135e8	5	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x408dd4	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x4070c4	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x406e9c	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcat.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x401b29	201	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40c790	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40c788	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x50f5d0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x4064e9	1926	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x50f5c0	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x4025d2	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x401631	109	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x4091f8	2149	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x409e57	28	FUNC	<unknown>	DEFAULT	2
matchPrompt	.symtab	0x401d10	345	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40c0fc	240	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x408470	102	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x40c0a0	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x40c1ec	237	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x4084e0	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x40ae74	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x40afac	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x513600	40	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x50f3e0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x50f420	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x40afd4	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x401bf2	286	FUNC	<unknown>	DEFAULT	2
next_start.1440	.symtab	0x515660	8	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x408e75	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x408e6d	8	FUNC	<unknown>	DEFAULT	2
numpids	.symtab	0x50f5c8	8	OBJECT	<unknown>	DEFAULT	10
object.2814	.symtab	0x50f580	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x406ec8	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x5156d0	4	OBJECT	<unknown>	DEFAULT	10
p.2759	.symtab	0x50f048	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x4011be	84	FUNC	<unknown>	DEFAULT	2
passwords	.symtab	0x50f0c0	112	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x4071a0	190	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x5156d8	8	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x406f40	38	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x40725e	485	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x513628	8	OBJECT	<unknown>	DEFAULT	10
prctl	.symtab	0x406f68	44	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4494	.symtab	0x40dab5	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x400627	1085	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x4003bd	75	FUNC	<unknown>	DEFAULT	2
printf	.symtab	0x407100	157	FUNC	<unknown>	DEFAULT	2
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printi	.symtab	0x4004e7	320	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x400408	223	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x404fc7	4617	FUNC	<unknown>	DEFAULT	2
qual_chars.4498	.symtab	0x40dad0	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40c3c8	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x409f88	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40023d	179	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x409f94	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x40e6e0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x40a19c	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x50f4a0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40c6c8	190	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x406f94	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readUntil	.symtab	0x401e69	586	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x408f7c	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x40169e	591	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x408f88	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sbrk	.symtab	0x40affc	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x5156d4	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x40266b	46	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x406fbc	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x408fb8	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendCNC	.symtab	0x403f4f	161	FUNC	<unknown>	DEFAULT	2
sendHOLD	.symtab	0x404b24	1187	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x403ff0	191	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x404706	1054	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0x4040af	1623	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x403a70	1247	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x408fc4	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x406fe8	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x408ff4	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x409fdc	98	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x40a0f4	168	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x40ad65	247	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x40905c	35	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x409080	20	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x409094	168	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x407010	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x40a7b0	415	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x40902c	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sockprintf	.symtab	0x400c2c	454	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4497	.symtab	0x40daf0	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4493	.symtab	0x40dac1	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4494	.symtab	0x40db20	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4493	.symtab	0x40db35	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4496	.symtab	0x40db00	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4495	.symtab	0x40db10	9	OBJECT	<unknown>	DEFAULT	4
srand	.symtab	0x40a0ac	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x40a0ac	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x40a1f6	169	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x50f170	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x50f160	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x50f168	8	OBJECT	<unknown>	DEFAULT	9
strcat	.symtab	0x4085c0	428	FUNC	<unknown>	DEFAULT	2
strchr	.symtab	0x408770	417	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x408920	213	FUNC	<unknown>	DEFAULT	2
strerror_r	.symtab	0x408d04	194	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x408a00	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x408ae4	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x408b68	206	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40c5b0	140	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x40c640	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x408c38	187	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x40a4bc	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x408dc8	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40c2dc	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40a4bc	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x40a4bc	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x40a950	351	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x40a358	335	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x400b47	229	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x408df0	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x402513	191	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x407068	39	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x4070d8	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x4002f0	205	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x40db40	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40db58	12	OBJECT	<unknown>	DEFAULT	4
unknown.2050	.symtab	0x40db64	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x50f460	48	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x401387	59	FUNC	<unknown>	DEFAULT	2
usernames	.symtab	0x50f080	48	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x406c70	21	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x407570	143	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x40b048	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x407090	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40b078	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40b0cc	140	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40b0bc	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x401212	308	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x407098	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
zprintf	.symtab	0x400a64	227	FUNC	<unknown>	DEFAULT	2

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.2345.95.55.1257822232840333 05/27/22-20:18:13.150637	TCP	2840333	ETPRO TROJAN ELF/BASHLITE Variant CnC Activity	57822	23	192.168.2.23	45.95.55.12

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 20:18:12.306025982 CEST	42836	443	192.168.2.23	91.189.91.43
May 27, 2022 20:18:13.073807001 CEST	42516	80	192.168.2.23	109.202.202.202
May 27, 2022 20:18:13.106779099 CEST	57822	23	192.168.2.23	45.95.55.12
May 27, 2022 20:18:13.129060984 CEST	23	57822	45.95.55.12	192.168.2.23
May 27, 2022 20:18:13.129167080 CEST	57822	23	192.168.2.23	45.95.55.12
May 27, 2022 20:18:13.150636911 CEST	57822	23	192.168.2.23	45.95.55.12
May 27, 2022 20:18:13.152182102 CEST	23	57822	45.95.55.12	192.168.2.23
May 27, 2022 20:18:13.152285099 CEST	57822	23	192.168.2.23	45.95.55.12
May 27, 2022 20:18:13.170412064 CEST	48156	23	192.168.2.23	1.1.1.1
May 27, 2022 20:18:13.170437098 CEST	42518	23	192.168.2.23	2.2.2.2
May 27, 2022 20:18:13.170475006 CEST	49592	23	192.168.2.23	3.3.3.3
May 27, 2022 20:18:13.170485020 CEST	54708	23	192.168.2.23	4.4.4.4
May 27, 2022 20:18:13.170495033 CEST	49082	23	192.168.2.23	6.6.6.6
May 27, 2022 20:18:13.170495033 CEST	40162	23	192.168.2.23	5.5.5.5
May 27, 2022 20:18:13.170521975 CEST	57832	23	192.168.2.23	7.7.7.7
May 27, 2022 20:18:13.170542002 CEST	57140	23	192.168.2.23	9.9.9.9
May 27, 2022 20:18:13.170547962 CEST	46260	23	192.168.2.23	8.8.8.8
May 27, 2022 20:18:13.170566082 CEST	36010	23	192.168.2.23	10.10.10.10
May 27, 2022 20:18:13.170594931 CEST	60458	23	192.168.2.23	11.11.11.11
May 27, 2022 20:18:13.170607090 CEST	40378	23	192.168.2.23	12.12.12.12
May 27, 2022 20:18:13.170609951 CEST	40662	23	192.168.2.23	13.13.13.13
May 27, 2022 20:18:13.170625925 CEST	43998	23	192.168.2.23	14.14.14.14
May 27, 2022 20:18:13.170648098 CEST	53602	23	192.168.2.23	15.15.15.15
May 27, 2022 20:18:13.170661926 CEST	50192	23	192.168.2.23	16.16.16.16
May 27, 2022 20:18:13.170691013 CEST	53766	23	192.168.2.23	17.17.17.17
May 27, 2022 20:18:13.170701981 CEST	32872	23	192.168.2.23	18.18.18.18
May 27, 2022 20:18:13.170718908 CEST	49356	23	192.168.2.23	20.20.20.20
May 27, 2022 20:18:13.170720100 CEST	43210	23	192.168.2.23	19.19.19.19
May 27, 2022 20:18:13.170749903 CEST	51758	23	192.168.2.23	21.21.21.21
May 27, 2022 20:18:13.170754910 CEST	49702	23	192.168.2.23	22.22.22.22
May 27, 2022 20:18:13.170772076 CEST	57016	23	192.168.2.23	23.23.23.23
May 27, 2022 20:18:13.170792103 CEST	58444	23	192.168.2.23	24.24.24.24
May 27, 2022 20:18:13.170804977 CEST	46128	23	192.168.2.23	25.25.25.25
May 27, 2022 20:18:13.170818090 CEST	43776	23	192.168.2.23	26.26.26.26
May 27, 2022 20:18:13.170840979 CEST	52116	23	192.168.2.23	27.27.27.27
May 27, 2022 20:18:13.170862913 CEST	37030	23	192.168.2.23	28.28.28.28
May 27, 2022 20:18:13.170878887 CEST	48866	23	192.168.2.23	29.29.29.29
May 27, 2022 20:18:13.170892954 CEST	35570	23	192.168.2.23	30.30.30.30
May 27, 2022 20:18:13.170908928 CEST	33118	23	192.168.2.23	31.31.31.31
May 27, 2022 20:18:13.170928001 CEST	53602	23	192.168.2.23	32.32.32.32
May 27, 2022 20:18:13.170933962 CEST	51350	23	192.168.2.23	33.33.33.33
May 27, 2022 20:18:13.170953035 CEST	52152	23	192.168.2.23	34.34.34.34
May 27, 2022 20:18:13.170964003 CEST	57370	23	192.168.2.23	35.35.35.35
May 27, 2022 20:18:13.170972109 CEST	39192	23	192.168.2.23	36.36.36.36
May 27, 2022 20:18:13.171006918 CEST	48986	23	192.168.2.23	38.38.38.38
May 27, 2022 20:18:13.171008110 CEST	51668	23	192.168.2.23	37.37.37.37
May 27, 2022 20:18:13.171015024 CEST	41630	23	192.168.2.23	40.40.40.40
May 27, 2022 20:18:13.171022892 CEST	55140	23	192.168.2.23	39.39.39.39
May 27, 2022 20:18:13.171045065 CEST	41622	23	192.168.2.23	41.41.41.41
May 27, 2022 20:18:13.171053886 CEST	56658	23	192.168.2.23	42.42.42.42
May 27, 2022 20:18:13.171066999 CEST	39688	23	192.168.2.23	43.43.43.43
May 27, 2022 20:18:13.171083927 CEST	23	57822	45.95.55.12	192.168.2.23
May 27, 2022 20:18:13.171086073 CEST	60462	23	192.168.2.23	44.44.44.44
May 27, 2022 20:18:13.171088934 CEST	34152	23	192.168.2.23	45.45.45.45
May 27, 2022 20:18:13.171108007 CEST	54502	23	192.168.2.23	46.46.46.46
May 27, 2022 20:18:13.171132088 CEST	48926	23	192.168.2.23	47.47.47.47
May 27, 2022 20:18:13.171144009 CEST	35586	23	192.168.2.23	48.48.48.48
May 27, 2022 20:18:13.171148062 CEST	57822	23	192.168.2.23	45.95.55.12
May 27, 2022 20:18:13.171164036 CEST	43286	23	192.168.2.23	49.49.49.49
May 27, 2022 20:18:13.171179056 CEST	53458	23	192.168.2.23	50.50.50.50
May 27, 2022 20:18:13.171195984 CEST	41166	23	192.168.2.23	51.51.51.51
May 27, 2022 20:18:13.171205044 CEST	58676	23	192.168.2.23	52.52.52.52
May 27, 2022 20:18:13.171216011 CEST	60164	23	192.168.2.23	53.53.53.53
May 27, 2022 20:18:13.171225071 CEST	34744	23	192.168.2.23	54.54.54.54
May 27, 2022 20:18:13.171255112 CEST	49552	23	192.168.2.23	55.55.55.55
May 27, 2022 20:18:13.171271086 CEST	49258	23	192.168.2.23	56.56.56.56
May 27, 2022 20:18:13.171287060 CEST	43860	23	192.168.2.23	57.57.57.57
May 27, 2022 20:18:13.171300888 CEST	52364	23	192.168.2.23	58.58.58.58
May 27, 2022 20:18:13.171318054 CEST	40474	23	192.168.2.23	59.59.59.59
May 27, 2022 20:18:13.171333075 CEST	39440	23	192.168.2.23	60.60.60.60
May 27, 2022 20:18:13.171354055 CEST	55010	23	192.168.2.23	61.61.61.61
May 27, 2022 20:18:13.171379089 CEST	34540	23	192.168.2.23	62.62.62.62
May 27, 2022 20:18:13.171397924 CEST	38972	23	192.168.2.23	63.63.63.63
May 27, 2022 20:18:13.171416044 CEST	33374	23	192.168.2.23	64.64.64.64
May 27, 2022 20:18:13.171425104 CEST	44114	23	192.168.2.23	65.65.65.65
May 27, 2022 20:18:13.171456099 CEST	36396	23	192.168.2.23	66.66.66.66
May 27, 2022 20:18:13.171457052 CEST	39006	23	192.168.2.23	67.67.67.67
May 27, 2022 20:18:13.171473026 CEST	34646	23	192.168.2.23	68.68.68.68
May 27, 2022 20:18:13.171489000 CEST	51510	23	192.168.2.23	69.69.69.69
May 27, 2022 20:18:13.171505928 CEST	57142	23	192.168.2.23	70.70.70.70
May 27, 2022 20:18:13.171521902 CEST	45526	23	192.168.2.23	71.71.71.71
May 27, 2022 20:18:13.171535015 CEST	43466	23	192.168.2.23	72.72.72.72
May 27, 2022 20:18:13.171552896 CEST	33770	23	192.168.2.23	73.73.73.73
May 27, 2022 20:18:13.171566010 CEST	53044	23	192.168.2.23	74.74.74.74
May 27, 2022 20:18:13.171583891 CEST	56002	23	192.168.2.23	75.75.75.75
May 27, 2022 20:18:13.171595097 CEST	46262	23	192.168.2.23	76.76.76.76
May 27, 2022 20:18:13.171608925 CEST	49008	23	192.168.2.23	77.77.77.77
May 27, 2022 20:18:13.171622992 CEST	54772	23	192.168.2.23	78.78.78.78
May 27, 2022 20:18:13.171647072 CEST	48066	23	192.168.2.23	79.79.79.79
May 27, 2022 20:18:13.171653032 CEST	41580	23	192.168.2.23	80.80.80.80
May 27, 2022 20:18:13.171660900 CEST	37382	23	192.168.2.23	81.81.81.81
May 27, 2022 20:18:13.171684027 CEST	43568	23	192.168.2.23	82.82.82.82
May 27, 2022 20:18:13.171709061 CEST	57584	23	192.168.2.23	83.83.83.83
May 27, 2022 20:18:13.171716928 CEST	51010	23	192.168.2.23	84.84.84.84
May 27, 2022 20:18:13.171749115 CEST	46518	23	192.168.2.23	85.85.85.85
May 27, 2022 20:18:13.171760082 CEST	40786	23	192.168.2.23	86.86.86.86
May 27, 2022 20:18:13.171780109 CEST	59264	23	192.168.2.23	87.87.87.87
May 27, 2022 20:18:13.171789885 CEST	56450	23	192.168.2.23	88.88.88.88
May 27, 2022 20:18:13.171806097 CEST	49692	23	192.168.2.23	89.89.89.89
May 27, 2022 20:18:13.171823025 CEST	33758	23	192.168.2.23	90.90.90.90

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 27, 2022 20:18:13.182437897 CEST	91.206.52.12	192.168.2.23	38c1	(Unknown)	Destination Unreachable
May 27, 2022 20:18:13.228790045 CEST	84.88.18.18	192.168.2.23	f3c2	(Net unreachable)	Destination Unreachable
May 27, 2022 20:18:13.242332935 CEST	185.31.199.2	192.168.2.23	27f1	(Time to live exceeded in transit)	Time Exceeded
May 27, 2022 20:18:13.313147068 CEST	4.79.101.74	192.168.2.23	5a7	(Net unreachable)	Destination Unreachable
May 27, 2022 20:18:13.376935005 CEST	105.25.144.9	192.168.2.23	2254	(Time to live exceeded in transit)	Time Exceeded
May 27, 2022 20:18:13.549319983 CEST	59.180.210.198	192.168.2.23	b58c	(Time to live exceeded in transit)	Time Exceeded
May 27, 2022 20:18:14.396152973 CEST	189.124.227.233	192.168.2.23	614a	(Unknown)	Destination Unreachable

System Behavior

Analysis Process: bash PID: 6227, Parent PID: 6125

General

Start time:	20:18:12
Start date:	27/05/2022
Path:	/tmp/bash
Arguments:	/tmp/bash
File size:	88523 bytes
MD5 hash:	e64c10e496d39e9d20786ff0df2f7d59

Analysis Process: bash PID: 6228, Parent PID: 6227

General

Start time:	20:18:12
Start date:	27/05/2022
Path:	/tmp/bash
Arguments:	n/a
File size:	88523 bytes
MD5 hash:	e64c10e496d39e9d20786ff0df2f7d59

Analysis Process: bash PID: 6229, Parent PID: 6228

General

Start time:	20:18:12
Start date:	27/05/2022
Path:	/tmp/bash
Arguments:	n/a
File size:	88523 bytes
MD5 hash:	e64c10e496d39e9d20786ff0df2f7d59

Analysis Process: bash PID: 6230, Parent PID: 6229

General

Start time:	20:18:12
Start date:	27/05/2022
Path:	/tmp/bash
Arguments:	n/a
File size:	88523 bytes
MD5 hash:	e64c10e496d39e9d20786ff0df2f7d59

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bash

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

ICMP Packets

System Behavior

Analysis Process: bash PID: 6227, Parent PID: 6125

General

Analysis Process: bash PID: 6228, Parent PID: 6227

General

Analysis Process: bash PID: 6229, Parent PID: 6228

General

Analysis Process: bash PID: 6230, Parent PID: 6229

General

Linux Analysis Report
bash