Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
YQ8ULbBFnH

Overview

General Information

Sample Name:YQ8ULbBFnH
Analysis ID:680600
MD5:ff22e45af9df28695df9805fceb128ee
SHA1:cd962d3495aaa3ebfcf8b0c186aa05740a821f87
SHA256:726ff17cc2f974309d1bc2cabfcde4aa0c01550c97553ab3676364e8458132e4
Tags:32elfgafgytintel
Infos:

Detection

Mirai
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Opens /proc/net/* files useful for finding connected devices and routers
Machine Learning detection for sample
Contains symbols with names commonly found in malware
Yara signature match
Sample contains strings that are user agent strings indicative of HTTP manipulation

Classification

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:680600
Start date and time: 08/08/202221:34:592022-08-08 21:34:59 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 6s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:YQ8ULbBFnH
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal84.spre.troj.lin@0/0@0/0
Command:/tmp/YQ8ULbBFnH
PID:6231
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate alot
Standard Error:
  • system is lnxubuntu20
  • YQ8ULbBFnH (PID: 6231, Parent: 6123, MD5: ff22e45af9df28695df9805fceb128ee) Arguments: /tmp/YQ8ULbBFnH
  • cleanup
SourceRuleDescriptionAuthorStrings
YQ8ULbBFnHJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    YQ8ULbBFnHLinux_Trojan_Gafgyt_83715433unknownunknown
    • 0x130b:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
    YQ8ULbBFnHLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xf03c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf08c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf0a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf0b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf0c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf0dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf0f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf12c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    YQ8ULbBFnHLinux_Trojan_Gafgyt_6122acdfunknownunknown
    • 0x538:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
    YQ8ULbBFnHLinux_Trojan_Gafgyt_f51c5ac3unknownunknown
    • 0x11e2:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
    Click to see the 3 entries
    SourceRuleDescriptionAuthorStrings
    6232.1.0000000008048000.000000000805b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6232.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_83715433unknownunknown
      • 0x130b:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
      6232.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xf03c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf08c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf0a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf0b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf0c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf0dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf0f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf12c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      6232.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_6122acdfunknownunknown
      • 0x538:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
      6232.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_f51c5ac3unknownunknown
      • 0x11e2:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
      Click to see the 31 entries
      No Snort rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: YQ8ULbBFnHAvira: detected
      Source: YQ8ULbBFnHVirustotal: Detection: 63%Perma Link
      Source: YQ8ULbBFnHReversingLabs: Detection: 64%
      Source: YQ8ULbBFnHJoe Sandbox ML: detected

      Spreading

      barindex
      Source: /tmp/YQ8ULbBFnH (PID: 6231)Opens: /proc/net/routeJump to behavior

      System Summary

      barindex
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
      Source: Process Memory Space: YQ8ULbBFnH PID: 6231, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: YQ8ULbBFnH PID: 6232, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: YQ8ULbBFnH PID: 6233, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: YQ8ULbBFnH PID: 6297, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: ELF static info symbol of initial sampleName: vseattack
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
      Source: YQ8ULbBFnH, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
      Source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
      Source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
      Source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
      Source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
      Source: Process Memory Space: YQ8ULbBFnH PID: 6231, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: YQ8ULbBFnH PID: 6232, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: YQ8ULbBFnH PID: 6233, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: YQ8ULbBFnH PID: 6297, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: YQ8ULbBFnHELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
      Source: YQ8ULbBFnHELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
      Source: YQ8ULbBFnHELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
      Source: YQ8ULbBFnHELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
      Source: YQ8ULbBFnHELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S
      Source: classification engineClassification label: mal84.spre.troj.lin@0/0@0/0

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: YQ8ULbBFnH, type: SAMPLE
      Source: Yara matchFile source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
      Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
      Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: YQ8ULbBFnH, type: SAMPLE
      Source: Yara matchFile source: 6232.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6233.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6297.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6231.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping1
      Remote System Discovery
      Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
      Data Obfuscation
      Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 680600 Sample: YQ8ULbBFnH Startdate: 08/08/2022 Architecture: LINUX Score: 84 19 Malicious sample detected (through community Yara rule) 2->19 21 Antivirus / Scanner detection for submitted sample 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 3 other signatures 2->25 8 YQ8ULbBFnH 2->8         started        process3 signatures4 27 Opens /proc/net/* files useful for finding connected devices and routers 8->27 11 YQ8ULbBFnH 8->11         started        13 YQ8ULbBFnH 8->13         started        process5 process6 15 YQ8ULbBFnH 11->15         started        process7 17 YQ8ULbBFnH 15->17         started       
      SourceDetectionScannerLabelLink
      YQ8ULbBFnH63%VirustotalBrowse
      YQ8ULbBFnH64%ReversingLabsLinux.Trojan.Gafgyt
      YQ8ULbBFnH100%AviraLINUX/Mirai.Gafgyt.
      YQ8ULbBFnH100%Joe Sandbox ML
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      No contacted domains info
      No contacted IP infos
      No context
      No context
      No context
      No context
      No context
      No created / dropped files found
      File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
      Entropy (8bit):6.356393614910588
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:YQ8ULbBFnH
      File size:104138
      MD5:ff22e45af9df28695df9805fceb128ee
      SHA1:cd962d3495aaa3ebfcf8b0c186aa05740a821f87
      SHA256:726ff17cc2f974309d1bc2cabfcde4aa0c01550c97553ab3676364e8458132e4
      SHA512:607281240b80b68f44f1fe09973af58456b32ff5d0b804f02131201038fcc0b80cf609eff08d0c63f1661cb663fd5c72bc8aaf05c24ac4db508c787eec0927f9
      SSDEEP:3072:wW8FUmgujld6Mkxm6AJ+4fFHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fFHmmFVcqq0GnDZT
      TLSH:6BA3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59
      File Content Preview:.ELF....................h...4....?......4. ...(.....................D&..D&...............0..............dk..........Q.td............................U..S.......w/...h....#...[]...$.............U......=.....t..1....$......$.......u........t...$@............

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:Intel 80386
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x8048168
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:81912
      Section Header Size:40
      Number of Section Headers:16
      Header String Table Index:13
      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .initPROGBITS0x80480940x940x1c0x00x6AX001
      .textPROGBITS0x80480b00xb00xde540x00x6AX0016
      .finiPROGBITS0x8055f040xdf040x170x00x6AX001
      .rodataPROGBITS0x8055f200xdf200x47200x00x2A0032
      .eh_framePROGBITS0x805a6400x126400x40x00x2A004
      .ctorsPROGBITS0x805b0000x130000x80x00x3WA004
      .dtorsPROGBITS0x805b0080x130080x80x00x3WA004
      .jcrPROGBITS0x805b0100x130100x40x00x3WA004
      .got.pltPROGBITS0x805b0140x130140xc0x40x3WA004
      .dataPROGBITS0x805b0200x130200x3600x00x3WA0032
      .bssNOBITS0x805b3800x133800x67e40x00x3WA0032
      .commentPROGBITS0x00x133800xc060x00x0001
      .shstrtabSTRTAB0x00x13f860x6f0x00x0001
      .symtabSYMTAB0x00x142780x30400x100x0152774
      .strtabSTRTAB0x00x172b80x24120x00x0001
      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x80480000x80480000x126440x126446.56720x5R E0x1000.init .text .fini .rodata .eh_frame
      LOAD0x130000x805b0000x805b0000x3800x6b643.85540x6RW 0x1000.ctors .dtors .jcr .got.plt .data .bss
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
      NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
      .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      .symtab0x80480940SECTION<unknown>DEFAULT1
      .symtab0x80480b00SECTION<unknown>DEFAULT2
      .symtab0x8055f040SECTION<unknown>DEFAULT3
      .symtab0x8055f200SECTION<unknown>DEFAULT4
      .symtab0x805a6400SECTION<unknown>DEFAULT5
      .symtab0x805b0000SECTION<unknown>DEFAULT6
      .symtab0x805b0080SECTION<unknown>DEFAULT7
      .symtab0x805b0100SECTION<unknown>DEFAULT8
      .symtab0x805b0140SECTION<unknown>DEFAULT9
      .symtab0x805b0200SECTION<unknown>DEFAULT10
      .symtab0x805b3800SECTION<unknown>DEFAULT11
      .symtab0x00SECTION<unknown>DEFAULT12
      .symtab0x00SECTION<unknown>DEFAULT13
      .symtab0x00SECTION<unknown>DEFAULT14
      .symtab0x00SECTION<unknown>DEFAULT15
      C.151.5750.symtab0x805834040OBJECT<unknown>DEFAULT4
      KHcommSOCK.symtab0x805b3a04OBJECT<unknown>DEFAULT11
      KHserverHACKER.symtab0x805b0f04OBJECT<unknown>DEFAULT10
      LOCAL_ADDR.symtab0x80616284OBJECT<unknown>DEFAULT11
      Q.symtab0x805b3c016384OBJECT<unknown>DEFAULT11
      UserAgents.symtab0x805b060144OBJECT<unknown>DEFAULT10
      _GLOBAL_OFFSET_TABLE_.symtab0x805b0140OBJECT<unknown>HIDDEN9
      _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __CTOR_END__.symtab0x805b0040OBJECT<unknown>DEFAULT6
      __CTOR_LIST__.symtab0x805b0000OBJECT<unknown>DEFAULT6
      __C_ctype_b.symtab0x805b1044OBJECT<unknown>DEFAULT10
      __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_b_data.symtab0x8058d00768OBJECT<unknown>DEFAULT4
      __C_ctype_tolower.symtab0x805b3784OBJECT<unknown>DEFAULT10
      __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_tolower_data.symtab0x805a340768OBJECT<unknown>DEFAULT4
      __C_ctype_toupper.symtab0x805b10c4OBJECT<unknown>DEFAULT10
      __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_toupper_data.symtab0x8059000768OBJECT<unknown>DEFAULT4
      __DTOR_END__.symtab0x805b00c0OBJECT<unknown>DEFAULT7
      __DTOR_LIST__.symtab0x805b0080OBJECT<unknown>DEFAULT7
      __EH_FRAME_BEGIN__.symtab0x805a6400OBJECT<unknown>DEFAULT5
      __FRAME_END__.symtab0x805a6400OBJECT<unknown>DEFAULT5
      __GI___C_ctype_b.symtab0x805b1044OBJECT<unknown>HIDDEN10
      __GI___C_ctype_b_data.symtab0x8058d00768OBJECT<unknown>HIDDEN4
      __GI___C_ctype_tolower.symtab0x805b3784OBJECT<unknown>HIDDEN10
      __GI___C_ctype_tolower_data.symtab0x805a340768OBJECT<unknown>HIDDEN4
      __GI___C_ctype_toupper.symtab0x805b10c4OBJECT<unknown>HIDDEN10
      __GI___C_ctype_toupper_data.symtab0x8059000768OBJECT<unknown>HIDDEN4
      __GI___ctype_b.symtab0x805b1084OBJECT<unknown>HIDDEN10
      __GI___ctype_tolower.symtab0x805b37c4OBJECT<unknown>HIDDEN10
      __GI___ctype_toupper.symtab0x805b1104OBJECT<unknown>HIDDEN10
      __GI___errno_location.symtab0x804f64c6FUNC<unknown>HIDDEN2
      __GI___fgetc_unlocked.symtab0x8055b24220FUNC<unknown>HIDDEN2
      __GI___glibc_strerror_r.symtab0x80506e029FUNC<unknown>HIDDEN2
      __GI___h_errno_location.symtab0x8052f846FUNC<unknown>HIDDEN2
      __GI___libc_fcntl.symtab0x804f13c87FUNC<unknown>HIDDEN2
      __GI___libc_fcntl64.symtab0x804f19463FUNC<unknown>HIDDEN2
      __GI___libc_open.symtab0x804f40475FUNC<unknown>HIDDEN2
      __GI___uClibc_fini.symtab0x805292463FUNC<unknown>HIDDEN2
      __GI___uClibc_init.symtab0x805299b64FUNC<unknown>HIDDEN2
      __GI___xpg_strerror_r.symtab0x8050700182FUNC<unknown>HIDDEN2
      __GI__exit.symtab0x804f1d440FUNC<unknown>HIDDEN2
      __GI_abort.symtab0x8051f60273FUNC<unknown>HIDDEN2
      __GI_atoi.symtab0x80523f820FUNC<unknown>HIDDEN2
      __GI_atol.symtab0x80523f820FUNC<unknown>HIDDEN2
      __GI_brk.symtab0x80545cc54FUNC<unknown>HIDDEN2
      __GI_clock_getres.symtab0x8052d2850FUNC<unknown>HIDDEN2
      __GI_close.symtab0x804f23046FUNC<unknown>HIDDEN2
      __GI_connect.symtab0x8050c3043FUNC<unknown>HIDDEN2
      __GI_dup2.symtab0x804f26050FUNC<unknown>HIDDEN2
      __GI_errno.symtab0x80616004OBJECT<unknown>HIDDEN11
      __GI_execl.symtab0x80525b4105FUNC<unknown>HIDDEN2
      __GI_execve.symtab0x8052d5c54FUNC<unknown>HIDDEN2
      __GI_exit.symtab0x805254c103FUNC<unknown>HIDDEN2
      __GI_fclose.symtab0x805463c271FUNC<unknown>HIDDEN2
      __GI_fcntl.symtab0x804f13c87FUNC<unknown>HIDDEN2
      __GI_fcntl64.symtab0x804f19463FUNC<unknown>HIDDEN2
      __GI_fflush_unlocked.symtab0x8054ccc333FUNC<unknown>HIDDEN2
      __GI_fgetc_unlocked.symtab0x8055b24220FUNC<unknown>HIDDEN2
      __GI_fgets.symtab0x8054b8498FUNC<unknown>HIDDEN2
      __GI_fgets_unlocked.symtab0x8054e1c105FUNC<unknown>HIDDEN2
      __GI_fopen.symtab0x805474c24FUNC<unknown>HIDDEN2
      __GI_fork.symtab0x804f29438FUNC<unknown>HIDDEN2
      __GI_fputs_unlocked.symtab0x805049049FUNC<unknown>HIDDEN2
      __GI_fseek.symtab0x805476427FUNC<unknown>HIDDEN2
      __GI_fseeko64.symtab0x8054780231FUNC<unknown>HIDDEN2
      __GI_fwrite_unlocked.symtab0x80504c4120FUNC<unknown>HIDDEN2
      __GI_getc_unlocked.symtab0x8055b24220FUNC<unknown>HIDDEN2
      __GI_getdtablesize.symtab0x804f2bc37FUNC<unknown>HIDDEN2
      __GI_getegid.symtab0x8052d9438FUNC<unknown>HIDDEN2
      __GI_geteuid.symtab0x804f2e438FUNC<unknown>HIDDEN2
      __GI_getgid.symtab0x8052dbc38FUNC<unknown>HIDDEN2
      __GI_gethostbyname.symtab0x80508cc48FUNC<unknown>HIDDEN2
      __GI_gethostbyname_r.symtab0x80508fc818FUNC<unknown>HIDDEN2
      __GI_getpagesize.symtab0x8052de417FUNC<unknown>HIDDEN2
      __GI_getpid.symtab0x804f30c38FUNC<unknown>HIDDEN2
      __GI_getrlimit.symtab0x804f35c50FUNC<unknown>HIDDEN2
      __GI_getsockname.symtab0x8050c5c43FUNC<unknown>HIDDEN2
      __GI_getuid.symtab0x8052df838FUNC<unknown>HIDDEN2
      __GI_h_errno.symtab0x80616044OBJECT<unknown>HIDDEN11
      __GI_inet_addr.symtab0x80508a437FUNC<unknown>HIDDEN2
      __GI_inet_aton.symtab0x8053b48148FUNC<unknown>HIDDEN2
      __GI_inet_ntop.symtab0x8055309465FUNC<unknown>HIDDEN2
      __GI_inet_pton.symtab0x805502e458FUNC<unknown>HIDDEN2
      __GI_initstate_r.symtab0x805234d171FUNC<unknown>HIDDEN2
      __GI_ioctl.symtab0x804f39063FUNC<unknown>HIDDEN2
      __GI_isatty.symtab0x80507ec29FUNC<unknown>HIDDEN2
      __GI_kill.symtab0x804f3d050FUNC<unknown>HIDDEN2
      __GI_lseek64.symtab0x8055aac86FUNC<unknown>HIDDEN2
      __GI_memchr.symtab0x80539a435FUNC<unknown>HIDDEN2
      __GI_memcpy.symtab0x805053c39FUNC<unknown>HIDDEN2
      __GI_memmove.symtab0x80539c839FUNC<unknown>HIDDEN2
      __GI_mempcpy.symtab0x80539f033FUNC<unknown>HIDDEN2
      __GI_memrchr.symtab0x8053a14176FUNC<unknown>HIDDEN2
      __GI_memset.symtab0x805056421FUNC<unknown>HIDDEN2
      __GI_mmap.symtab0x8052c9c27FUNC<unknown>HIDDEN2
      __GI_mremap.symtab0x8052e2063FUNC<unknown>HIDDEN2
      __GI_munmap.symtab0x8052e6050FUNC<unknown>HIDDEN2
      __GI_nanosleep.symtab0x8052e9450FUNC<unknown>HIDDEN2
      __GI_open.symtab0x804f40475FUNC<unknown>HIDDEN2
      __GI_pipe.symtab0x804f46846FUNC<unknown>HIDDEN2
      __GI_poll.symtab0x805460454FUNC<unknown>HIDDEN2
      __GI_raise.symtab0x80545a024FUNC<unknown>HIDDEN2
      __GI_random.symtab0x805207c72FUNC<unknown>HIDDEN2
      __GI_random_r.symtab0x805225594FUNC<unknown>HIDDEN2
      __GI_rawmemchr.symtab0x8054ed899FUNC<unknown>HIDDEN2
      __GI_read.symtab0x804f4d854FUNC<unknown>HIDDEN2
      __GI_recv.symtab0x8050cc451FUNC<unknown>HIDDEN2
      __GI_recvfrom.symtab0x8050cf867FUNC<unknown>HIDDEN2
      __GI_sbrk.symtab0x8052ec878FUNC<unknown>HIDDEN2
      __GI_select.symtab0x804f51063FUNC<unknown>HIDDEN2
      __GI_send.symtab0x8050d3c51FUNC<unknown>HIDDEN2
      __GI_sendto.symtab0x8050d7067FUNC<unknown>HIDDEN2
      __GI_setsockopt.symtab0x8050db459FUNC<unknown>HIDDEN2
      __GI_setstate_r.symtab0x80521bc153FUNC<unknown>HIDDEN2
      __GI_sigaction.symtab0x8052ba7218FUNC<unknown>HIDDEN2
      __GI_sigaddset.symtab0x8050e1c42FUNC<unknown>HIDDEN2
      __GI_sigemptyset.symtab0x8050e4825FUNC<unknown>HIDDEN2
      __GI_signal.symtab0x8050e64175FUNC<unknown>HIDDEN2
      __GI_sigprocmask.symtab0x804f55085FUNC<unknown>HIDDEN2
      __GI_sleep.symtab0x8052620393FUNC<unknown>HIDDEN2
      __GI_socket.symtab0x8050df043FUNC<unknown>HIDDEN2
      __GI_sprintf.symtab0x804f67831FUNC<unknown>HIDDEN2
      __GI_srandom_r.symtab0x80522b3154FUNC<unknown>HIDDEN2
      __GI_strcasecmp.symtab0x8055c0054FUNC<unknown>HIDDEN2
      __GI_strchr.symtab0x805057c30FUNC<unknown>HIDDEN2
      __GI_strcmp.symtab0x8054e8829FUNC<unknown>HIDDEN2
      __GI_strcoll.symtab0x8054e8829FUNC<unknown>HIDDEN2
      __GI_strcpy.symtab0x805059c27FUNC<unknown>HIDDEN2
      __GI_strdup.symtab0x8054f7054FUNC<unknown>HIDDEN2
      __GI_strlen.symtab0x80505b819FUNC<unknown>HIDDEN2
      __GI_strncat.symtab0x8054ea846FUNC<unknown>HIDDEN2
      __GI_strncpy.symtab0x80505cc38FUNC<unknown>HIDDEN2
      __GI_strnlen.symtab0x80505f425FUNC<unknown>HIDDEN2
      __GI_strpbrk.symtab0x8053b2039FUNC<unknown>HIDDEN2
      __GI_strspn.symtab0x8054f3c50FUNC<unknown>HIDDEN2
      __GI_strstr.symtab0x8050610206FUNC<unknown>HIDDEN2
      __GI_strtok.symtab0x80507d025FUNC<unknown>HIDDEN2
      __GI_strtok_r.symtab0x8053ac489FUNC<unknown>HIDDEN2
      __GI_strtol.symtab0x805240c26FUNC<unknown>HIDDEN2
      __GI_sysconf.symtab0x80527ac325FUNC<unknown>HIDDEN2
      __GI_tcgetattr.symtab0x805080c112FUNC<unknown>HIDDEN2
      __GI_time.symtab0x804f5a846FUNC<unknown>HIDDEN2
      __GI_times.symtab0x8052f1846FUNC<unknown>HIDDEN2
      __GI_tolower.symtab0x8055b0429FUNC<unknown>HIDDEN2
      __GI_toupper.symtab0x804f62c29FUNC<unknown>HIDDEN2
      __GI_vfork.symtab0x804f12421FUNC<unknown>HIDDEN2
      __GI_vsnprintf.symtab0x804f698176FUNC<unknown>HIDDEN2
      __GI_wait4.symtab0x8052f4859FUNC<unknown>HIDDEN2
      __GI_waitpid.symtab0x804f5d826FUNC<unknown>HIDDEN2
      __GI_wcrtomb.symtab0x8052f8c69FUNC<unknown>HIDDEN2
      __GI_wcsnrtombs.symtab0x8052ff4133FUNC<unknown>HIDDEN2
      __GI_wcsrtombs.symtab0x8052fd430FUNC<unknown>HIDDEN2
      __GI_write.symtab0x804f5f454FUNC<unknown>HIDDEN2
      __JCR_END__.symtab0x805b0100OBJECT<unknown>DEFAULT8
      __JCR_LIST__.symtab0x805b0100OBJECT<unknown>DEFAULT8
      __app_fini.symtab0x80615f44OBJECT<unknown>HIDDEN11
      __atexit_lock.symtab0x805b34024OBJECT<unknown>DEFAULT10
      __bsd_signal.symtab0x8050e64175FUNC<unknown>HIDDEN2
      __bss_start.symtab0x805b3800NOTYPE<unknown>DEFAULTSHN_ABS
      __check_one_fd.symtab0x805296752FUNC<unknown>DEFAULT2
      __ctype_b.symtab0x805b1084OBJECT<unknown>DEFAULT10
      __ctype_tolower.symtab0x805b37c4OBJECT<unknown>DEFAULT10
      __ctype_toupper.symtab0x805b1104OBJECT<unknown>DEFAULT10
      __curbrk.symtab0x80616244OBJECT<unknown>HIDDEN11
      __data_start.symtab0x805b0280NOTYPE<unknown>DEFAULT10
      __decode_answer.symtab0x80556a8249FUNC<unknown>HIDDEN2
      __decode_dotted.symtab0x8055cc8217FUNC<unknown>HIDDEN2
      __decode_header.symtab0x805558c171FUNC<unknown>HIDDEN2
      __deregister_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __dns_lookup.symtab0x8053bdc1876FUNC<unknown>HIDDEN2
      __do_global_ctors_aux.symtab0x8055ed00FUNC<unknown>DEFAULT2
      __do_global_dtors_aux.symtab0x80480c00FUNC<unknown>DEFAULT2
      __dso_handle.symtab0x805b0200OBJECT<unknown>HIDDEN10
      __encode_dotted.symtab0x8055c38144FUNC<unknown>HIDDEN2
      __encode_header.symtab0x80554dc175FUNC<unknown>HIDDEN2
      __encode_question.symtab0x805563883FUNC<unknown>HIDDEN2
      __environ.symtab0x80615ec4OBJECT<unknown>DEFAULT11
      __errno_location.symtab0x804f64c6FUNC<unknown>DEFAULT2
      __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __exit_cleanup.symtab0x80615e44OBJECT<unknown>HIDDEN11
      __fgetc_unlocked.symtab0x8055b24220FUNC<unknown>DEFAULT2
      __fini_array_end.symtab0x805b0000NOTYPE<unknown>HIDDENSHN_ABS
      __fini_array_start.symtab0x805b0000NOTYPE<unknown>HIDDENSHN_ABS
      __get_hosts_byname_r.symtab0x805457444FUNC<unknown>HIDDEN2
      __get_pc_thunk_bx.symtab0x80480b00FUNC<unknown>HIDDEN2
      __getpagesize.symtab0x8052de417FUNC<unknown>DEFAULT2
      __glibc_strerror_r.symtab0x80506e029FUNC<unknown>DEFAULT2
      __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __h_errno_location.symtab0x8052f846FUNC<unknown>DEFAULT2
      __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __init_array_end.symtab0x805b0000NOTYPE<unknown>HIDDENSHN_ABS
      __init_array_start.symtab0x805b0000NOTYPE<unknown>HIDDENSHN_ABS
      __length_dotted.symtab0x8055da465FUNC<unknown>HIDDEN2
      __length_question.symtab0x805568c28FUNC<unknown>HIDDEN2
      __libc_close.symtab0x804f23046FUNC<unknown>DEFAULT2
      __libc_connect.symtab0x8050c3043FUNC<unknown>DEFAULT2
      __libc_creat.symtab0x804f44f25FUNC<unknown>DEFAULT2
      __libc_fcntl.symtab0x804f13c87FUNC<unknown>DEFAULT2
      __libc_fcntl64.symtab0x804f19463FUNC<unknown>DEFAULT2
      __libc_fork.symtab0x804f29438FUNC<unknown>DEFAULT2
      __libc_getpid.symtab0x804f30c38FUNC<unknown>DEFAULT2
      __libc_lseek64.symtab0x8055aac86FUNC<unknown>DEFAULT2
      __libc_nanosleep.symtab0x8052e9450FUNC<unknown>DEFAULT2
      __libc_open.symtab0x804f40475FUNC<unknown>DEFAULT2
      __libc_poll.symtab0x805460454FUNC<unknown>DEFAULT2
      __libc_read.symtab0x804f4d854FUNC<unknown>DEFAULT2
      __libc_recv.symtab0x8050cc451FUNC<unknown>DEFAULT2
      __libc_recvfrom.symtab0x8050cf867FUNC<unknown>DEFAULT2
      __libc_select.symtab0x804f51063FUNC<unknown>DEFAULT2
      __libc_send.symtab0x8050d3c51FUNC<unknown>DEFAULT2
      __libc_sendto.symtab0x8050d7067FUNC<unknown>DEFAULT2
      __libc_sigaction.symtab0x8052ba7218FUNC<unknown>DEFAULT2
      __libc_stack_end.symtab0x80615e84OBJECT<unknown>DEFAULT11
      __libc_waitpid.symtab0x804f5d826FUNC<unknown>DEFAULT2
      __libc_write.symtab0x804f5f454FUNC<unknown>DEFAULT2
      __malloc_consolidate.symtab0x8051bf9424FUNC<unknown>HIDDEN2
      __malloc_largebin_index.symtab0x8050f7838FUNC<unknown>DEFAULT2
      __malloc_lock.symtab0x805b25024OBJECT<unknown>DEFAULT10
      __malloc_state.symtab0x80617c0888OBJECT<unknown>DEFAULT11
      __malloc_trim.symtab0x8051b6c141FUNC<unknown>DEFAULT2
      __nameserver.symtab0x8061b4812OBJECT<unknown>HIDDEN11
      __nameservers.symtab0x8061b544OBJECT<unknown>HIDDEN11
      __open_etc_hosts.symtab0x80557a449FUNC<unknown>HIDDEN2
      __open_nameservers.symtab0x8054330579FUNC<unknown>HIDDEN2
      __pagesize.symtab0x80615f04OBJECT<unknown>DEFAULT11
      __preinit_array_end.symtab0x805b0000NOTYPE<unknown>HIDDENSHN_ABS
      __preinit_array_start.symtab0x805b0000NOTYPE<unknown>HIDDENSHN_ABS
      __pthread_initialize_minimal.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __pthread_mutex_init.symtab0x80529633FUNC<unknown>DEFAULT2
      __pthread_mutex_lock.symtab0x80529633FUNC<unknown>DEFAULT2
      __pthread_mutex_trylock.symtab0x80529633FUNC<unknown>DEFAULT2
      __pthread_mutex_unlock.symtab0x80529633FUNC<unknown>DEFAULT2
      __pthread_return_0.symtab0x80529633FUNC<unknown>DEFAULT2
      __pthread_return_void.symtab0x80529661FUNC<unknown>DEFAULT2
      __raise.symtab0x80545a024FUNC<unknown>HIDDEN2
      __read_etc_hosts_r.symtab0x80557d5724FUNC<unknown>HIDDEN2
      __register_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __resolv_lock.symtab0x805b36024OBJECT<unknown>DEFAULT10
      __restore.symtab0x8052b9f0NOTYPE<unknown>DEFAULT2
      __restore_rt.symtab0x8052b980NOTYPE<unknown>DEFAULT2
      __rtld_fini.symtab0x80615f84OBJECT<unknown>HIDDEN11
      __searchdomain.symtab0x8061b3816OBJECT<unknown>HIDDEN11
      __searchdomains.symtab0x8061b584OBJECT<unknown>HIDDEN11
      __sigaddset.symtab0x8050f3832FUNC<unknown>DEFAULT2
      __sigdelset.symtab0x8050f5832FUNC<unknown>DEFAULT2
      __sigismember.symtab0x8050f1436FUNC<unknown>DEFAULT2
      __socketcall.symtab0x8052cb850FUNC<unknown>HIDDEN2
      __socketcall.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __stdin.symtab0x805b1204OBJECT<unknown>DEFAULT10
      __stdio_READ.symtab0x8055de879FUNC<unknown>HIDDEN2
      __stdio_WRITE.symtab0x805307c128FUNC<unknown>HIDDEN2
      __stdio_adjust_position.symtab0x8054868164FUNC<unknown>HIDDEN2
      __stdio_fwrite.symtab0x80530fc234FUNC<unknown>HIDDEN2
      __stdio_init_mutex.symtab0x804f7ab23FUNC<unknown>HIDDEN2
      __stdio_mutex_initializer.4160.symtab0x805930024OBJECT<unknown>DEFAULT4
      __stdio_rfill.symtab0x8055e3840FUNC<unknown>HIDDEN2
      __stdio_seek.symtab0x8054b5051FUNC<unknown>HIDDEN2
      __stdio_trans2r_o.symtab0x8055e60110FUNC<unknown>HIDDEN2
      __stdio_trans2w_o.symtab0x80531e8167FUNC<unknown>HIDDEN2
      __stdio_wcommit.symtab0x804f84c43FUNC<unknown>HIDDEN2
      __stdout.symtab0x805b1244OBJECT<unknown>DEFAULT10
      __syscall_error.symtab0x8052c8421FUNC<unknown>HIDDEN2
      __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_rt_sigaction.symtab0x8052cec59FUNC<unknown>HIDDEN2
      __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __uClibc_fini.symtab0x805292463FUNC<unknown>DEFAULT2
      __uClibc_init.symtab0x805299b64FUNC<unknown>DEFAULT2
      __uClibc_main.symtab0x80529db443FUNC<unknown>DEFAULT2
      __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __uclibc_progname.symtab0x805b3584OBJECT<unknown>HIDDEN10
      __vfork.symtab0x804f12421FUNC<unknown>HIDDEN2
      __xpg_strerror_r.symtab0x8050700182FUNC<unknown>DEFAULT2
      __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _charpad.symtab0x804f87854FUNC<unknown>DEFAULT2
      _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _dl_aux_init.symtab0x80545b818FUNC<unknown>DEFAULT2
      _dl_phdr.symtab0x8061b5c4OBJECT<unknown>DEFAULT11
      _dl_phnum.symtab0x8061b604OBJECT<unknown>DEFAULT11
      _edata.symtab0x805b3800NOTYPE<unknown>DEFAULTSHN_ABS
      _end.symtab0x8061b640NOTYPE<unknown>DEFAULTSHN_ABS
      _errno.symtab0x80616004OBJECT<unknown>DEFAULT11
      _exit.symtab0x804f1d440FUNC<unknown>DEFAULT2
      _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _fini.symtab0x8055f043FUNC<unknown>DEFAULT3
      _fixed_buffers.symtab0x805f3e08192OBJECT<unknown>DEFAULT11
      _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _fp_out_narrow.symtab0x804f8ae106FUNC<unknown>DEFAULT2
      _fpmaxtostr.symtab0x80533f81449FUNC<unknown>HIDDEN2
      _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _h_errno.symtab0x80616044OBJECT<unknown>DEFAULT11
      _init.symtab0x80480943FUNC<unknown>DEFAULT1
      _load_inttype.symtab0x805329086FUNC<unknown>HIDDEN2
      _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_init.symtab0x804fed0111FUNC<unknown>HIDDEN2
      _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_parsespec.symtab0x80500c1975FUNC<unknown>HIDDEN2
      _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_prepargs.symtab0x804ff4066FUNC<unknown>HIDDEN2
      _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _ppfs_setargs.symtab0x804ff84273FUNC<unknown>HIDDEN2
      _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _promoted_size.symtab0x805009841FUNC<unknown>DEFAULT2
      _pthread_cleanup_pop_restore.symtab0x80529661FUNC<unknown>DEFAULT2
      _pthread_cleanup_push_defer.symtab0x80529661FUNC<unknown>DEFAULT2
      _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _sigintr.symtab0x8061740128OBJECT<unknown>HIDDEN11
      _start.symtab0x804816834FUNC<unknown>DEFAULT2
      _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _stdio_fopen.symtab0x805490c579FUNC<unknown>HIDDEN2
      _stdio_init.symtab0x804f74899FUNC<unknown>HIDDEN2
      _stdio_openlist.symtab0x805b1284OBJECT<unknown>DEFAULT10
      _stdio_openlist_add_lock.symtab0x805b12c24OBJECT<unknown>DEFAULT10
      _stdio_openlist_dec_use.symtab0x8054be8228FUNC<unknown>DEFAULT2
      _stdio_openlist_del_count.symtab0x805f3d84OBJECT<unknown>DEFAULT11
      _stdio_openlist_del_lock.symtab0x805b14424OBJECT<unknown>DEFAULT10
      _stdio_openlist_use_count.symtab0x805f3d44OBJECT<unknown>DEFAULT11
      _stdio_streams.symtab0x805b160240OBJECT<unknown>DEFAULT10
      _stdio_term.symtab0x804f7c2136FUNC<unknown>HIDDEN2
      _stdio_user_locking.symtab0x805b15c4OBJECT<unknown>DEFAULT10
      _stdlib_strto_l.symtab0x8052428289FUNC<unknown>HIDDEN2
      _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _store_inttype.symtab0x80532e861FUNC<unknown>HIDDEN2
      _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _string_syserrmsgs.symtab0x80593e02906OBJECT<unknown>HIDDEN4
      _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _uintmaxtostr.symtab0x8053328207FUNC<unknown>HIDDEN2
      _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _vfprintf_internal.symtab0x804f9181464FUNC<unknown>HIDDEN2
      _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      abort.symtab0x8051f60273FUNC<unknown>DEFAULT2
      abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      access.symtab0x804f1fc50FUNC<unknown>DEFAULT2
      access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      acnc.symtab0x804af58166FUNC<unknown>DEFAULT2
      add_entry.symtab0x804e82d85FUNC<unknown>DEFAULT2
      atoi.symtab0x80523f820FUNC<unknown>DEFAULT2
      atol.symtab0x80523f820FUNC<unknown>DEFAULT2
      atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      axis_bp.symtab0x805b0504OBJECT<unknown>DEFAULT10
      bcopy.symtab0x80507b821FUNC<unknown>DEFAULT2
      bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      been_there_done_that.symtab0x80615e01OBJECT<unknown>DEFAULT11
      been_there_done_that.3001.symtab0x80615fc1OBJECT<unknown>DEFAULT11
      brk.symtab0x80545cc54FUNC<unknown>DEFAULT2
      brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      bsd_signal.symtab0x8050e64175FUNC<unknown>DEFAULT2
      buf.5162.symtab0x8061400460OBJECT<unknown>DEFAULT11
      c.symtab0x805b0f84OBJECT<unknown>DEFAULT10
      calloc.symtab0x8051740244FUNC<unknown>DEFAULT2
      calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      checksum_generic.symtab0x804818c91FUNC<unknown>DEFAULT2
      checksum_tcp_udp.symtab0x80481e7207FUNC<unknown>DEFAULT2
      checksum_tcpudp.symtab0x80482b6207FUNC<unknown>DEFAULT2
      clock.symtab0x804f65436FUNC<unknown>DEFAULT2
      clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      clock_getres.symtab0x8052d2850FUNC<unknown>DEFAULT2
      clock_getres.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      close.symtab0x804f23046FUNC<unknown>DEFAULT2
      close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      completed.2429.symtab0x805b3801OBJECT<unknown>DEFAULT11
      connect.symtab0x8050c3043FUNC<unknown>DEFAULT2
      connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      connectTimeout.symtab0x804954a523FUNC<unknown>DEFAULT2
      creat.symtab0x804f44f25FUNC<unknown>DEFAULT2
      crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      csum.symtab0x8049886159FUNC<unknown>DEFAULT2
      data_start.symtab0x805b0280NOTYPE<unknown>DEFAULT10
      decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      dup2.symtab0x804f26050FUNC<unknown>DEFAULT2
      dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      environ.symtab0x80615ec4OBJECT<unknown>DEFAULT11
      errno.symtab0x80616004OBJECT<unknown>DEFAULT11
      errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      execl.symtab0x80525b4105FUNC<unknown>DEFAULT2
      execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      execve.symtab0x8052d5c54FUNC<unknown>DEFAULT2
      execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      exit.symtab0x805254c103FUNC<unknown>DEFAULT2
      exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      exp10_table.symtab0x805a200156OBJECT<unknown>DEFAULT4
      fclose.symtab0x805463c271FUNC<unknown>DEFAULT2
      fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fcntl.symtab0x804f13c87FUNC<unknown>DEFAULT2
      fcntl64.symtab0x804f19463FUNC<unknown>DEFAULT2
      fdgets.symtab0x80490df111FUNC<unknown>DEFAULT2
      fdopen_pids.symtab0x805f3c04OBJECT<unknown>DEFAULT11
      fdpclose.symtab0x8048f6a373FUNC<unknown>DEFAULT2
      fdpopen.symtab0x8048d84486FUNC<unknown>DEFAULT2
      fflush_unlocked.symtab0x8054ccc333FUNC<unknown>DEFAULT2
      fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgetc_unlocked.symtab0x8055b24220FUNC<unknown>DEFAULT2
      fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgets.symtab0x8054b8498FUNC<unknown>DEFAULT2
      fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgets_unlocked.symtab0x8054e1c105FUNC<unknown>DEFAULT2
      fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      findRandIP.symtab0x804985a44FUNC<unknown>DEFAULT2
      fmt.symtab0x805a1dc20OBJECT<unknown>DEFAULT4
      fopen.symtab0x805474c24FUNC<unknown>DEFAULT2
      fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fork.symtab0x804f29438FUNC<unknown>DEFAULT2
      fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fputs_unlocked.symtab0x805049049FUNC<unknown>DEFAULT2
      fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      frame_dummy.symtab0x80481100FUNC<unknown>DEFAULT2
      free.symtab0x8051da1412FUNC<unknown>DEFAULT2
      free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fseek.symtab0x805476427FUNC<unknown>DEFAULT2
      fseeko.symtab0x805476427FUNC<unknown>DEFAULT2
      fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fseeko64.symtab0x8054780231FUNC<unknown>DEFAULT2
      fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fwrite_unlocked.symtab0x80504c4120FUNC<unknown>DEFAULT2
      fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getBuild.symtab0x804d5a85FUNC<unknown>DEFAULT2
      getHost.symtab0x80492b955FUNC<unknown>DEFAULT2
      getOurIP.symtab0x804d385547FUNC<unknown>DEFAULT2
      get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getc_unlocked.symtab0x8055b24220FUNC<unknown>DEFAULT2
      getdtablesize.symtab0x804f2bc37FUNC<unknown>DEFAULT2
      getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getegid.symtab0x8052d9438FUNC<unknown>DEFAULT2
      getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      geteuid.symtab0x804f2e438FUNC<unknown>DEFAULT2
      geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getgid.symtab0x8052dbc38FUNC<unknown>DEFAULT2
      getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      gethostbyname.symtab0x80508cc48FUNC<unknown>DEFAULT2
      gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      gethostbyname_r.symtab0x80508fc818FUNC<unknown>DEFAULT2
      gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getpagesize.symtab0x8052de417FUNC<unknown>DEFAULT2
      getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getpid.symtab0x804f30c38FUNC<unknown>DEFAULT2
      getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getppid.symtab0x804f33438FUNC<unknown>DEFAULT2
      getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getrlimit.symtab0x804f35c50FUNC<unknown>DEFAULT2
      getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getsockname.symtab0x8050c5c43FUNC<unknown>DEFAULT2
      getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getsockopt.symtab0x8050c8859FUNC<unknown>DEFAULT2
      getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getuid.symtab0x8052df838FUNC<unknown>DEFAULT2
      getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      h.5161.symtab0x80615cc20OBJECT<unknown>DEFAULT11
      h_errno.symtab0x80616044OBJECT<unknown>DEFAULT11
      hacks.symtab0x805b0404OBJECT<unknown>DEFAULT10
      hacks2.symtab0x805b0444OBJECT<unknown>DEFAULT10
      hacks3.symtab0x805b0484OBJECT<unknown>DEFAULT10
      hacks4.symtab0x805b04c4OBJECT<unknown>DEFAULT10
      hextable.symtab0x8056c201024OBJECT<unknown>DEFAULT4
      htonl.symtab0x80508897FUNC<unknown>DEFAULT2
      htons.symtab0x805087c13FUNC<unknown>DEFAULT2
      httphex.symtab0x804b0fc1244FUNC<unknown>DEFAULT2
      i.4536.symtab0x805b0fc4OBJECT<unknown>DEFAULT10
      index.symtab0x805057c30FUNC<unknown>DEFAULT2
      inet_addr.symtab0x80508a437FUNC<unknown>DEFAULT2
      inet_aton.symtab0x8053b48148FUNC<unknown>DEFAULT2
      inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      inet_ntop.symtab0x8055309465FUNC<unknown>DEFAULT2
      inet_ntop4.symtab0x80551f8273FUNC<unknown>DEFAULT2
      inet_pton.symtab0x805502e458FUNC<unknown>DEFAULT2
      inet_pton4.symtab0x8054fa8134FUNC<unknown>DEFAULT2
      initConnection.symtab0x804d1f2403FUNC<unknown>DEFAULT2
      init_rand.symtab0x80484b1111FUNC<unknown>DEFAULT2
      initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      initstate.symtab0x805212187FUNC<unknown>DEFAULT2
      initstate_r.symtab0x805234d171FUNC<unknown>DEFAULT2
      ioctl.symtab0x804f39063FUNC<unknown>DEFAULT2
      ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      isatty.symtab0x80507ec29FUNC<unknown>DEFAULT2
      isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      kill.symtab0x804f3d050FUNC<unknown>DEFAULT2
      kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      killer_status.symtab0x805b3b04OBJECT<unknown>DEFAULT11
      lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/mmap.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc/sysdeps/linux/i386/vfork.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      listFork.symtab0x8049755261FUNC<unknown>DEFAULT2
      llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      lseek64.symtab0x8055aac86FUNC<unknown>DEFAULT2
      macAddress.symtab0x805b3b46OBJECT<unknown>DEFAULT11
      main.symtab0x804d5ad1795FUNC<unknown>DEFAULT2
      main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      makeIPPacket.symtab0x80499dd132FUNC<unknown>DEFAULT2
      makeRandomStr.symtab0x804931f106FUNC<unknown>DEFAULT2
      makevsepacket.symtab0x804a9c4151FUNC<unknown>DEFAULT2
      malloc.symtab0x8050f9e1954FUNC<unknown>DEFAULT2
      malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      malloc_trim.symtab0x8051f3d34FUNC<unknown>DEFAULT2
      memchr.symtab0x80539a435FUNC<unknown>DEFAULT2
      memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memcpy.symtab0x805053c39FUNC<unknown>DEFAULT2
      memcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memmove.symtab0x80539c839FUNC<unknown>DEFAULT2
      memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mempcpy.symtab0x80539f033FUNC<unknown>DEFAULT2
      mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memrchr.symtab0x8053a14176FUNC<unknown>DEFAULT2
      memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memset.symtab0x805056421FUNC<unknown>DEFAULT2
      memset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mmap.symtab0x8052c9c27FUNC<unknown>DEFAULT2
      mremap.symtab0x8052e2063FUNC<unknown>DEFAULT2
      mremap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      munmap.symtab0x8052e6050FUNC<unknown>DEFAULT2
      munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mylock.symtab0x805b26824OBJECT<unknown>DEFAULT10
      mylock.symtab0x805b28024OBJECT<unknown>DEFAULT10
      mylock.symtab0x806160824OBJECT<unknown>DEFAULT11
      nanosleep.symtab0x8052e9450FUNC<unknown>DEFAULT2
      nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      next_start.1278.symtab0x80613e04OBJECT<unknown>DEFAULT11
      ngPid.symtab0x80616304OBJECT<unknown>DEFAULT11
      ntohl.symtab0x805089d7FUNC<unknown>DEFAULT2
      ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      ntohs.symtab0x805089013FUNC<unknown>DEFAULT2
      ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      numpids.symtab0x805b3a88OBJECT<unknown>DEFAULT11
      object.2482.symtab0x805b38424OBJECT<unknown>DEFAULT11
      open.symtab0x804f40475FUNC<unknown>DEFAULT2
      open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      ourIP.symtab0x806162c4OBJECT<unknown>DEFAULT11
      p.2427.symtab0x805b0240OBJECT<unknown>DEFAULT10
      parseHex.symtab0x804914e68FUNC<unknown>DEFAULT2
      pids.symtab0x80616384OBJECT<unknown>DEFAULT11
      pipe.symtab0x804f46846FUNC<unknown>DEFAULT2
      pipe.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      poll.symtab0x805460454FUNC<unknown>DEFAULT2
      poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      prctl.symtab0x804f49863FUNC<unknown>DEFAULT2
      prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      prefix.4371.symtab0x805932512OBJECT<unknown>DEFAULT4
      print.symtab0x804899f722FUNC<unknown>DEFAULT2
      printchar.symtab0x804874466FUNC<unknown>DEFAULT2
      printi.symtab0x8048860319FUNC<unknown>DEFAULT2
      prints.symtab0x8048786218FUNC<unknown>DEFAULT2
      processCmd.symtab0x804b5d87194FUNC<unknown>DEFAULT2
      qual_chars.4377.symtab0x805933820OBJECT<unknown>DEFAULT4
      raise.symtab0x80545a024FUNC<unknown>DEFAULT2
      raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand.symtab0x80520745FUNC<unknown>DEFAULT2
      rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand__str.symtab0x804dd65110FUNC<unknown>DEFAULT2
      rand_alpha_str.symtab0x804ddd3114FUNC<unknown>DEFAULT2
      rand_alphastr.symtab0x804869f165FUNC<unknown>DEFAULT2
      rand_cmwc.symtab0x80485df192FUNC<unknown>DEFAULT2
      rand_init.symtab0x804dcb077FUNC<unknown>DEFAULT2
      rand_next.symtab0x804dcfd104FUNC<unknown>DEFAULT2
      random.symtab0x805207c72FUNC<unknown>DEFAULT2
      random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      random_poly_info.symtab0x8059f4040OBJECT<unknown>DEFAULT4
      random_r.symtab0x805225594FUNC<unknown>DEFAULT2
      random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      randtbl.symtab0x805b2c0128OBJECT<unknown>DEFAULT10
      rawmemchr.symtab0x8054ed899FUNC<unknown>DEFAULT2
      rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      read.symtab0x804f4d854FUNC<unknown>DEFAULT2
      read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      realloc.symtab0x8051834822FUNC<unknown>DEFAULT2
      realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      recv.symtab0x8050cc451FUNC<unknown>DEFAULT2
      recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      recvLine.symtab0x8049389449FUNC<unknown>DEFAULT2
      recvfrom.symtab0x8050cf867FUNC<unknown>DEFAULT2
      recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      resolv_domain_to_hostname.symtab0x804de48125FUNC<unknown>DEFAULT2
      resolv_entries_free.symtab0x804e4ed49FUNC<unknown>DEFAULT2
      resolv_lookup.symtab0x804df501437FUNC<unknown>DEFAULT2
      resolv_skip_name.symtab0x804dec5139FUNC<unknown>DEFAULT2
      rtcp.symtab0x804a49c904FUNC<unknown>DEFAULT2
      sbrk.symtab0x8052ec878FUNC<unknown>DEFAULT2
      sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      scanPid.symtab0x80616344OBJECT<unknown>DEFAULT11
      select.symtab0x804f51063FUNC<unknown>DEFAULT2
      select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      send.symtab0x8050d3c51FUNC<unknown>DEFAULT2
      send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sendSTD.symtab0x804a824416FUNC<unknown>DEFAULT2
      sendto.symtab0x8050d7067FUNC<unknown>DEFAULT2
      sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setsockopt.symtab0x8050db459FUNC<unknown>DEFAULT2
      setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setstate.symtab0x80520c493FUNC<unknown>DEFAULT2
      setstate_r.symtab0x80521bc153FUNC<unknown>DEFAULT2
      sigaction.symtab0x8052ba7218FUNC<unknown>DEFAULT2
      sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigaddset.symtab0x8050e1c42FUNC<unknown>DEFAULT2
      sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigemptyset.symtab0x8050e4825FUNC<unknown>DEFAULT2
      signal.symtab0x8050e64175FUNC<unknown>DEFAULT2
      signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigprocmask.symtab0x804f55085FUNC<unknown>DEFAULT2
      sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sleep.symtab0x8052620393FUNC<unknown>DEFAULT2
      sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      socket.symtab0x8050df043FUNC<unknown>DEFAULT2
      socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      socket_connect.symtab0x804affe254FUNC<unknown>DEFAULT2
      sockprintf.symtab0x8048cc0196FUNC<unknown>DEFAULT2
      spec_and_mask.4376.symtab0x805934c16OBJECT<unknown>DEFAULT4
      spec_base.4370.symtab0x80593317OBJECT<unknown>DEFAULT4
      spec_chars.4373.symtab0x805937521OBJECT<unknown>DEFAULT4
      spec_flags.4372.symtab0x805938a8OBJECT<unknown>DEFAULT4
      spec_or_mask.4375.symtab0x805935c16OBJECT<unknown>DEFAULT4
      spec_ranges.4374.symtab0x805936c9OBJECT<unknown>DEFAULT4
      sprintf.symtab0x804f67831FUNC<unknown>DEFAULT2
      sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      srand.symtab0x805217867FUNC<unknown>DEFAULT2
      srandom.symtab0x805217867FUNC<unknown>DEFAULT2
      srandom_r.symtab0x80522b3154FUNC<unknown>DEFAULT2
      static_id.symtab0x805b35c2OBJECT<unknown>DEFAULT10
      static_ns.symtab0x80616204OBJECT<unknown>DEFAULT11
      stderr.symtab0x805b11c4OBJECT<unknown>DEFAULT10
      stdin.symtab0x805b1144OBJECT<unknown>DEFAULT10
      stdout.symtab0x805b1184OBJECT<unknown>DEFAULT10
      strcasecmp.symtab0x8055c0054FUNC<unknown>DEFAULT2
      strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strchr.symtab0x805057c30FUNC<unknown>DEFAULT2
      strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strcmp.symtab0x8054e8829FUNC<unknown>DEFAULT2
      strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strcoll.symtab0x8054e8829FUNC<unknown>DEFAULT2
      strcpy.symtab0x805059c27FUNC<unknown>DEFAULT2
      strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strdup.symtab0x8054f7054FUNC<unknown>DEFAULT2
      strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strerror_r.symtab0x8050700182FUNC<unknown>DEFAULT2
      strlen.symtab0x80505b819FUNC<unknown>DEFAULT2
      strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strncat.symtab0x8054ea846FUNC<unknown>DEFAULT2
      strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strncpy.symtab0x80505cc38FUNC<unknown>DEFAULT2
      strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strnlen.symtab0x80505f425FUNC<unknown>DEFAULT2
      strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strpbrk.symtab0x8053b2039FUNC<unknown>DEFAULT2
      strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strspn.symtab0x8054f3c50FUNC<unknown>DEFAULT2
      strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strstr.symtab0x8050610206FUNC<unknown>DEFAULT2
      strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strtok.symtab0x80507d025FUNC<unknown>DEFAULT2
      strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strtok_r.symtab0x8053ac489FUNC<unknown>DEFAULT2
      strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strtol.symtab0x805240c26FUNC<unknown>DEFAULT2
      strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sysconf.symtab0x80527ac325FUNC<unknown>DEFAULT2
      sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      szprintf.symtab0x8048c9939FUNC<unknown>DEFAULT2
      table.symtab0x8061640232OBJECT<unknown>DEFAULT11
      table.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      table_init.symtab0x804e520652FUNC<unknown>DEFAULT2
      table_key.symtab0x805b1004OBJECT<unknown>DEFAULT10
      table_lock_val.symtab0x804e7d541FUNC<unknown>DEFAULT2
      table_retrieve_val.symtab0x804e7fe47FUNC<unknown>DEFAULT2
      table_unlock_val.symtab0x804e7ac41FUNC<unknown>DEFAULT2
      tcgetattr.symtab0x805080c112FUNC<unknown>DEFAULT2
      tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      tcpFl00d.symtab0x8049f1d1407FUNC<unknown>DEFAULT2
      tcpcsum.symtab0x8049925184FUNC<unknown>DEFAULT2
      time.symtab0x804f5a846FUNC<unknown>DEFAULT2
      time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      times.symtab0x8052f1846FUNC<unknown>DEFAULT2
      times.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      toggle_obf.symtab0x804e882240FUNC<unknown>DEFAULT2
      tolower.symtab0x8055b0429FUNC<unknown>DEFAULT2
      tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      toupper.symtab0x804f62c29FUNC<unknown>DEFAULT2
      toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      trim.symtab0x8048520191FUNC<unknown>DEFAULT2
      type_codes.symtab0x805939224OBJECT<unknown>DEFAULT4
      type_sizes.symtab0x80593aa12OBJECT<unknown>DEFAULT4
      udpfl00d.symtab0x8049a611212FUNC<unknown>DEFAULT2
      unknown.1330.symtab0x80593b614OBJECT<unknown>DEFAULT4
      unsafe_state.symtab0x805b29828OBJECT<unknown>DEFAULT10
      uppercase.symtab0x80492f047FUNC<unknown>DEFAULT2
      userID.symtab0x805b0f44OBJECT<unknown>DEFAULT10
      usleep.symtab0x80528f448FUNC<unknown>DEFAULT2
      usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      util.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      util_atoi.symtab0x804eb31412FUNC<unknown>DEFAULT2
      util_fdgets.symtab0x804efd1133FUNC<unknown>DEFAULT2
      util_isalpha.symtab0x804f08357FUNC<unknown>DEFAULT2
      util_isdigit.symtab0x804f0f545FUNC<unknown>DEFAULT2
      util_isspace.symtab0x804f0bc57FUNC<unknown>DEFAULT2
      util_isupper.symtab0x804f05645FUNC<unknown>DEFAULT2
      util_itoa.symtab0x804eccd253FUNC<unknown>DEFAULT2
      util_local_addr.symtab0x804ef11192FUNC<unknown>DEFAULT2
      util_memcpy.symtab0x804eadf48FUNC<unknown>DEFAULT2
      util_memsearch.symtab0x804edca118FUNC<unknown>DEFAULT2
      util_strcat.symtab0x804eab047FUNC<unknown>DEFAULT2
      util_strcmp.symtab0x804ea11108FUNC<unknown>DEFAULT2
      util_strcpy.symtab0x804ea7d51FUNC<unknown>DEFAULT2
      util_stristr.symtab0x804ee40209FUNC<unknown>DEFAULT2
      util_strlen.symtab0x804e97441FUNC<unknown>DEFAULT2
      util_strncmp.symtab0x804e99d116FUNC<unknown>DEFAULT2
      util_zero.symtab0x804eb0f34FUNC<unknown>DEFAULT2
      vfork.symtab0x804f12421FUNC<unknown>DEFAULT2
      vseattack.symtab0x804aa5b1277FUNC<unknown>DEFAULT2
      vsnprintf.symtab0x804f698176FUNC<unknown>DEFAULT2
      vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      w.symtab0x805f3d04OBJECT<unknown>DEFAULT11
      wait4.symtab0x8052f4859FUNC<unknown>DEFAULT2
      wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      waitpid.symtab0x804f5d826FUNC<unknown>DEFAULT2
      waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      watchdog_maintain.symtab0x8048388297FUNC<unknown>DEFAULT2
      watchdog_pid.symtab0x805b3a44OBJECT<unknown>DEFAULT11
      wcrtomb.symtab0x8052f8c69FUNC<unknown>DEFAULT2
      wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      wcsnrtombs.symtab0x8052ff4133FUNC<unknown>DEFAULT2
      wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      wcsrtombs.symtab0x8052fd430FUNC<unknown>DEFAULT2
      wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      wildString.symtab0x8049192295FUNC<unknown>DEFAULT2
      write.symtab0x804f5f454FUNC<unknown>DEFAULT2
      write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      x.symtab0x805f3c44OBJECT<unknown>DEFAULT11
      xdigits.3285.symtab0x805a2f417OBJECT<unknown>DEFAULT4
      y.symtab0x805f3c84OBJECT<unknown>DEFAULT11
      z.symtab0x805f3cc4OBJECT<unknown>DEFAULT11
      zprintf.symtab0x8048c7140FUNC<unknown>DEFAULT2
      No network behavior found

      System Behavior

      Start time:21:35:45
      Start date:08/08/2022
      Path:/tmp/YQ8ULbBFnH
      Arguments:/tmp/YQ8ULbBFnH
      File size:104138 bytes
      MD5 hash:ff22e45af9df28695df9805fceb128ee

      Start time:21:35:45
      Start date:08/08/2022
      Path:/tmp/YQ8ULbBFnH
      Arguments:n/a
      File size:104138 bytes
      MD5 hash:ff22e45af9df28695df9805fceb128ee

      Start time:21:35:45
      Start date:08/08/2022
      Path:/tmp/YQ8ULbBFnH
      Arguments:n/a
      File size:104138 bytes
      MD5 hash:ff22e45af9df28695df9805fceb128ee

      Start time:21:35:45
      Start date:08/08/2022
      Path:/tmp/YQ8ULbBFnH
      Arguments:n/a
      File size:104138 bytes
      MD5 hash:ff22e45af9df28695df9805fceb128ee

      Start time:21:37:58
      Start date:08/08/2022
      Path:/tmp/YQ8ULbBFnH
      Arguments:n/a
      File size:104138 bytes
      MD5 hash:ff22e45af9df28695df9805fceb128ee