Edit tour

Linux Analysis Report
W9BzYpUe5X

Overview

General Information

Sample Name:	W9BzYpUe5X
Analysis ID:	680601
MD5:	3104c4d8cc3582f1bf62e9dd0693cd54
SHA1:	335c7a4bc0d3d4215578d48ac0acbe7040add542
SHA256:	a91de25239447ad1c50a66b6fb137acf70fb09b6d253da17e9c3c8b0eab42eaf
Tags:	32elfgafgytsparc
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Yara signature match

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680601
Start date and time: 08/08/202221:39:29	2022-08-08 21:39:29 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	W9BzYpUe5X
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal80.spre.troj.lin@0/1@0/0

Runtime Messages

Command:	/tmp/W9BzYpUe5X
PID:	6228
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

W9BzYpUe5X (PID: 6228, Parent: 6127, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/W9BzYpUe5X

W9BzYpUe5X New Fork (PID: 6230, Parent: 6228)

W9BzYpUe5X New Fork (PID: 6231, Parent: 6228)

W9BzYpUe5X New Fork (PID: 6234, Parent: 6231)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
W9BzYpUe5X	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
W9BzYpUe5X	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x157d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x157ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1583c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1592c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6231.1.00007fdff8011000.00007fdff802a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6231.1.00007fdff8011000.00007fdff802a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x157d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x157ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1583c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1592c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6230.1.00007fdff8011000.00007fdff802a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6230.1.00007fdff8011000.00007fdff802a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x157d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x157ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1583c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1592c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6228.1.00007fdff8011000.00007fdff802a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6228.1.00007fdff8011000.00007fdff802a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x157d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x157ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1583c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1592c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: W9BzYpUe5X PID: 6228	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x384c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x389c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x393c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x398c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: W9BzYpUe5X PID: 6230	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x84aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x850e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8522:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8536:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x854a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x855e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8572:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8586:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x859a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8612:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8626:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x863a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: W9BzYpUe5X PID: 6231	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x55c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x562c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5668:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x567c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5690:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x571c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 4 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: W9BzYpUe5X

Avira: detected

Multi AV Scanner detection for submitted file

Source: W9BzYpUe5X

Virustotal: Detection: 62%

Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/W9BzYpUe5X (PID: 6228)

Opens: /proc/net/route

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:35072 -> 109.206.241.200:29448

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200

System Summary

Malicious sample detected (through community Yara rule)

Source: W9BzYpUe5X, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6231.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: W9BzYpUe5X PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: W9BzYpUe5X PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: W9BzYpUe5X PID: 6231, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: W9BzYpUe5X, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6231.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6228.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: W9BzYpUe5X PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: W9BzYpUe5X PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: W9BzYpUe5X PID: 6231, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.spre.troj.lin@0/1@0/0

Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/string/sparc/memchr.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/string/sparc/memcpy.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/string/sparc/memset.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/string/sparc/strchr.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/string/sparc/strcmp.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/string/sparc/strcpy.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/string/sparc/strlen.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crt1.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crti.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crtn.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/fork.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/rem.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/udiv.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/umul.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/urem.S
Source: W9BzYpUe5X	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/vfork.S

Source: /tmp/W9BzYpUe5X (PID: 6228)

Queries kernel information via 'uname':

Source: W9BzYpUe5X, 6228.1.000055a13d1bd000.000055a13d244000.rw-.sdmp, W9BzYpUe5X, 6230.1.000055a13d1bd000.000055a13d244000.rw-.sdmp, W9BzYpUe5X, 6231.1.000055a13d1bd000.000055a13d244000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: W9BzYpUe5X, 6228.1.000055a13d1bd000.000055a13d244000.rw-.sdmp, W9BzYpUe5X, 6230.1.000055a13d1bd000.000055a13d244000.rw-.sdmp, W9BzYpUe5X, 6231.1.000055a13d1bd000.000055a13d244000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: W9BzYpUe5X, 6228.1.00007ffca884a000.00007ffca886b000.rw-.sdmp, W9BzYpUe5X, 6230.1.00007ffca884a000.00007ffca886b000.rw-.sdmp, W9BzYpUe5X, 6231.1.00007ffca884a000.00007ffca886b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/W9BzYpUe5XSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/W9BzYpUe5X
Source: W9BzYpUe5X, 6228.1.00007ffca884a000.00007ffca886b000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.Tylk59\
Source: W9BzYpUe5X, 6228.1.00007ffca884a000.00007ffca886b000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.Tylk59
Source: W9BzYpUe5X, 6228.1.00007ffca884a000.00007ffca886b000.rw-.sdmp, W9BzYpUe5X, 6230.1.00007ffca884a000.00007ffca886b000.rw-.sdmp, W9BzYpUe5X, 6231.1.00007ffca884a000.00007ffca886b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: W9BzYpUe5X, type: SAMPLE
Source: Yara match	File source: 6231.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: W9BzYpUe5X, type: SAMPLE
Source: Yara match	File source: 6231.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007fdff8011000.00007fdff802a000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
W9BzYpUe5X	63%	Virustotal		Browse
W9BzYpUe5X	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.206.241.200	unknown	Germany	209929	AWMLTNL	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.Tylk59 (deleted)

Download File

Process:	/tmp/W9BzYpUe5X
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.070361683210354
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	W9BzYpUe5X
File size:	129856
MD5:	3104c4d8cc3582f1bf62e9dd0693cd54
SHA1:	335c7a4bc0d3d4215578d48ac0acbe7040add542
SHA256:	a91de25239447ad1c50a66b6fb137acf70fb09b6d253da17e9c3c8b0eab42eaf
SHA512:	b4ff84c0d3ba2885a45fc4261220bdcf77a868ee385dcd7d1dda3d9a39f503811132b44e0a6d5df1eb109a641cc2cf92fe76ff0ade995acbacf4b23a6d4a816d
SSDEEP:	3072:wsrp9xV+GZTZepNPhj+e3fSqP+L7ymm/QMurB1nKGNb:SMQplV+amm/QMurB1nKGNb
TLSH:	35C3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BD9
File Content Preview:	.ELF...........................4.........4. ...(.......................................................@..h.........dt.Q................................@..(....@.QW................#.....a ..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	107016
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100b0	0xb0	0x14594	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x24644	0x14644	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x24658	0x14658	0x4680	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x28cd8	0x18cd8	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x38cdc	0x18cdc	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x38ce4	0x18ce4	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x38cec	0x18cec	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x38cf0	0x18cf0	0x42c	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x39120	0x1911c	0x6468	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1911c	0xb2e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x19c4a	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x19c6a	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x19c89	0x16e	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x19df7	0xfb	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x19ef2	0x7c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x19f70	0x28	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x19f98	0x10b	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1a0a3	0x6e	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1a111	0x18	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1a129	0xdc	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1a5c8	0x30b0	0x10	0x0		23	287	4
.strtab	STRTAB	0x0	0x1d678	0x24c8	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x18cdc	0x18cdc	6.0822	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x18cdc	0x38cdc	0x38cdc	0x440	0x68ac	3.0891	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x24644	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x24658	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x28cd8	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x38cdc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x38ce4	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x38cec	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x38cf0	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x39120	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
.rem	.symtab	0x1a6c0	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x1a6a0	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x1a6b4	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x1a680	32	FUNC	<unknown>	DEFAULT	2
C.151.5681	.symtab	0x26af0	40	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x39140	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x38da0	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x3f3c8	4	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x39160	16384	OBJECT	<unknown>	DEFAULT	10
UserAgents	.symtab	0x38d10	144	OBJECT	<unknown>	DEFAULT	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x38ce0	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x38cdc	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x38db4	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x27568	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x39114	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x289d8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x38dbc	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x27868	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x38ce8	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x38ce4	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x28cd8	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x28cd8	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x38db4	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x27568	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x39114	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x289d8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x38dbc	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x27868	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x38db8	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x39118	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x38dc0	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x1ade8	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1e724	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x206c8	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1aac8	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x20094	132	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x2016c	104	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1e744	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1a7d8	64	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x223d8	316	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1fbb0	24	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x1fbb0	24	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x22530	60	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1a860	68	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1ec94	76	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x1a8a4	72	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x3f39c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x1fe08	152	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x20488	76	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1fd88	128	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x22608	324	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x22e1c	420	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x22ca4	100	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x22fc0	192	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x2274c	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a618	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1bfe8	60	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x22764	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x22788	272	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1c024	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1a8ec	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x204d4	64	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1a914	64	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x20514	64	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1e958	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1e994	768	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1a954	64	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1a9d4	72	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1ece0	76	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x20554	64	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x3f3a0	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x1e930	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x21800	220	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x23764	684	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x233a0	544	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1facc	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1aa1c	100	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1e878	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1aa80	72	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x240dc	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x214ec	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1c700	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1c11c	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x21604	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x21624	272	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1d7a8	416	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x20594	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1aac8	120	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x1ab58	68	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x225bc	76	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x240c4	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1f6cc	80	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1f94c	156	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x23080	204	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1abf0	76	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1ed80	32	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1eda0	88	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x205dc	84	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1ac3c	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1edf8	32	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1ee18	88	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1ee70	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1f828	292	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x22338	160	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1eee8	56	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1ef20	32	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1ef40	188	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1ac90	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1fea0	428	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1ee9c	76	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1ae2c	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1f9e8	228	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x242b8	92	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1d9bc	524	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1dd1c	648	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1dd1c	648	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1e00c	804	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x2329c	56	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1e398	120	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x2314c	224	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1e410	248	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1e508	252	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x217b0	80	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1dbc8	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x2322c	112	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1e604	288	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1e860	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x21734	124	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1fbc8	20	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1e898	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1ad1c	72	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x20630	72	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x2414c	36	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1adc4	36	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x1a64c	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1ae60	156	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x20678	80	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1ad64	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x206d4	72	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x20738	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x2071c	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1ad78	76	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x38cec	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x38cec	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x3f390	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x390c4	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x1ef40	188	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x3911c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x20128	68	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x38db8	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x39118	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x38dc0	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x3f3c4	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x38cf8	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x23c98	240	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x243b8	196	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x23b2c	208	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x218dc	1852	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x245fc	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x38cf0	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x24314	164	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x23a10	284	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x23bfc	120	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x3f388	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x1ade8	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x3f380	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x22300	56	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x1e724	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x206c8	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x1f42c	160	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x1f4cc	156	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1f5b0	268	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x1f568	48	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1f598	24	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x2447c	72	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x23c74	36	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x1a860	68	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1ec94	76	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x1ab40	24	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a618	52	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x1a954	64	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x240dc	112	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x20594	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1aac8	120	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x225bc	76	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1abf0	76	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1ed80	32	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1eda0	88	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1ac3c	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1edf8	32	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1ee18	88	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x22338	160	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x3f384	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x1ad64	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1ad78	76	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x38f00	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x3f368	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x3f544	24	OBJECT	<unknown>	DEFAULT	10
__muldi3	.symtab	0x1a544	212	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x3f56c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x3f578	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x23d88	56	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x22018	744	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x3f38c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x20120	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x240c4	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x23dc0	772	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x390e4	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x3f394	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x3f55c	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x3f57c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x1f024	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1f050	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1effc	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x20440	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x38dd0	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x244c4	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x207f4	196	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x22898	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x208b8	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1af5c	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3860	.symtab	0x27b68	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x2452c	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x22c70	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x24564	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x209f8	252	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1b028	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x38dd4	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x2256c	80	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x20094	132	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x2016c	104	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x201d4	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x214ec	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x390dc	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x1a64c	52	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1e744	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x1b060	60	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x22514	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x3f580	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x3f584	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x3911c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x3f588	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x3f39c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x1a7d8	64	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x24644	8	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x3d180	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1b09c	128	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x20cf8	1908	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x3f3a0	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x10094	8	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x20af4	144	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1b798	164	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1baa0	1352	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1b83c	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1b878	480	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1ba58	72	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x20120	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x20120	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x3f4c4	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x101a4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x22994	732	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1aefc	96	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x38dd8	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x38ddc	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x22d08	276	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x3d17c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x38df4	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x3d178	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x38e10	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x1af78	176	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x38e0c	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1fbdc	428	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x20b84	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x27cc8	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x20bc0	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1b11c	1660	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x223d8	316	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x1a818	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x148cc	236	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x19374	140	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x1fbb0	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1fbb0	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
axis_bp	.symtab	0x38d0c	4	OBJECT	<unknown>	DEFAULT	9
bcopy	.symtab	0x1c110	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x3f3c0	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2818	.symtab	0x3f398	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x22530	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1ef40	188	FUNC	<unknown>	DEFAULT	2
buf.4861	.symtab	0x3f188	460	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x1d774	52	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x38da8	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x24638	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1012c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x10198	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1f1bc	112	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x101dc	224	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x102bc	468	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x10490	468	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x1adf4	56	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1a860	68	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2248	.symtab	0x39120	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x1ec94	76	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x12400	672	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x1ab40	24	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x128b0	312	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x38cf8	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x1a8a4	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x3f388	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x3f39c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x27c38	126	OBJECT	<unknown>	DEFAULT	4
execl	.symtab	0x1fe08	152	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x20488	76	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1fd88	128	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x288d0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x22608	324	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x11c54	224	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x3d160	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x11a84	464	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x1174c	824	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x22e1c	420	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x22ca4	100	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x22fc0	192	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x12850	96	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x288b8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x2274c	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1a618	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked	.symtab	0x1bfe8	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10138	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1f22c	232	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x22764	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x22764	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x22788	272	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1c024	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x175a8	16	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x11fc4	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x17234	884	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x1a8ec	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x204d4	64	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1a914	64	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x20514	64	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1e958	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1e994	768	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1a954	64	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1a994	64	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1a9d4	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1ece0	76	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1ed2c	84	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x20554	64	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4860	.symtab	0x3f354	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x3f3a0	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x38cfc	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x38d00	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x38d04	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x38d08	4	OBJECT	<unknown>	DEFAULT	9
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x2539c	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x1e91c	8	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1e924	12	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0x14b04	1044	FUNC	<unknown>	DEFAULT	2
i.4436	.symtab	0x38dac	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x1d9bc	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1e930	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x21800	220	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x23764	684	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x235c0	420	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x233a0	544	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x232d4	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x16f80	692	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x107ec	228	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x38f08	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x1f77c	96	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1facc	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1aa1c	100	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1e878	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x1aa80	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x39150	4	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/fork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/rem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/udiv.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/umul.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/urem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x126a0	432	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x240dc	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x39158	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x175b8	2892	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x12adc	220	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x12090	128	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x14080	244	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1f07c	320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x214ec	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x1c700	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x1c11c	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x21604	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x21624	272	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1d7a8	416	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x39010	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x3f3a4	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x390fc	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x20594	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1092	.symtab	0x3f180	4	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x3f3d0	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x1e908	8	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1e910	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x39148	8	OBJECT	<unknown>	DEFAULT	10
object.2329	.symtab	0x39124	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x1aac8	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x3f3cc	4	OBJECT	<unknown>	DEFAULT	10
p.2246	.symtab	0x38cf4	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x11d34	136	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x3f3d8	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x1ab58	68	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x225bc	76	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x1ab9c	84	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4072	.symtab	0x27b90	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x11140	1144	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x10d00	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10f28	536	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10d6c	444	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x14f18	8296	FUNC	<unknown>	DEFAULT	2
qual_chars.4078	.symtab	0x27ba8	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x240c4	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1f6bc	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x18290	256	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x18390	188	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x10bbc	324	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x10a58	356	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x18104	160	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x181a4	236	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1f6cc	80	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x28840	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1f94c	156	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x39044	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x23080	204	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x1abf0	76	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1f314	280	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x1ed80	32	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x12110	752	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x1eda0	88	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_domain_to_hostname	.symtab	0x1844c	292	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x18fe4	88	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x18674	2416	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x18570	260	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x1dbc8	192	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x13998	1292	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x205dc	84	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x3f3d4	4	OBJECT	<unknown>	DEFAULT	10
select	.symtab	0x1ac3c	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1edf8	32	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x13ea4	476	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1ee18	88	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1ee70	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1f71c	96	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1f828	292	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x22338	160	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x1eee8	56	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x1ef20	32	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x1ef40	188	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x1ac90	140	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1fea0	428	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1ee9c	76	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x149b8	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x1165c	240	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4077	.symtab	0x27bbc	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4071	.symtab	0x27ba0	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4074	.symtab	0x27bf0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4073	.symtab	0x27c08	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4076	.symtab	0x27bcc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4075	.symtab	0x27be0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x1ae2c	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x1f7dc	76	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x1f7dc	76	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x1f9e8	228	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x390e0	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x3f3bc	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x38dcc	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x38dc4	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x38dc8	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x242b8	92	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x1d9bc	524	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x1dd1c	648	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1dd1c	648	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1e00c	804	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x2329c	56	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1e744	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1e398	120	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x2314c	224	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1e410	248	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1e508	252	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x217b0	80	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1dbc8	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x2322c	112	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x1e604	288	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1e860	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x21734	124	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1fbc8	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x11608	84	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x3f3dc	232	OBJECT	<unknown>	DEFAULT	10
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x1903c	568	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x38db0	4	OBJECT	<unknown>	DEFAULT	9
table_lock_val	.symtab	0x192c0	76	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x1930c	104	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x19274	76	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1e898	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x132bc	1756	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x129e8	244	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x1ad1c	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x20630	72	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x19400	384	FUNC	<unknown>	DEFAULT	2
tolower	.symtab	0x2414c	36	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x1adc4	36	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x108d0	392	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x27c10	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x27c28	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x12bb8	1796	FUNC	<unknown>	DEFAULT	2
unknown.1115	.symtab	0x27cb8	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x39028	28	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x12028	104	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x38da4	4	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x2004c	72	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x19994	832	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x1a258	252	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x1a3b8	148	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x1a4e0	100	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x1a44c	148	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x1a354	100	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x19cd4	472	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x1a170	232	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x198c4	120	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x19eac	260	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x19838	140	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x196f8	240	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x197e8	80	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x19fb0	448	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x19580	112	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x195f0	264	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x1993c	88	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x1a64c	52	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x14174	1880	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x1ae60	156	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x3d174	4	OBJECT	<unknown>	DEFAULT	10
wait4	.symtab	0x20678	80	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x1ad64	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x10664	392	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x39144	4	OBJECT	<unknown>	DEFAULT	10
wcrtomb	.symtab	0x206d4	72	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x20738	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x2071c	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x11dbc	520	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x1ad78	76	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x3d168	4	OBJECT	<unknown>	DEFAULT	10
xdigits.3071	.symtab	0x28990	17	OBJECT	<unknown>	DEFAULT	4
y	.symtab	0x3d16c	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x3d170	4	OBJECT	<unknown>	DEFAULT	10
zprintf	.symtab	0x115b8	80	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 21:40:15.963095903 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 8, 2022 21:40:16.149276972 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:40:16.176681042 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:40:16.176959038 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:40:16.177293062 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:40:16.204435110 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:40:16.735049009 CEST	42516	80	192.168.2.23	109.202.202.202
Aug 8, 2022 21:40:30.810491085 CEST	43928	443	192.168.2.23	91.189.91.42
Aug 8, 2022 21:40:43.097961903 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 8, 2022 21:40:47.193746090 CEST	42516	80	192.168.2.23	109.202.202.202
Aug 8, 2022 21:40:57.960333109 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:40:57.960664988 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:40:57.988023996 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:40:57.988353014 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:41:11.768441916 CEST	43928	443	192.168.2.23	91.189.91.42
Aug 8, 2022 21:41:57.988693953 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:41:57.989120007 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:41:58.015980005 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:41:58.016344070 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:42:58.014200926 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:42:58.014401913 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:42:58.041802883 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:42:58.041934013 CEST	35072	29448	192.168.2.23	109.206.241.200

System Behavior

Analysis Process: W9BzYpUe5X PID: 6228, Parent PID: 6127

General

Start time:	21:40:15
Start date:	08/08/2022
Path:	/tmp/W9BzYpUe5X
Arguments:	/tmp/W9BzYpUe5X
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: W9BzYpUe5X PID: 6230, Parent PID: 6228

General

Start time:	21:40:15
Start date:	08/08/2022
Path:	/tmp/W9BzYpUe5X
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: W9BzYpUe5X PID: 6231, Parent PID: 6228

General

Start time:	21:40:15
Start date:	08/08/2022
Path:	/tmp/W9BzYpUe5X
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: W9BzYpUe5X PID: 6234, Parent PID: 6231

General

Start time:	21:40:15
Start date:	08/08/2022
Path:	/tmp/W9BzYpUe5X
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report W9BzYpUe5X

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.Tylk59 (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: W9BzYpUe5X PID: 6228, Parent PID: 6127

General

Analysis Process: W9BzYpUe5X PID: 6230, Parent PID: 6228

General

Analysis Process: W9BzYpUe5X PID: 6231, Parent PID: 6228

General

Analysis Process: W9BzYpUe5X PID: 6234, Parent PID: 6231

General

Linux Analysis Report
W9BzYpUe5X