Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
x-3.2-.SNOOPY

Overview

General Information

Sample Name:x-3.2-.SNOOPY
Analysis ID:679558
MD5:ca34f09d0fe8bd0dddd1443e401781d7
SHA1:da043d55a48b11f1c0b47b38bd2bb279454a3ac4
SHA256:3d4c4cc860a146597b5830fa4e4c5ab9a5eb32304bd88a9e6256452740998727
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Contains symbols with names commonly found in malware
Opens /proc/net/* files useful for finding connected devices and routers
Machine Learning detection for sample
Yara signature match
Executes the "wget" command typically used for HTTP/S downloading
Sample contains strings that are user agent strings indicative of HTTP manipulation
Executes the "uname" command used to read OS and architecture name
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679558
Start date and time: 06/08/202201:52:112022-08-06 01:52:11 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 34s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:x-3.2-.SNOOPY
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal76.spre.linSNOOPY@0/3@0/0

Runtime Messages

Command:/tmp/x-3.2-.SNOOPY
PID:6319
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • sh (PID: 6264, Parent: 6186, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
    • sh New Fork (PID: 6265, Parent: 6264)
    • rsyslog-rotate (PID: 6265, Parent: 6264, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate
      • systemctl (PID: 6266, Parent: 6265, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service
  • uname (PID: 6269, Parent: 6218, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -p
  • dash New Fork (PID: 6272, Parent: 6271)
  • cut (PID: 6272, Parent: 6271, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -40 /tmp/tmp.5piRJmkiY5
  • dash New Fork (PID: 6273, Parent: 6271)
  • tr (PID: 6273, Parent: 6271, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -c -d [:alnum:]
  • dash New Fork (PID: 6276, Parent: 6184)
  • wget (PID: 6276, Parent: 6184, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com
  • dash New Fork (PID: 6278, Parent: 6184)
  • cat (PID: 6278, Parent: 6184, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.hDXKGVsUIR
  • dash New Fork (PID: 6279, Parent: 6184)
  • head (PID: 6279, Parent: 6184, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6280, Parent: 6184)
  • tr (PID: 6280, Parent: 6184, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6281, Parent: 6184)
  • cut (PID: 6281, Parent: 6184, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6282, Parent: 6184)
  • cat (PID: 6282, Parent: 6184, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.hDXKGVsUIR
  • dash New Fork (PID: 6283, Parent: 6184)
  • head (PID: 6283, Parent: 6184, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6284, Parent: 6184)
  • tr (PID: 6284, Parent: 6184, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6285, Parent: 6184)
  • cut (PID: 6285, Parent: 6184, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6286, Parent: 6184)
  • rm (PID: 6286, Parent: 6184, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.hDXKGVsUIR /tmp/tmp.1y2FR6QFox /tmp/tmp.5piRJmkiY5
  • x-3.2-.SNOOPY (PID: 6319, Parent: 6126, MD5: ca34f09d0fe8bd0dddd1443e401781d7) Arguments: /tmp/x-3.2-.SNOOPY
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
x-3.2-.SNOOPYLinux_Trojan_Gafgyt_6122acdfunknownunknown
  • 0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
x-3.2-.SNOOPYLinux_Trojan_Gafgyt_1b2e2a3aunknownunknown
  • 0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
x-3.2-.SNOOPYLinux_Trojan_Gafgyt_9127f7beunknownunknown
  • 0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1

Memory Dumps

SourceRuleDescriptionAuthorStrings
6322.1.0000000008048000.0000000008055000.r-x.sdmpLinux_Trojan_Gafgyt_6122acdfunknownunknown
  • 0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
6322.1.0000000008048000.0000000008055000.r-x.sdmpLinux_Trojan_Gafgyt_1b2e2a3aunknownunknown
  • 0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
6322.1.0000000008048000.0000000008055000.r-x.sdmpLinux_Trojan_Gafgyt_9127f7beunknownunknown
  • 0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
6319.1.0000000008048000.0000000008055000.r-x.sdmpLinux_Trojan_Gafgyt_6122acdfunknownunknown
  • 0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
6319.1.0000000008048000.0000000008055000.r-x.sdmpLinux_Trojan_Gafgyt_1b2e2a3aunknownunknown
  • 0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
Click to see the 1 entries

Snort Signatures

Timestamp:192.168.2.23163.123.143.81399068392841335 08/06/22-01:53:00.671113
SID:2841335
Source Port:39906
Destination Port:839
Protocol:TCP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: x-3.2-.SNOOPYVirustotal: Detection: 57%Perma Link
Source: x-3.2-.SNOOPYReversingLabs: Detection: 58%
Machine Learning detection for sample
Source: x-3.2-.SNOOPYJoe Sandbox ML: detected

Spreading

barindex
Opens /proc/net/* files useful for finding connected devices and routers
Source: /tmp/x-3.2-.SNOOPY (PID: 6319)Opens: /proc/net/route

Networking

barindex
Snort IDS alert for network traffic
Source: TrafficSnort IDS: 2841335 ETPRO TROJAN ELF/Mirai Variant CnC Checkin 192.168.2.23:39906 -> 163.123.143.81:839
Source: /usr/bin/dash (PID: 6276)Wget executable: /usr/bin/wget -> wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:39906 -> 163.123.143.81:839
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: unknownTCP traffic detected without corresponding DNS query: 163.123.143.81
Source: tmp.1y2FR6QFox.14.drString found in binary or memory: https://motd.ubuntu.com/
Source: motd-news.32.dr, tmp.hDXKGVsUIR.14.drString found in binary or memory: https://ubuntu.com/blog/microk8s-memory-optimisation

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: x-3.2-.SNOOPY, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: x-3.2-.SNOOPY, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: x-3.2-.SNOOPY, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 6322.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 6322.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 6322.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 6319.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 6319.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 6319.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sampleName: vseattack
Source: x-3.2-.SNOOPY, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: x-3.2-.SNOOPY, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: x-3.2-.SNOOPY, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 6319.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 6319.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 6319.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: classification engineClassification label: mal76.spre.linSNOOPY@0/3@0/0
Source: x-3.2-.SNOOPYELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: x-3.2-.SNOOPYELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: x-3.2-.SNOOPYELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: x-3.2-.SNOOPYELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: /usr/bin/dash (PID: 6276)Wget executable: /usr/bin/wget -> wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com
Source: /usr/sbin/logrotate (PID: 6264)Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6266)Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service
Source: /usr/bin/dash (PID: 6286)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.hDXKGVsUIR /tmp/tmp.1y2FR6QFox /tmp/tmp.5piRJmkiY5
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: /usr/bin/python3.8 (PID: 6269)Uname executable: /usr/bin/uname -> uname -p

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Scripting		1
Systemd Service		1
Systemd Service		1
Scripting		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
Data Obfuscation		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
File Deletion		LSASS Memory1
Remote System Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
Encrypted Channel		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
Non-Standard Port		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer11
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 679558 Sample: x-3.2-.SNOOPY Startdate: 06/08/2022 Architecture: LINUX Score: 76 25 163.123.143.81, 39906, 839 ILIGHT-NETUS Reserved 2->25 27 109.202.202.202, 80 INIT7CH Switzerland 2->27 29 2 other IPs or domains 2->29 31 Snort IDS alert for network traffic 2->31 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 2 other signatures 2->37 8 dash rm x-3.2-.SNOOPY 2->8         started        11 logrotate sh 2->11         started        13 python3.8 uname 2->13         started        15 11 other processes 2->15 signatures3 process4 signatures5 39 Opens /proc/net/* files useful for finding connected devices and routers 8->39 17 x-3.2-.SNOOPY 8->17         started        19 sh rsyslog-rotate 11->19         started        process6 process7 21 x-3.2-.SNOOPY 17->21         started        23 rsyslog-rotate systemctl 19->23         started       

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
x-3.2-.SNOOPY57%VirustotalBrowse
x-3.2-.SNOOPY59%ReversingLabsLinux.Trojan.Gafgyt
x-3.2-.SNOOPY100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://motd.ubuntu.com/tmp.1y2FR6QFox.14.drfalse
    		high
    https://ubuntu.com/blog/microk8s-memory-optimisationmotd-news.32.dr, tmp.hDXKGVsUIR.14.drfalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      109.202.202.202
      		unknownSwitzerland
      		13030INIT7CHfalse
      91.189.91.43
      		unknownUnited Kingdom
      		41231CANONICAL-ASGBfalse
      163.123.143.81
      		unknownReserved
      		1767ILIGHT-NETUStrue
      91.189.91.42
      		unknownUnited Kingdom
      		41231CANONICAL-ASGBfalse

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      /tmp/tmp.1y2FR6QFox

      Download File
      Process:/usr/bin/wget
      File Type:UTF-8 Unicode text
      Category:dropped
      Size (bytes):494
      Entropy (8bit):4.942242112845035
      Encrypted:false
      SSDEEP:6:HXTFpF4AYLEHKLG13/3xg7F/uZCHKLGZgM/Tt5RhgZDl7jzisnf53GV8F8ETa4k4:HDfF4TL6OM48QTt5Rh0ish3GV8WEgzG
      MD5:939805A2DE862140C43456F85CDCF889
      SHA1:45BFA80A0FA084970E567BA10A3E0687D8C0483E
      SHA-256:E17608051FFD0540555DA96B9CBD4F57FE256637E718CE2C11171C069C352B67
      SHA-512:30D2FABEB9D430CA5EFEBE15C2267DF80797483D2002DBF16AC2AA73C534D18EC4E0E6AA6259DC1000385CED7605AB44AD8872C9338EB2C0609763E4DA6CC89E
      Malicious:false
      Reputation:low
      Preview:--2022-08-06 01:52:44-- https://motd.ubuntu.com/.Resolving motd.ubuntu.com (motd.ubuntu.com)... 54.171.230.55, 34.249.145.219, 2a05:d018:91c:3200:2846:99fb:81b6:1e11, ....Connecting to motd.ubuntu.com (motd.ubuntu.com)|54.171.230.55|:443... connected..HTTP request sent, awaiting response... 200 OK.Length: 191 [text/plain].Saving to: .STDOUT... 0K 100% 47.1K=0.004s..2022-08-06 01:52:45 (47.1 KB/s) - written to stdout [191/191]..

      /tmp/tmp.hDXKGVsUIR

      Download File
      Process:/usr/bin/wget
      File Type:ASCII text
      Category:dropped
      Size (bytes):191
      Entropy (8bit):4.515771857099866
      Encrypted:false
      SSDEEP:3:P2lnI+5MsqqzNLz+FRNScHUBfRau95++sZzR5woLB1Fh0VTGTl/X5kURn:OZ8uNLzDc0pR75+9Zz/woFmIT52URn
      MD5:DD514F892B5F93ED615D366E58AC58AF
      SHA1:BA75EDB3C2232CC260BC187F604DC8F25AA72C11
      SHA-256:F40D0DCE6E83DF74109FEF5E68E51CC255727783EEAE04C3E34677E23F7552CF
      SHA-512:9150BDE63F6C4850C5340D8877892B4D9BBF9EBDC98CDCF557A93FA304C1222CEE446418F5BE2ACCDBF38393778AFA5D4F3EDCB37A47BF57D3A4B2DEAD42A2D0
      Malicious:false
      Reputation:high, very likely benign file
      Preview: * Super-optimized for small spaces - read how we shrank the memory. footprint of MicroK8s to make it the smallest full K8s around... https://ubuntu.com/blog/microk8s-memory-optimisation.

      /var/cache/motd-news

      Download File
      Process:/usr/bin/cut
      File Type:ASCII text
      Category:dropped
      Size (bytes):191
      Entropy (8bit):4.515771857099866
      Encrypted:false
      SSDEEP:3:P2lnI+5MsqqzNLz+FRNScHUBfRau95++sZzR5woLB1Fh0VTGTl/X5kURn:OZ8uNLzDc0pR75+9Zz/woFmIT52URn
      MD5:DD514F892B5F93ED615D366E58AC58AF
      SHA1:BA75EDB3C2232CC260BC187F604DC8F25AA72C11
      SHA-256:F40D0DCE6E83DF74109FEF5E68E51CC255727783EEAE04C3E34677E23F7552CF
      SHA-512:9150BDE63F6C4850C5340D8877892B4D9BBF9EBDC98CDCF557A93FA304C1222CEE446418F5BE2ACCDBF38393778AFA5D4F3EDCB37A47BF57D3A4B2DEAD42A2D0
      Malicious:false
      Reputation:high, very likely benign file
      Preview: * Super-optimized for small spaces - read how we shrank the memory. footprint of MicroK8s to make it the smallest full K8s around... https://ubuntu.com/blog/microk8s-memory-optimisation.

      Static File Info

      General

      File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
      Entropy (8bit):6.390591865594507
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:x-3.2-.SNOOPY
      File size:74024
      MD5:ca34f09d0fe8bd0dddd1443e401781d7
      SHA1:da043d55a48b11f1c0b47b38bd2bb279454a3ac4
      SHA256:3d4c4cc860a146597b5830fa4e4c5ab9a5eb32304bd88a9e6256452740998727
      SHA512:de5af8be9508268a2c25efb73f0841b068224c80b492f67e271a0e808ae9b15a98e4d22c844fce2b69701db5ff94474e710377b008b71447d23b3489e20a1d2f
      SSDEEP:1536:nm+c5osQWiKLoxKFn6pD+OTxzMvMmLI2VOCjXUfJRk:45omr0xKFn6J+OkMmU2VOCbUfJRk
      TLSH:49733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355
      File Content Preview:.ELF....................h...4...........4. ...(..............................................U...U.......i..........Q.td............................U..S............h........[]...$.............U......=.X...t..1.....U......U......u........t...$.E..........X

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:Intel 80386
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x8048168
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:54280
      Section Header Size:40
      Number of Section Headers:16
      Header String Table Index:13

      Sections

      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .initPROGBITS0x80480940x940x1c0x00x6AX001
      .textPROGBITS0x80480b00xb00xa3c40x00x6AX0016
      .finiPROGBITS0x80524740xa4740x170x00x6AX001
      .rodataPROGBITS0x80524a00xa4a00x21000x00x2A0032
      .eh_framePROGBITS0x80545a00xc5a00x40x00x2A004
      .ctorsPROGBITS0x80555a40xc5a40x80x00x3WA004
      .dtorsPROGBITS0x80555ac0xc5ac0x80x00x3WA004
      .jcrPROGBITS0x80555b40xc5b40x40x00x3WA004
      .got.pltPROGBITS0x80555b80xc5b80xc0x40x3WA004
      .dataPROGBITS0x80555e00xc5e00x2c00x00x3WA0032
      .bssNOBITS0x80558a00xc8a00x66e40x00x3WA0032
      .commentPROGBITS0x00xc8a00xaf80x00x0001
      .shstrtabSTRTAB0x00xd3980x6f0x00x0001
      .symtabSYMTAB0x00xd6880x2a600x100x0152484
      .strtabSTRTAB0x00x100e80x20400x00x0001

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x80480000x80480000xc5a40xc5a46.55770x5R E0x1000.init .text .fini .rodata .eh_frame
      LOAD0xc5a40x80555a40x80555a40x2fc0x69e03.38350x6RW 0x1000.ctors .dtors .jcr .got.plt .data .bss
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

      Symbols

      NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
      .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      .symtab0x80480940SECTION<unknown>DEFAULT1
      .symtab0x80480b00SECTION<unknown>DEFAULT2
      .symtab0x80524740SECTION<unknown>DEFAULT3
      .symtab0x80524a00SECTION<unknown>DEFAULT4
      .symtab0x80545a00SECTION<unknown>DEFAULT5
      .symtab0x80555a40SECTION<unknown>DEFAULT6
      .symtab0x80555ac0SECTION<unknown>DEFAULT7
      .symtab0x80555b40SECTION<unknown>DEFAULT8
      .symtab0x80555b80SECTION<unknown>DEFAULT9
      .symtab0x80555e00SECTION<unknown>DEFAULT10
      .symtab0x80558a00SECTION<unknown>DEFAULT11
      .symtab0x00SECTION<unknown>DEFAULT12
      .symtab0x00SECTION<unknown>DEFAULT13
      .symtab0x00SECTION<unknown>DEFAULT14
      .symtab0x00SECTION<unknown>DEFAULT15
      Q.symtab0x80558e016384OBJECT<unknown>DEFAULT11
      SendHTTPHex.symtab0x804a3d1431FUNC<unknown>DEFAULT2
      SendSTDHEX.symtab0x8049c33306FUNC<unknown>DEFAULT2
      SendUDP.symtab0x8049362850FUNC<unknown>DEFAULT2
      _GLOBAL_OFFSET_TABLE_.symtab0x80555b80OBJECT<unknown>HIDDEN9
      _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __CTOR_END__.symtab0x80555a80OBJECT<unknown>DEFAULT6
      __CTOR_LIST__.symtab0x80555a40OBJECT<unknown>DEFAULT6
      __C_ctype_b.symtab0x80556184OBJECT<unknown>DEFAULT10
      __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_b_data.symtab0x8052c60768OBJECT<unknown>DEFAULT4
      __C_ctype_tolower.symtab0x80558984OBJECT<unknown>DEFAULT10
      __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_tolower_data.symtab0x80542a0768OBJECT<unknown>DEFAULT4
      __C_ctype_toupper.symtab0x80556204OBJECT<unknown>DEFAULT10
      __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_toupper_data.symtab0x8052f60768OBJECT<unknown>DEFAULT4
      __DTOR_END__.symtab0x80555b00OBJECT<unknown>DEFAULT7
      __DTOR_LIST__.symtab0x80555ac0OBJECT<unknown>DEFAULT7
      __EH_FRAME_BEGIN__.symtab0x80545a00OBJECT<unknown>DEFAULT5
      __FRAME_END__.symtab0x80545a00OBJECT<unknown>DEFAULT5
      __GI___C_ctype_b.symtab0x80556184OBJECT<unknown>HIDDEN10
      __GI___C_ctype_b_data.symtab0x8052c60768OBJECT<unknown>HIDDEN4
      __GI___C_ctype_tolower.symtab0x80558984OBJECT<unknown>HIDDEN10
      __GI___C_ctype_tolower_data.symtab0x80542a0768OBJECT<unknown>HIDDEN4
      __GI___C_ctype_toupper.symtab0x80556204OBJECT<unknown>HIDDEN10
      __GI___C_ctype_toupper_data.symtab0x8052f60768OBJECT<unknown>HIDDEN4
      __GI___ctype_b.symtab0x805561c4OBJECT<unknown>HIDDEN10
      __GI___ctype_tolower.symtab0x805589c4OBJECT<unknown>HIDDEN10
      __GI___ctype_toupper.symtab0x80556244OBJECT<unknown>HIDDEN10
      __GI___errno_location.symtab0x804c06c6FUNC<unknown>HIDDEN2
      __GI___fgetc_unlocked.symtab0x8052094220FUNC<unknown>HIDDEN2
      __GI___glibc_strerror_r.symtab0x804d0b429FUNC<unknown>HIDDEN2
      __GI___h_errno_location.symtab0x804f4b46FUNC<unknown>HIDDEN2
      __GI___libc_fcntl.symtab0x804bc9887FUNC<unknown>HIDDEN2
      __GI___libc_fcntl64.symtab0x804bcf063FUNC<unknown>HIDDEN2
      __GI___libc_open.symtab0x804beb075FUNC<unknown>HIDDEN2
      __GI___uClibc_fini.symtab0x804ee3863FUNC<unknown>HIDDEN2
      __GI___uClibc_init.symtab0x804eeaf64FUNC<unknown>HIDDEN2
      __GI___xpg_strerror_r.symtab0x804d0d4182FUNC<unknown>HIDDEN2
      __GI__exit.symtab0x804bd3040FUNC<unknown>HIDDEN2
      __GI_abort.symtab0x804e4e0273FUNC<unknown>HIDDEN2
      __GI_atoi.symtab0x804e97820FUNC<unknown>HIDDEN2
      __GI_atol.symtab0x804e97820FUNC<unknown>HIDDEN2
      __GI_brk.symtab0x8050b2454FUNC<unknown>HIDDEN2
      __GI_chdir.symtab0x804bd8c46FUNC<unknown>HIDDEN2
      __GI_clock_getres.symtab0x804f22450FUNC<unknown>HIDDEN2
      __GI_close.symtab0x804bdbc46FUNC<unknown>HIDDEN2
      __GI_connect.symtab0x804d66843FUNC<unknown>HIDDEN2
      __GI_errno.symtab0x805bb204OBJECT<unknown>HIDDEN11
      __GI_exit.symtab0x804eacc103FUNC<unknown>HIDDEN2
      __GI_fclose.symtab0x8050bac271FUNC<unknown>HIDDEN2
      __GI_fcntl.symtab0x804bc9887FUNC<unknown>HIDDEN2
      __GI_fcntl64.symtab0x804bcf063FUNC<unknown>HIDDEN2
      __GI_fflush_unlocked.symtab0x805123c333FUNC<unknown>HIDDEN2
      __GI_fgetc_unlocked.symtab0x8052094220FUNC<unknown>HIDDEN2
      __GI_fgets.symtab0x80510f498FUNC<unknown>HIDDEN2
      __GI_fgets_unlocked.symtab0x805138c105FUNC<unknown>HIDDEN2
      __GI_fopen.symtab0x8050cbc24FUNC<unknown>HIDDEN2
      __GI_fork.symtab0x804bdec38FUNC<unknown>HIDDEN2
      __GI_fputs_unlocked.symtab0x804ce8c49FUNC<unknown>HIDDEN2
      __GI_fseek.symtab0x8050cd427FUNC<unknown>HIDDEN2
      __GI_fseeko64.symtab0x8050cf0231FUNC<unknown>HIDDEN2
      __GI_fwrite_unlocked.symtab0x804cec0120FUNC<unknown>HIDDEN2
      __GI_getc_unlocked.symtab0x8052094220FUNC<unknown>HIDDEN2
      __GI_getdtablesize.symtab0x804f25837FUNC<unknown>HIDDEN2
      __GI_getegid.symtab0x804f28038FUNC<unknown>HIDDEN2
      __GI_geteuid.symtab0x804f2a838FUNC<unknown>HIDDEN2
      __GI_getgid.symtab0x804f2d038FUNC<unknown>HIDDEN2
      __GI_gethostbyname.symtab0x804d30448FUNC<unknown>HIDDEN2
      __GI_gethostbyname_r.symtab0x804d334818FUNC<unknown>HIDDEN2
      __GI_getpagesize.symtab0x804f2f817FUNC<unknown>HIDDEN2
      __GI_getpid.symtab0x804be1438FUNC<unknown>HIDDEN2
      __GI_getrlimit.symtab0x804f30c50FUNC<unknown>HIDDEN2
      __GI_getsockname.symtab0x804d69443FUNC<unknown>HIDDEN2
      __GI_getuid.symtab0x804f34038FUNC<unknown>HIDDEN2
      __GI_h_errno.symtab0x805bb244OBJECT<unknown>HIDDEN11
      __GI_inet_addr.symtab0x804d2dc37FUNC<unknown>HIDDEN2
      __GI_inet_aton.symtab0x80500a0148FUNC<unknown>HIDDEN2
      __GI_inet_ntoa.symtab0x804d2c721FUNC<unknown>HIDDEN2
      __GI_inet_ntoa_r.symtab0x804d27879FUNC<unknown>HIDDEN2
      __GI_inet_ntop.symtab0x8051879465FUNC<unknown>HIDDEN2
      __GI_inet_pton.symtab0x805159e458FUNC<unknown>HIDDEN2
      __GI_initstate_r.symtab0x804e8cd171FUNC<unknown>HIDDEN2
      __GI_ioctl.symtab0x804be3c63FUNC<unknown>HIDDEN2
      __GI_isatty.symtab0x804d1c029FUNC<unknown>HIDDEN2
      __GI_kill.symtab0x804be7c50FUNC<unknown>HIDDEN2
      __GI_lseek64.symtab0x805201c86FUNC<unknown>HIDDEN2
      __GI_memchr.symtab0x804fed435FUNC<unknown>HIDDEN2
      __GI_memcpy.symtab0x804cf3839FUNC<unknown>HIDDEN2
      __GI_memmove.symtab0x804fef839FUNC<unknown>HIDDEN2
      __GI_mempcpy.symtab0x804ff4833FUNC<unknown>HIDDEN2
      __GI_memrchr.symtab0x804ff6c176FUNC<unknown>HIDDEN2
      __GI_memset.symtab0x804cf6021FUNC<unknown>HIDDEN2
      __GI_mmap.symtab0x804f19827FUNC<unknown>HIDDEN2
      __GI_munmap.symtab0x804f36850FUNC<unknown>HIDDEN2
      __GI_nanosleep.symtab0x804f39c50FUNC<unknown>HIDDEN2
      __GI_open.symtab0x804beb075FUNC<unknown>HIDDEN2
      __GI_poll.symtab0x8050b7454FUNC<unknown>HIDDEN2
      __GI_raise.symtab0x8050af824FUNC<unknown>HIDDEN2
      __GI_random.symtab0x804e5fc72FUNC<unknown>HIDDEN2
      __GI_random_r.symtab0x804e7d594FUNC<unknown>HIDDEN2
      __GI_rawmemchr.symtab0x805144899FUNC<unknown>HIDDEN2
      __GI_read.symtab0x804bf1454FUNC<unknown>HIDDEN2
      __GI_recv.symtab0x804d6fc51FUNC<unknown>HIDDEN2
      __GI_sbrk.symtab0x804f3d078FUNC<unknown>HIDDEN2
      __GI_select.symtab0x804bf4c63FUNC<unknown>HIDDEN2
      __GI_send.symtab0x804d73051FUNC<unknown>HIDDEN2
      __GI_sendto.symtab0x804d76467FUNC<unknown>HIDDEN2
      __GI_setsid.symtab0x804bf8c38FUNC<unknown>HIDDEN2
      __GI_setsockopt.symtab0x804d7a859FUNC<unknown>HIDDEN2
      __GI_setstate_r.symtab0x804e73c153FUNC<unknown>HIDDEN2
      __GI_sigaction.symtab0x804f0bb218FUNC<unknown>HIDDEN2
      __GI_signal.symtab0x804d810175FUNC<unknown>HIDDEN2
      __GI_sigprocmask.symtab0x804f42085FUNC<unknown>HIDDEN2
      __GI_sleep.symtab0x804eb34393FUNC<unknown>HIDDEN2
      __GI_socket.symtab0x804d7e443FUNC<unknown>HIDDEN2
      __GI_sprintf.symtab0x804c07431FUNC<unknown>HIDDEN2
      __GI_srandom_r.symtab0x804e833154FUNC<unknown>HIDDEN2
      __GI_strcasecmp.symtab0x805217054FUNC<unknown>HIDDEN2
      __GI_strchr.symtab0x804cf7830FUNC<unknown>HIDDEN2
      __GI_strcmp.symtab0x80513f829FUNC<unknown>HIDDEN2
      __GI_strcoll.symtab0x80513f829FUNC<unknown>HIDDEN2
      __GI_strcpy.symtab0x804cf9827FUNC<unknown>HIDDEN2
      __GI_strdup.symtab0x80514e054FUNC<unknown>HIDDEN2
      __GI_strlen.symtab0x804cfb419FUNC<unknown>HIDDEN2
      __GI_strncat.symtab0x805141846FUNC<unknown>HIDDEN2
      __GI_strncpy.symtab0x804ff2038FUNC<unknown>HIDDEN2
      __GI_strnlen.symtab0x804cfc825FUNC<unknown>HIDDEN2
      __GI_strpbrk.symtab0x805007839FUNC<unknown>HIDDEN2
      __GI_strspn.symtab0x80514ac50FUNC<unknown>HIDDEN2
      __GI_strstr.symtab0x804cfe4206FUNC<unknown>HIDDEN2
      __GI_strtok.symtab0x804d1a425FUNC<unknown>HIDDEN2
      __GI_strtok_r.symtab0x805001c89FUNC<unknown>HIDDEN2
      __GI_strtol.symtab0x804e98c26FUNC<unknown>HIDDEN2
      __GI_sysconf.symtab0x804ecc0325FUNC<unknown>HIDDEN2
      __GI_tcgetattr.symtab0x804d1e0112FUNC<unknown>HIDDEN2
      __GI_time.symtab0x804bfb446FUNC<unknown>HIDDEN2
      __GI_tolower.symtab0x805207429FUNC<unknown>HIDDEN2
      __GI_toupper.symtab0x804c04c29FUNC<unknown>HIDDEN2
      __GI_vsnprintf.symtab0x804c094176FUNC<unknown>HIDDEN2
      __GI_wait4.symtab0x804f47859FUNC<unknown>HIDDEN2
      __GI_waitpid.symtab0x804bfe426FUNC<unknown>HIDDEN2
      __GI_wcrtomb.symtab0x804f4bc69FUNC<unknown>HIDDEN2
      __GI_wcsnrtombs.symtab0x804f524133FUNC<unknown>HIDDEN2
      __GI_wcsrtombs.symtab0x804f50430FUNC<unknown>HIDDEN2
      __GI_write.symtab0x804c00054FUNC<unknown>HIDDEN2
      __JCR_END__.symtab0x80555b40OBJECT<unknown>DEFAULT8
      __JCR_LIST__.symtab0x80555b40OBJECT<unknown>DEFAULT8
      __app_fini.symtab0x805bb144OBJECT<unknown>HIDDEN11
      __atexit_lock.symtab0x805586024OBJECT<unknown>DEFAULT10
      __bsd_signal.symtab0x804d810175FUNC<unknown>HIDDEN2
      __bss_start.symtab0x80558a00NOTYPE<unknown>DEFAULTSHN_ABS
      __check_one_fd.symtab0x804ee7b52FUNC<unknown>DEFAULT2
      __ctype_b.symtab0x805561c4OBJECT<unknown>DEFAULT10
      __ctype_tolower.symtab0x805589c4OBJECT<unknown>DEFAULT10
      __ctype_toupper.symtab0x80556244OBJECT<unknown>DEFAULT10
      __curbrk.symtab0x805bb444OBJECT<unknown>HIDDEN11
      __data_start.symtab0x80555e80NOTYPE<unknown>DEFAULT10
      __decode_answer.symtab0x8051c18249FUNC<unknown>HIDDEN2
      __decode_dotted.symtab0x8052238217FUNC<unknown>HIDDEN2
      __decode_header.symtab0x8051afc171FUNC<unknown>HIDDEN2
      __deregister_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __dns_lookup.symtab0x80501341876FUNC<unknown>HIDDEN2
      __do_global_ctors_aux.symtab0x80524400FUNC<unknown>DEFAULT2
      __do_global_dtors_aux.symtab0x80480c00FUNC<unknown>DEFAULT2
      __dso_handle.symtab0x80555e00OBJECT<unknown>HIDDEN10
      __encode_dotted.symtab0x80521a8144FUNC<unknown>HIDDEN2
      __encode_header.symtab0x8051a4c175FUNC<unknown>HIDDEN2
      __encode_question.symtab0x8051ba883FUNC<unknown>HIDDEN2
      __environ.symtab0x805bb0c4OBJECT<unknown>DEFAULT11
      __errno_location.symtab0x804c06c6FUNC<unknown>DEFAULT2
      __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __exit_cleanup.symtab0x805bb044OBJECT<unknown>HIDDEN11
      __fgetc_unlocked.symtab0x8052094220FUNC<unknown>DEFAULT2
      __fini_array_end.symtab0x80555a40NOTYPE<unknown>HIDDENSHN_ABS
      __fini_array_start.symtab0x80555a40NOTYPE<unknown>HIDDENSHN_ABS
      __get_hosts_byname_r.symtab0x8050acc44FUNC<unknown>HIDDEN2
      __get_pc_thunk_bx.symtab0x80480b00FUNC<unknown>HIDDEN2
      __getpagesize.symtab0x804f2f817FUNC<unknown>DEFAULT2
      __glibc_strerror_r.symtab0x804d0b429FUNC<unknown>DEFAULT2
      __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __h_errno_location.symtab0x804f4b46FUNC<unknown>DEFAULT2
      __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __init_array_end.symtab0x80555a40NOTYPE<unknown>HIDDENSHN_ABS
      __init_array_start.symtab0x80555a40NOTYPE<unknown>HIDDENSHN_ABS
      __length_dotted.symtab0x805231465FUNC<unknown>HIDDEN2
      __length_question.symtab0x8051bfc28FUNC<unknown>HIDDEN2
      __libc_close.symtab0x804bdbc46FUNC<unknown>DEFAULT2
      __libc_connect.symtab0x804d66843FUNC<unknown>DEFAULT2
      __libc_creat.symtab0x804befb25FUNC<unknown>DEFAULT2
      __libc_fcntl.symtab0x804bc9887FUNC<unknown>DEFAULT2
      __libc_fcntl64.symtab0x804bcf063FUNC<unknown>DEFAULT2
      __libc_fork.symtab0x804bdec38FUNC<unknown>DEFAULT2
      __libc_getpid.symtab0x804be1438FUNC<unknown>DEFAULT2
      __libc_lseek64.symtab0x805201c86FUNC<unknown>DEFAULT2
      __libc_nanosleep.symtab0x804f39c50FUNC<unknown>DEFAULT2
      __libc_open.symtab0x804beb075FUNC<unknown>DEFAULT2
      __libc_poll.symtab0x8050b7454FUNC<unknown>DEFAULT2
      __libc_read.symtab0x804bf1454FUNC<unknown>DEFAULT2
      __libc_recv.symtab0x804d6fc51FUNC<unknown>DEFAULT2
      __libc_select.symtab0x804bf4c63FUNC<unknown>DEFAULT2
      __libc_send.symtab0x804d73051FUNC<unknown>DEFAULT2
      __libc_sendto.symtab0x804d76467FUNC<unknown>DEFAULT2
      __libc_sigaction.symtab0x804f0bb218FUNC<unknown>DEFAULT2
      __libc_stack_end.symtab0x805bb084OBJECT<unknown>DEFAULT11
      __libc_waitpid.symtab0x804bfe426FUNC<unknown>DEFAULT2
      __libc_write.symtab0x804c00054FUNC<unknown>DEFAULT2
      __malloc_consolidate.symtab0x804e179424FUNC<unknown>HIDDEN2
      __malloc_largebin_index.symtab0x804d92438FUNC<unknown>DEFAULT2
      __malloc_lock.symtab0x805577024OBJECT<unknown>DEFAULT10
      __malloc_state.symtab0x805bbe0888OBJECT<unknown>DEFAULT11
      __malloc_trim.symtab0x804e0ec141FUNC<unknown>DEFAULT2
      __nameserver.symtab0x805bf6812OBJECT<unknown>HIDDEN11
      __nameservers.symtab0x805bf744OBJECT<unknown>HIDDEN11
      __open_etc_hosts.symtab0x8051d1449FUNC<unknown>HIDDEN2
      __open_nameservers.symtab0x8050888579FUNC<unknown>HIDDEN2
      __pagesize.symtab0x805bb104OBJECT<unknown>DEFAULT11
      __preinit_array_end.symtab0x80555a40NOTYPE<unknown>HIDDENSHN_ABS
      __preinit_array_start.symtab0x80555a40NOTYPE<unknown>HIDDENSHN_ABS
      __pthread_initialize_minimal.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __pthread_mutex_init.symtab0x804ee773FUNC<unknown>DEFAULT2
      __pthread_mutex_lock.symtab0x804ee773FUNC<unknown>DEFAULT2
      __pthread_mutex_trylock.symtab0x804ee773FUNC<unknown>DEFAULT2
      __pthread_mutex_unlock.symtab0x804ee773FUNC<unknown>DEFAULT2
      __pthread_return_0.symtab0x804ee773FUNC<unknown>DEFAULT2
      __pthread_return_void.symtab0x804ee7a1FUNC<unknown>DEFAULT2
      __raise.symtab0x8050af824FUNC<unknown>HIDDEN2
      __read_etc_hosts_r.symtab0x8051d45724FUNC<unknown>HIDDEN2
      __register_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __resolv_lock.symtab0x805588024OBJECT<unknown>DEFAULT10
      __restore.symtab0x804f0b30NOTYPE<unknown>DEFAULT2
      __restore_rt.symtab0x804f0ac0NOTYPE<unknown>DEFAULT2
      __rtld_fini.symtab0x805bb184OBJECT<unknown>HIDDEN11
      __searchdomain.symtab0x805bf5816OBJECT<unknown>HIDDEN11
      __searchdomains.symtab0x805bf784OBJECT<unknown>HIDDEN11
      __sigaddset.symtab0x804d8e432FUNC<unknown>DEFAULT2
      __sigdelset.symtab0x804d90432FUNC<unknown>DEFAULT2
      __sigismember.symtab0x804d8c036FUNC<unknown>DEFAULT2
      __socketcall.symtab0x804f1b450FUNC<unknown>HIDDEN2
      __socketcall.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __stdin.symtab0x80556344OBJECT<unknown>DEFAULT10
      __stdio_READ.symtab0x805235879FUNC<unknown>HIDDEN2
      __stdio_WRITE.symtab0x804f5ac128FUNC<unknown>HIDDEN2
      __stdio_adjust_position.symtab0x8050dd8164FUNC<unknown>HIDDEN2
      __stdio_fwrite.symtab0x804f62c234FUNC<unknown>HIDDEN2
      __stdio_init_mutex.symtab0x804c1a723FUNC<unknown>HIDDEN2
      __stdio_mutex_initializer.4160.symtab0x805326024OBJECT<unknown>DEFAULT4
      __stdio_rfill.symtab0x80523a840FUNC<unknown>HIDDEN2
      __stdio_seek.symtab0x80510c051FUNC<unknown>HIDDEN2
      __stdio_trans2r_o.symtab0x80523d0110FUNC<unknown>HIDDEN2
      __stdio_trans2w_o.symtab0x804f718167FUNC<unknown>HIDDEN2
      __stdio_wcommit.symtab0x804c24843FUNC<unknown>HIDDEN2
      __stdout.symtab0x80556384OBJECT<unknown>DEFAULT10
      __syscall_error.symtab0x8050b5c21FUNC<unknown>HIDDEN2
      __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_rt_sigaction.symtab0x804f1e859FUNC<unknown>HIDDEN2
      __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __uClibc_fini.symtab0x804ee3863FUNC<unknown>DEFAULT2
      __uClibc_init.symtab0x804eeaf64FUNC<unknown>DEFAULT2
      __uClibc_main.symtab0x804eeef443FUNC<unknown>DEFAULT2
      __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __uclibc_progname.symtab0x80558784OBJECT<unknown>HIDDEN10
      __xpg_strerror_r.symtab0x804d0d4182FUNC<unknown>DEFAULT2
      __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _charpad.symtab0x804c27454FUNC<unknown>DEFAULT2
      _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _dl_aux_init.symtab0x8050b1018FUNC<unknown>DEFAULT2
      _dl_phdr.symtab0x805bf7c4OBJECT<unknown>DEFAULT11
      _dl_phnum.symtab0x805bf804OBJECT<unknown>DEFAULT11
      _edata.symtab0x80558a00NOTYPE<unknown>DEFAULTSHN_ABS
      _end.symtab0x805bf840NOTYPE<unknown>DEFAULTSHN_ABS
      _errno.symtab0x805bb204OBJECT<unknown>DEFAULT11
      _exit.symtab0x804bd3040FUNC<unknown>DEFAULT2
      _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _fini.symtab0x80524743FUNC<unknown>DEFAULT3
      _fixed_buffers.symtab0x80599008192OBJECT<unknown>DEFAULT11
      _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _fp_out_narrow.symtab0x804c2aa106FUNC<unknown>DEFAULT2
      _fpmaxtostr.symtab0x804f9281449FUNC<unknown>HIDDEN2
      _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _h_errno.symtab0x805bb244OBJECT<unknown>DEFAULT11
      _init.symtab0x80480943FUNC<unknown>DEFAULT1
      _load_inttype.symtab0x804f7c086FUNC<unknown>HIDDEN2
      _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_init.symtab0x804c8cc111FUNC<unknown>HIDDEN2
      _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_parsespec.symtab0x804cabd975FUNC<unknown>HIDDEN2
      _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_prepargs.symtab0x804c93c66FUNC<unknown>HIDDEN2
      _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_setargs.symtab0x804c980273FUNC<unknown>HIDDEN2
      _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _promoted_size.symtab0x804ca9441FUNC<unknown>DEFAULT2
      _pthread_cleanup_pop_restore.symtab0x804ee7a1FUNC<unknown>DEFAULT2
      _pthread_cleanup_push_defer.symtab0x804ee7a1FUNC<unknown>DEFAULT2
      _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _sigintr.symtab0x805bb60128OBJECT<unknown>HIDDEN11
      _start.symtab0x804816834FUNC<unknown>DEFAULT2
      _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _stdio_fopen.symtab0x8050e7c579FUNC<unknown>HIDDEN2
      _stdio_init.symtab0x804c14499FUNC<unknown>HIDDEN2
      _stdio_openlist.symtab0x805563c4OBJECT<unknown>DEFAULT10
      _stdio_openlist_add_lock.symtab0x805564024OBJECT<unknown>DEFAULT10
      _stdio_openlist_dec_use.symtab0x8051158228FUNC<unknown>DEFAULT2
      _stdio_openlist_del_count.symtab0x80598e44OBJECT<unknown>DEFAULT11
      _stdio_openlist_del_lock.symtab0x805565824OBJECT<unknown>DEFAULT10
      _stdio_openlist_use_count.symtab0x80598e04OBJECT<unknown>DEFAULT11
      _stdio_streams.symtab0x8055680240OBJECT<unknown>DEFAULT10
      _stdio_term.symtab0x804c1be136FUNC<unknown>HIDDEN2
      _stdio_user_locking.symtab0x80556704OBJECT<unknown>DEFAULT10
      _stdlib_strto_l.symtab0x804e9a8289FUNC<unknown>HIDDEN2
      _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _store_inttype.symtab0x804f81861FUNC<unknown>HIDDEN2
      _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _string_syserrmsgs.symtab0x80533402906OBJECT<unknown>HIDDEN4
      _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _uintmaxtostr.symtab0x804f858207FUNC<unknown>HIDDEN2
      _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _vfprintf_internal.symtab0x804c3141464FUNC<unknown>HIDDEN2
      _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      abort.symtab0x804e4e0273FUNC<unknown>DEFAULT2
      abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      access.symtab0x804bd5850FUNC<unknown>DEFAULT2
      access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      atoi.symtab0x804e97820FUNC<unknown>DEFAULT2
      atol.symtab0x804e97820FUNC<unknown>DEFAULT2
      atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      bcopy.symtab0x804d18c21FUNC<unknown>DEFAULT2
      bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      been_there_done_that.symtab0x805bb001OBJECT<unknown>DEFAULT11
      been_there_done_that.3001.symtab0x805bb1c1OBJECT<unknown>DEFAULT11
      bot_snoopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      brk.symtab0x8050b2454FUNC<unknown>DEFAULT2
      brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      bsd_signal.symtab0x804d810175FUNC<unknown>DEFAULT2
      buf.2827.symtab0x805b90416OBJECT<unknown>DEFAULT11
      buf.5162.symtab0x805b920460OBJECT<unknown>DEFAULT11
      c.symtab0x80556104OBJECT<unknown>DEFAULT10
      chdir.symtab0x804bd8c46FUNC<unknown>DEFAULT2
      chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      clock_getres.symtab0x804f22450FUNC<unknown>DEFAULT2
      clock_getres.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      close.symtab0x804bdbc46FUNC<unknown>DEFAULT2
      close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      commServer.symtab0x80555ec4OBJECT<unknown>DEFAULT10
      completed.2429.symtab0x80558a01OBJECT<unknown>DEFAULT11
      connect.symtab0x804d66843FUNC<unknown>DEFAULT2
      connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      connectTimeout.symtab0x8048e77523FUNC<unknown>DEFAULT2
      creat.symtab0x804befb25FUNC<unknown>DEFAULT2
      crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      csum.symtab0x8049187159FUNC<unknown>DEFAULT2
      currentServer.symtab0x805560c4OBJECT<unknown>DEFAULT10
      data_start.symtab0x80555e80NOTYPE<unknown>DEFAULT10
      decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      environ.symtab0x805bb0c4OBJECT<unknown>DEFAULT11
      errno.symtab0x805bb204OBJECT<unknown>DEFAULT11
      errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      exit.symtab0x804eacc103FUNC<unknown>DEFAULT2
      exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      exp10_table.symtab0x8054160156OBJECT<unknown>DEFAULT4
      fclose.symtab0x8050bac271FUNC<unknown>DEFAULT2
      fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fcntl.symtab0x804bc9887FUNC<unknown>DEFAULT2
      fcntl64.symtab0x804bcf063FUNC<unknown>DEFAULT2
      fdgets.symtab0x80482e7111FUNC<unknown>DEFAULT2
      fflush_unlocked.symtab0x805123c333FUNC<unknown>DEFAULT2
      fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgetc_unlocked.symtab0x8052094220FUNC<unknown>DEFAULT2
      fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgets.symtab0x80510f498FUNC<unknown>DEFAULT2
      fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgets_unlocked.symtab0x805138c105FUNC<unknown>DEFAULT2
      fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fmt.symtab0x805413c20OBJECT<unknown>DEFAULT4
      fopen.symtab0x8050cbc24FUNC<unknown>DEFAULT2
      fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fork.symtab0x804bdec38FUNC<unknown>DEFAULT2
      fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fputs_unlocked.symtab0x804ce8c49FUNC<unknown>DEFAULT2
      fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      frame_dummy.symtab0x80481100FUNC<unknown>DEFAULT2
      free.symtab0x804e321412FUNC<unknown>DEFAULT2
      free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fseek.symtab0x8050cd427FUNC<unknown>DEFAULT2
      fseeko.symtab0x8050cd427FUNC<unknown>DEFAULT2
      fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fseeko64.symtab0x8050cf0231FUNC<unknown>DEFAULT2
      fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      ftcp.symtab0x80496b41407FUNC<unknown>DEFAULT2
      fwrite_unlocked.symtab0x804cec0120FUNC<unknown>DEFAULT2
      fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getArch.symtab0x804a72f10FUNC<unknown>DEFAULT2
      getHost.symtab0x8048c1555FUNC<unknown>DEFAULT2
      getOurIP.symtab0x8048356547FUNC<unknown>DEFAULT2
      getPortz.symtab0x804a739154FUNC<unknown>DEFAULT2
      getRandomIP.symtab0x80482bb44FUNC<unknown>DEFAULT2
      get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getc_unlocked.symtab0x8052094220FUNC<unknown>DEFAULT2
      getdtablesize.symtab0x804f25837FUNC<unknown>DEFAULT2
      getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getegid.symtab0x804f28038FUNC<unknown>DEFAULT2
      getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      geteuid.symtab0x804f2a838FUNC<unknown>DEFAULT2
      geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getgid.symtab0x804f2d038FUNC<unknown>DEFAULT2
      getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      gethostbyname.symtab0x804d30448FUNC<unknown>DEFAULT2
      gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      gethostbyname_r.symtab0x804d334818FUNC<unknown>DEFAULT2
      gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getpagesize.symtab0x804f2f817FUNC<unknown>DEFAULT2
      getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getpid.symtab0x804be1438FUNC<unknown>DEFAULT2
      getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getrlimit.symtab0x804f30c50FUNC<unknown>DEFAULT2
      getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getsockname.symtab0x804d69443FUNC<unknown>DEFAULT2
      getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getsockopt.symtab0x804d6c059FUNC<unknown>DEFAULT2
      getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getuid.symtab0x804f34038FUNC<unknown>DEFAULT2
      getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      gotIP.symtab0x80558c44OBJECT<unknown>DEFAULT11
      h.5161.symtab0x805baec20OBJECT<unknown>DEFAULT11
      h_errno.symtab0x805bb244OBJECT<unknown>DEFAULT11
      htonl.symtab0x804d25d7FUNC<unknown>DEFAULT2
      htons.symtab0x804d25013FUNC<unknown>DEFAULT2
      i.4243.symtab0x80556144OBJECT<unknown>DEFAULT10
      index.symtab0x804cf7830FUNC<unknown>DEFAULT2
      inet_addr.symtab0x804d2dc37FUNC<unknown>DEFAULT2
      inet_aton.symtab0x80500a0148FUNC<unknown>DEFAULT2
      inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      inet_ntoa.symtab0x804d2c721FUNC<unknown>DEFAULT2
      inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      inet_ntoa_r.symtab0x804d27879FUNC<unknown>DEFAULT2
      inet_ntop.symtab0x8051879465FUNC<unknown>DEFAULT2
      inet_ntop4.symtab0x8051768273FUNC<unknown>DEFAULT2
      inet_pton.symtab0x805159e458FUNC<unknown>DEFAULT2
      inet_pton4.symtab0x8051518134FUNC<unknown>DEFAULT2
      initConnection.symtab0x804b566334FUNC<unknown>DEFAULT2
      init_rand.symtab0x804818c111FUNC<unknown>DEFAULT2
      initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      initstate.symtab0x804e6a187FUNC<unknown>DEFAULT2
      initstate_r.symtab0x804e8cd171FUNC<unknown>DEFAULT2
      ioctl.symtab0x804be3c63FUNC<unknown>DEFAULT2
      ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      isatty.symtab0x804d1c029FUNC<unknown>DEFAULT2
      isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      isspace.symtab0x804c03817FUNC<unknown>DEFAULT2
      isspace.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      kill.symtab0x804be7c50FUNC<unknown>DEFAULT2
      kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/mmap.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      listFork.symtab0x8049082261FUNC<unknown>DEFAULT2
      llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      lseek64.symtab0x805201c86FUNC<unknown>DEFAULT2
      macAddress.symtab0x80558d06OBJECT<unknown>DEFAULT11
      main.symtab0x804b6b41507FUNC<unknown>DEFAULT2
      mainCommSock.symtab0x80558c04OBJECT<unknown>DEFAULT11
      makeIPPacket.symtab0x80492de132FUNC<unknown>DEFAULT2
      makeRandomStr.symtab0x8048c4c106FUNC<unknown>DEFAULT2
      makevsepacket.symtab0x8049e63151FUNC<unknown>DEFAULT2
      malloc.symtab0x804d94a1954FUNC<unknown>DEFAULT2
      malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      malloc_trim.symtab0x804e4bd34FUNC<unknown>DEFAULT2
      memchr.symtab0x804fed435FUNC<unknown>DEFAULT2
      memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memcpy.symtab0x804cf3839FUNC<unknown>DEFAULT2
      memcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memmove.symtab0x804fef839FUNC<unknown>DEFAULT2
      memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mempcpy.symtab0x804ff4833FUNC<unknown>DEFAULT2
      mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memrchr.symtab0x804ff6c176FUNC<unknown>DEFAULT2
      memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memset.symtab0x804cf6021FUNC<unknown>DEFAULT2
      memset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mmap.symtab0x804f19827FUNC<unknown>DEFAULT2
      munmap.symtab0x804f36850FUNC<unknown>DEFAULT2
      munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mylock.symtab0x805578824OBJECT<unknown>DEFAULT10
      mylock.symtab0x80557a024OBJECT<unknown>DEFAULT10
      mylock.symtab0x805bb2824OBJECT<unknown>DEFAULT11
      nanosleep.symtab0x804f39c50FUNC<unknown>DEFAULT2
      nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      next_start.1278.symtab0x805b9004OBJECT<unknown>DEFAULT11
      ntohl.symtab0x804d2717FUNC<unknown>DEFAULT2
      ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      ntohs.symtab0x804d26413FUNC<unknown>DEFAULT2
      ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      numpids.symtab0x80558c88OBJECT<unknown>DEFAULT11
      object.2482.symtab0x80558a424OBJECT<unknown>DEFAULT11
      open.symtab0x804beb075FUNC<unknown>DEFAULT2
      open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      ourIP.symtab0x805bb484OBJECT<unknown>DEFAULT11
      p.2427.symtab0x80555e40OBJECT<unknown>DEFAULT10
      pids.symtab0x805bb4c4OBJECT<unknown>DEFAULT11
      poll.symtab0x8050b7454FUNC<unknown>DEFAULT2
      poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      prefix.4371.symtab0x805328512OBJECT<unknown>DEFAULT4
      print.symtab0x804887f722FUNC<unknown>DEFAULT2
      printchar.symtab0x804862466FUNC<unknown>DEFAULT2
      printi.symtab0x8048740319FUNC<unknown>DEFAULT2
      prints.symtab0x8048666218FUNC<unknown>DEFAULT2
      processCmd.symtab0x804a7d33475FUNC<unknown>DEFAULT2
      qual_chars.4377.symtab0x805329820OBJECT<unknown>DEFAULT4
      raise.symtab0x8050af824FUNC<unknown>DEFAULT2
      raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand.symtab0x804e5f45FUNC<unknown>DEFAULT2
      rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand_cmwc.symtab0x80481fb192FUNC<unknown>DEFAULT2
      random.symtab0x804e5fc72FUNC<unknown>DEFAULT2
      random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      random_poly_info.symtab0x8053ea040OBJECT<unknown>DEFAULT4
      random_r.symtab0x804e7d594FUNC<unknown>DEFAULT2
      random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      randtbl.symtab0x80557e0128OBJECT<unknown>DEFAULT10
      rawmemchr.symtab0x805144899FUNC<unknown>DEFAULT2
      rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      read.symtab0x804bf1454FUNC<unknown>DEFAULT2
      read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      recv.symtab0x804d6fc51FUNC<unknown>DEFAULT2
      recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      recvLine.symtab0x8048cb6449FUNC<unknown>DEFAULT2
      sbrk.symtab0x804f3d078FUNC<unknown>DEFAULT2
      sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      select.symtab0x804bf4c63FUNC<unknown>DEFAULT2
      select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      send.symtab0x804d73051FUNC<unknown>DEFAULT2
      send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sendHTTPtwo.symtab0x804a580431FUNC<unknown>DEFAULT2
      sendto.symtab0x804d76467FUNC<unknown>DEFAULT2
      sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setsid.symtab0x804bf8c38FUNC<unknown>DEFAULT2
      setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setsockopt.symtab0x804d7a859FUNC<unknown>DEFAULT2
      setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setstate.symtab0x804e64493FUNC<unknown>DEFAULT2
      setstate_r.symtab0x804e73c153FUNC<unknown>DEFAULT2
      sigaction.symtab0x804f0bb218FUNC<unknown>DEFAULT2
      sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      signal.symtab0x804d810175FUNC<unknown>DEFAULT2
      signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigprocmask.symtab0x804f42085FUNC<unknown>DEFAULT2
      sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sleep.symtab0x804eb34393FUNC<unknown>DEFAULT2
      sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      socket.symtab0x804d7e443FUNC<unknown>DEFAULT2
      socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      socket_connect.symtab0x8049d65254FUNC<unknown>DEFAULT2
      sockprintf.symtab0x8048b51196FUNC<unknown>DEFAULT2
      spec_and_mask.4376.symtab0x80532ac16OBJECT<unknown>DEFAULT4
      spec_base.4370.symtab0x80532917OBJECT<unknown>DEFAULT4
      spec_chars.4373.symtab0x80532d521OBJECT<unknown>DEFAULT4
      spec_flags.4372.symtab0x80532ea8OBJECT<unknown>DEFAULT4
      spec_or_mask.4375.symtab0x80532bc16OBJECT<unknown>DEFAULT4
      spec_ranges.4374.symtab0x80532cc9OBJECT<unknown>DEFAULT4
      sprintf.symtab0x804c07431FUNC<unknown>DEFAULT2
      sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      srand.symtab0x804e6f867FUNC<unknown>DEFAULT2
      srandom.symtab0x804e6f867FUNC<unknown>DEFAULT2
      srandom_r.symtab0x804e833154FUNC<unknown>DEFAULT2
      static_id.symtab0x805587c2OBJECT<unknown>DEFAULT10
      static_ns.symtab0x805bb404OBJECT<unknown>DEFAULT11
      stderr.symtab0x80556304OBJECT<unknown>DEFAULT10
      stdin.symtab0x80556284OBJECT<unknown>DEFAULT10
      stdout.symtab0x805562c4OBJECT<unknown>DEFAULT10
      strcasecmp.symtab0x805217054FUNC<unknown>DEFAULT2
      strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strchr.symtab0x804cf7830FUNC<unknown>DEFAULT2
      strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strcmp.symtab0x80513f829FUNC<unknown>DEFAULT2
      strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strcoll.symtab0x80513f829FUNC<unknown>DEFAULT2
      strcpy.symtab0x804cf9827FUNC<unknown>DEFAULT2
      strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strdup.symtab0x80514e054FUNC<unknown>DEFAULT2
      strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strerror_r.symtab0x804d0d4182FUNC<unknown>DEFAULT2
      strlen.symtab0x804cfb419FUNC<unknown>DEFAULT2
      strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strncat.symtab0x805141846FUNC<unknown>DEFAULT2
      strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strncpy.symtab0x804ff2038FUNC<unknown>DEFAULT2
      strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strnlen.symtab0x804cfc825FUNC<unknown>DEFAULT2
      strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strpbrk.symtab0x805007839FUNC<unknown>DEFAULT2
      strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strspn.symtab0x80514ac50FUNC<unknown>DEFAULT2
      strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strstr.symtab0x804cfe4206FUNC<unknown>DEFAULT2
      strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strtok.symtab0x804d1a425FUNC<unknown>DEFAULT2
      strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strtok_r.symtab0x805001c89FUNC<unknown>DEFAULT2
      strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strtol.symtab0x804e98c26FUNC<unknown>DEFAULT2
      strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sysconf.symtab0x804ecc0325FUNC<unknown>DEFAULT2
      sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      tcgetattr.symtab0x804d1e0112FUNC<unknown>DEFAULT2
      tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      tcpcsum.symtab0x8049226184FUNC<unknown>DEFAULT2
      time.symtab0x804bfb446FUNC<unknown>DEFAULT2
      time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      tolower.symtab0x805207429FUNC<unknown>DEFAULT2
      tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      toupper.symtab0x804c04c29FUNC<unknown>DEFAULT2
      toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      trim.symtab0x8048579171FUNC<unknown>DEFAULT2
      type_codes.symtab0x80532f224OBJECT<unknown>DEFAULT4
      type_sizes.symtab0x805330a12OBJECT<unknown>DEFAULT4
      unknown.1330.symtab0x805331614OBJECT<unknown>DEFAULT4
      unsafe_state.symtab0x80557b828OBJECT<unknown>DEFAULT10
      useragents.symtab0x80555f028OBJECT<unknown>DEFAULT10
      usleep.symtab0x804ee0848FUNC<unknown>DEFAULT2
      usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      vseattack.symtab0x8049efa1239FUNC<unknown>DEFAULT2
      vsnprintf.symtab0x804c094176FUNC<unknown>DEFAULT2
      vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      wait4.symtab0x804f47859FUNC<unknown>DEFAULT2
      wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      waitpid.symtab0x804bfe426FUNC<unknown>DEFAULT2
      waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      wcrtomb.symtab0x804f4bc69FUNC<unknown>DEFAULT2
      wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      wcsnrtombs.symtab0x804f524133FUNC<unknown>DEFAULT2
      wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      wcsrtombs.symtab0x804f50430FUNC<unknown>DEFAULT2
      wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      write.symtab0x804c00054FUNC<unknown>DEFAULT2
      write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      xdigits.3285.symtab0x805425417OBJECT<unknown>DEFAULT4

      Network Behavior

      Snort IDS Alerts

      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
      192.168.2.23163.123.143.81399068392841335 08/06/22-01:53:00.671113TCP2841335ETPRO TROJAN ELF/Mirai Variant CnC Checkin39906839192.168.2.23163.123.143.81

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Aug 6, 2022 01:52:58.815227985 CEST42836443192.168.2.2391.189.91.43
      Aug 6, 2022 01:52:59.583203077 CEST4251680192.168.2.23109.202.202.202
      Aug 6, 2022 01:53:00.408884048 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:53:00.437414885 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:53:00.437606096 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:53:00.437655926 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:53:00.671113014 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:53:00.699481964 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:53:13.150455952 CEST43928443192.168.2.2391.189.91.42
      Aug 6, 2022 01:53:25.437731981 CEST42836443192.168.2.2391.189.91.43
      Aug 6, 2022 01:53:27.424295902 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:53:27.424465895 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:53:27.456490993 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:53:27.456614017 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:53:29.533498049 CEST4251680192.168.2.23109.202.202.202
      Aug 6, 2022 01:53:54.108274937 CEST43928443192.168.2.2391.189.91.42
      Aug 6, 2022 01:54:27.433825016 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:54:27.434040070 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:54:27.464616060 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:54:27.464816093 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:55:27.451535940 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:55:27.451714993 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:55:27.484514952 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:55:27.484657049 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:56:27.475846052 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:56:27.476059914 CEST39906839192.168.2.23163.123.143.81
      Aug 6, 2022 01:56:27.506045103 CEST83939906163.123.143.81192.168.2.23
      Aug 6, 2022 01:56:27.506201029 CEST39906839192.168.2.23163.123.143.81

      System Behavior

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/bin/sh
      Arguments:sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/bin/sh
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/lib/rsyslog/rsyslog-rotate
      Arguments:/usr/lib/rsyslog/rsyslog-rotate
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/lib/rsyslog/rsyslog-rotate
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/systemctl
      Arguments:systemctl kill -s HUP rsyslog.service
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/python3.8
      Arguments:n/a
      File size:5490352 bytes
      MD5 hash:69f442c3e33b5f9a66b722c29ad89435

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/uname
      Arguments:uname -p
      File size:39288 bytes
      MD5 hash:4ac7c634c5bec95753c480e9d421dcc2

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/cut
      Arguments:cut -c -40 /tmp/tmp.5piRJmkiY5
      File size:47480 bytes
      MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/tr
      Arguments:tr -c -d [:alnum:]
      File size:51544 bytes
      MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:44
      Start date:06/08/2022
      Path:/usr/bin/wget
      Arguments:wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com
      File size:548568 bytes
      MD5 hash:996940118df7bb2aaa718589d4e95c08

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/cat
      Arguments:cat /tmp/tmp.hDXKGVsUIR
      File size:43416 bytes
      MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/head
      Arguments:head -n 10
      File size:47480 bytes
      MD5 hash:fd96a67145172477dd57131396fc9608

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/tr
      Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
      File size:51544 bytes
      MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/cut
      Arguments:cut -c -80
      File size:47480 bytes
      MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/cat
      Arguments:cat /tmp/tmp.hDXKGVsUIR
      File size:43416 bytes
      MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/head
      Arguments:head -n 10
      File size:47480 bytes
      MD5 hash:fd96a67145172477dd57131396fc9608

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/tr
      Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
      File size:51544 bytes
      MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/cut
      Arguments:cut -c -80
      File size:47480 bytes
      MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/dash
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      General

      Start time:01:52:45
      Start date:06/08/2022
      Path:/usr/bin/rm
      Arguments:rm -f /tmp/tmp.hDXKGVsUIR /tmp/tmp.1y2FR6QFox /tmp/tmp.5piRJmkiY5
      File size:72056 bytes
      MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

      General

      Start time:01:52:59
      Start date:06/08/2022
      Path:/tmp/x-3.2-.SNOOPY
      Arguments:/tmp/x-3.2-.SNOOPY
      File size:74024 bytes
      MD5 hash:ca34f09d0fe8bd0dddd1443e401781d7

      General

      Start time:01:52:59
      Start date:06/08/2022
      Path:/tmp/x-3.2-.SNOOPY
      Arguments:n/a
      File size:74024 bytes
      MD5 hash:ca34f09d0fe8bd0dddd1443e401781d7

      General

      Start time:01:52:59
      Start date:06/08/2022
      Path:/tmp/x-3.2-.SNOOPY
      Arguments:n/a
      File size:74024 bytes
      MD5 hash:ca34f09d0fe8bd0dddd1443e401781d7