Edit tour

Linux Analysis Report
08QmkdUS4O

Overview

General Information

Sample Name:	08QmkdUS4O
Analysis ID:	680603
MD5:	4c0115c94951a66f3be2d121dd9fae29
SHA1:	831538ed8530f8329ef95394d8876c6a32e80011
SHA256:	48e1d0c82a2abfc1efb94fc2e781249601d900c4cb0a56cf6b4605891feb5514
Tags:	32armelfgafgytMirai
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Opens /proc/net/* files useful for finding connected devices and routers

Yara signature match

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680603
Start date and time: 08/08/202221:43:57	2022-08-08 21:43:57 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	08QmkdUS4O
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal76.spre.troj.lin@0/0@0/0

Runtime Messages

Command:	/tmp/08QmkdUS4O
PID:	6230
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

08QmkdUS4O (PID: 6230, Parent: 6126, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/08QmkdUS4O

08QmkdUS4O New Fork (PID: 6232, Parent: 6230)

08QmkdUS4O New Fork (PID: 6233, Parent: 6230)

08QmkdUS4O New Fork (PID: 6236, Parent: 6233)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
08QmkdUS4O	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
08QmkdUS4O	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6233.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6233.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6232.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6232.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6230.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6230.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1325c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1334c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1339c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 08QmkdUS4O PID: 6230	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10f2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ff2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11006:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1101a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1102e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11042:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11056:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1107e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11092:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 08QmkdUS4O PID: 6232	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13dc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ddd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13df1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ea5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13eb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ecd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ee1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ef5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 08QmkdUS4O PID: 6233	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2308:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2330:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2344:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2358:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x236c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x245c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 4 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 08QmkdUS4O

Avira: detected

Multi AV Scanner detection for submitted file

Source: 08QmkdUS4O	Virustotal: Detection: 62%			Perma Link
Source: 08QmkdUS4O	ReversingLabs: Detection: 61%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/08QmkdUS4O (PID: 6230)

Opens: /proc/net/route

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:35072 -> 109.206.241.200:29448

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.200

System Summary

Malicious sample detected (through community Yara rule)

Source: 08QmkdUS4O, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6233.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6232.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 08QmkdUS4O PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 08QmkdUS4O PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 08QmkdUS4O PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: 08QmkdUS4O, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6233.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6232.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 08QmkdUS4O PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 08QmkdUS4O PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 08QmkdUS4O PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.spre.troj.lin@0/0@0/0

Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: 08QmkdUS4O	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/08QmkdUS4O (PID: 6230)

Queries kernel information via 'uname':

Jump to behavior

Source: 08QmkdUS4O, 6230.1.000055bbe20ab000.000055bbe21fa000.rw-.sdmp, 08QmkdUS4O, 6232.1.000055bbe20ab000.000055bbe21fa000.rw-.sdmp, 08QmkdUS4O, 6233.1.000055bbe20ab000.000055bbe21fa000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: 08QmkdUS4O, 6230.1.00007fffb3e79000.00007fffb3e9a000.rw-.sdmp, 08QmkdUS4O, 6232.1.00007fffb3e79000.00007fffb3e9a000.rw-.sdmp, 08QmkdUS4O, 6233.1.00007fffb3e79000.00007fffb3e9a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/08QmkdUS4OSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/08QmkdUS4O
Source: 08QmkdUS4O, 6230.1.000055bbe20ab000.000055bbe21fa000.rw-.sdmp, 08QmkdUS4O, 6232.1.000055bbe20ab000.000055bbe21fa000.rw-.sdmp, 08QmkdUS4O, 6233.1.000055bbe20ab000.000055bbe21fa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 08QmkdUS4O, 6230.1.00007fffb3e79000.00007fffb3e9a000.rw-.sdmp, 08QmkdUS4O, 6232.1.00007fffb3e79000.00007fffb3e9a000.rw-.sdmp, 08QmkdUS4O, 6233.1.00007fffb3e79000.00007fffb3e9a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 08QmkdUS4O, type: SAMPLE
Source: Yara match	File source: 6233.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 08QmkdUS4O, type: SAMPLE
Source: Yara match	File source: 6233.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007f1cb8017000.00007f1cb802e000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
08QmkdUS4O	63%	Virustotal		Browse
08QmkdUS4O	62%	ReversingLabs	Linux.Trojan.Gafgyt
08QmkdUS4O	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.206.241.200	unknown	Germany	209929	AWMLTNL	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
109.206.241.200	W9BzYpUe5X	Get hash	malicious	Browse
	7vhbMpslIG	Get hash	malicious	Browse
	FyUl1j2cXj	Get hash	malicious	Browse
	34ePCj9J1F	Get hash	malicious	Browse
	Dc08q46S8U	Get hash	malicious	Browse
109.202.202.202	W9BzYpUe5X	Get hash	malicious	Browse
	7vhbMpslIG	Get hash	malicious	Browse
	FyUl1j2cXj	Get hash	malicious	Browse
	34ePCj9J1F	Get hash	malicious	Browse
	Dc08q46S8U	Get hash	malicious	Browse
	TCccGZGtlL	Get hash	malicious	Browse
	vg0kRB2PLf	Get hash	malicious	Browse
	qVXlqhOmQq	Get hash	malicious	Browse
	BXshTEYrhY	Get hash	malicious	Browse
	L8REvh5QGb	Get hash	malicious	Browse
	a01BJ3m8cw	Get hash	malicious	Browse
	4NXfTjfl6o	Get hash	malicious	Browse
	T09NNS4zv8	Get hash	malicious	Browse
	2evgVCBg4o	Get hash	malicious	Browse
	25OWHuy7ih	Get hash	malicious	Browse
	GJcPBwhQ7a	Get hash	malicious	Browse
	ScVWitNTjh	Get hash	malicious	Browse
	o5PXxvYUZa	Get hash	malicious	Browse
	yIEtjwVMK7	Get hash	malicious	Browse
	botx.arm5	Get hash	malicious	Browse
91.189.91.43	W9BzYpUe5X	Get hash	malicious	Browse
	7vhbMpslIG	Get hash	malicious	Browse
	FyUl1j2cXj	Get hash	malicious	Browse
	34ePCj9J1F	Get hash	malicious	Browse
	Dc08q46S8U	Get hash	malicious	Browse
	TCccGZGtlL	Get hash	malicious	Browse
	vg0kRB2PLf	Get hash	malicious	Browse
	qVXlqhOmQq	Get hash	malicious	Browse
	BXshTEYrhY	Get hash	malicious	Browse
	L8REvh5QGb	Get hash	malicious	Browse
	a01BJ3m8cw	Get hash	malicious	Browse
	4NXfTjfl6o	Get hash	malicious	Browse
	T09NNS4zv8	Get hash	malicious	Browse
	2evgVCBg4o	Get hash	malicious	Browse
	25OWHuy7ih	Get hash	malicious	Browse
	GJcPBwhQ7a	Get hash	malicious	Browse
	ScVWitNTjh	Get hash	malicious	Browse
	o5PXxvYUZa	Get hash	malicious	Browse
	yIEtjwVMK7	Get hash	malicious	Browse
	botx.arm5	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
INIT7CH	W9BzYpUe5X	Get hash	malicious	Browse	109.202.202.202
	7vhbMpslIG	Get hash	malicious	Browse	109.202.202.202
	FyUl1j2cXj	Get hash	malicious	Browse	109.202.202.202
	34ePCj9J1F	Get hash	malicious	Browse	109.202.202.202
	Dc08q46S8U	Get hash	malicious	Browse	109.202.202.202
	TCccGZGtlL	Get hash	malicious	Browse	109.202.202.202
	vg0kRB2PLf	Get hash	malicious	Browse	109.202.202.202
	qVXlqhOmQq	Get hash	malicious	Browse	109.202.202.202
	BXshTEYrhY	Get hash	malicious	Browse	109.202.202.202
	L8REvh5QGb	Get hash	malicious	Browse	109.202.202.202
	a01BJ3m8cw	Get hash	malicious	Browse	109.202.202.202
	4NXfTjfl6o	Get hash	malicious	Browse	109.202.202.202
	T09NNS4zv8	Get hash	malicious	Browse	109.202.202.202
	2evgVCBg4o	Get hash	malicious	Browse	109.202.202.202
	25OWHuy7ih	Get hash	malicious	Browse	109.202.202.202
	GJcPBwhQ7a	Get hash	malicious	Browse	109.202.202.202
	ScVWitNTjh	Get hash	malicious	Browse	109.202.202.202
	o5PXxvYUZa	Get hash	malicious	Browse	109.202.202.202
	yIEtjwVMK7	Get hash	malicious	Browse	109.202.202.202
	botx.arm5	Get hash	malicious	Browse	109.202.202.202
AWMLTNL	W9BzYpUe5X	Get hash	malicious	Browse	109.206.241.200
	7vhbMpslIG	Get hash	malicious	Browse	109.206.241.200
	FyUl1j2cXj	Get hash	malicious	Browse	109.206.241.200
	34ePCj9J1F	Get hash	malicious	Browse	109.206.241.200
	Dc08q46S8U	Get hash	malicious	Browse	109.206.241.200
	ICPO07082299976.doc	Get hash	malicious	Browse	109.206.241.81
	cH4gky4gfD	Get hash	malicious	Browse	109.206.241.211
	oWklLGZuSu	Get hash	malicious	Browse	109.206.241.211
	nSXSa4dSND	Get hash	malicious	Browse	109.206.241.211
	SYqwUjX1nA	Get hash	malicious	Browse	109.206.241.211
	Qq1Rxis6vK	Get hash	malicious	Browse	109.206.241.211
	P4RpqfkkF7	Get hash	malicious	Browse	109.206.241.211
	d4dyUKBiRo	Get hash	malicious	Browse	109.206.241.211
	6MhZDTqLC3	Get hash	malicious	Browse	109.206.241.211
	nfbaWkGGZS	Get hash	malicious	Browse	109.206.241.211
	nMvQ8ak7xr	Get hash	malicious	Browse	109.206.241.211
	Contract - Wipak Oy.xlsx	Get hash	malicious	Browse	109.206.241.81
	t3uEMr422v.exe	Get hash	malicious	Browse	109.206.241.81
	SecuriteInfo.com.Variant.Tedy.172823.10285.exe	Get hash	malicious	Browse	109.206.241.195
	PAYMENT_.EXE	Get hash	malicious	Browse	109.206.241.195

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	6.061107529790168
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	08QmkdUS4O
File size:	129898
MD5:	4c0115c94951a66f3be2d121dd9fae29
SHA1:	831538ed8530f8329ef95394d8876c6a32e80011
SHA256:	48e1d0c82a2abfc1efb94fc2e781249601d900c4cb0a56cf6b4605891feb5514
SHA512:	dbb1006d134c8c912369341f5b78bc995e37951821f8c357be0baed6063574fb2886708032829a2d0c3178aae6fef8aed92ec9fb7df4d8bdf7ede10294d46e92
SSDEEP:	3072:6jVlyaL5JCrIpv04svbttiEiTmP46aQyfPlfKsNb:yoCJCN4svbHemP46aQyfPlfKsNb
TLSH:	DBC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................e...e...............e...e...e..@....h..........Q.td..................................-...L."....H..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	100108
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x1204c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1a0fc	0x120fc	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1a110	0x12110	0x4490	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1e5a0	0x165a0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x265a4	0x165a4	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x265ac	0x165ac	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x265b4	0x165b4	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x265b8	0x165b8	0x42c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x269e4	0x169e4	0x6458	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x169e4	0xbd4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x175b8	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x176d8	0x578	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x17c50	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x17d04	0x8bd	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x185c4	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x18664	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x18a2c	0x4a00	0x10	0x0		19	647	4
.strtab	STRTAB	0x0	0x1d42c	0x273e	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x165a4	0x165a4	6.1609	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x165a4	0x265a4	0x265a4	0x440	0x6898	3.1189	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1a0fc	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1a110	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1e5a0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x265a4	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x265ac	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x265b4	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x265b8	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x269e4	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a0fc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a108	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a10c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x884c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x979c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1173c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1195c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1260c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1318c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1326c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1348c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1358c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1399c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1409c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1439c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1453c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1489c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1519c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1529c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1534c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1556c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1584c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1599c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1672c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1759c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1771c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x186e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1927c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1941c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a06c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x265a4	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x265ac	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x265c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x265c4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x265c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8774	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x89ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8adc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x978c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x991c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae04	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x9a6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa02c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc48c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf3a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf51c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2667c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x10318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10690	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26680	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x26688	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26690	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1d548	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x125f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13264	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13928	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13be4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x267cc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x13ed8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14388	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x268d4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1448c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x268ec	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14704	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e174	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269a0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14b6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15194	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1531c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2cc54	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x15380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1bc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1752c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1756c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x186e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x269d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19154	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x191d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.151.5663	.symtab	0x1c524	40	OBJECT	<unknown>	DEFAULT	4
C.182.5957	.symtab	0x1c590	16	OBJECT	<unknown>	DEFAULT	4
C.183.5958	.symtab	0x1c564	20	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x26a00	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x2666c	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x2cc7c	4	OBJECT	<unknown>	DEFAULT	10
Laligned	.symtab	0x12f78	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x12f94	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x26a1c	16384	OBJECT	<unknown>	DEFAULT	10
UserAgents	.symtab	0x265dc	144	OBJECT	<unknown>	DEFAULT	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x265a8	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x265a4	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x26680	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1cf48	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x269d8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1e2a0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x26688	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1d248	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x265b0	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x265ac	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1e5a0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1e5a0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x26680	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1cf48	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x269d8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1e2a0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x26688	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1d248	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x26684	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x269dc	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x2668c	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x11cbc	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13364	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x15378	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x117c0	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x11834	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x11ab0	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14d60	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14e10	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x13378	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x11884	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x14250	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1489c	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x1489c	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17534	60	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x118d8	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13944	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x11904	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2cc54	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x14adc	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x151ec	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x14a48	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1759c	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x117c0	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x11834	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17e2c	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17c58	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x18010	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1771c	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x11930	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12d88	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17728	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17734	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12dbc	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1195c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15218	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x11984	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x15244	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1358c	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x135d0	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x119b0	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11a08	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x13970	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x15270	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2cc58	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x13568	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x168e4	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x186e8	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x18374	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x147d4	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11a34	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1346c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11a84	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18f90	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16630	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x12e80	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x16620	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1672c	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16744	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x12e90	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1529c	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x11ab0	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x11b1c	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x17570	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x174f8	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1439c	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x14678	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x180a8	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x11b78	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x139cc	44	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x139f8	52	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x152c8	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11ba4	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13a2c	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13a58	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13a8c	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x145b8	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x150b8	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x13ae8	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x13b18	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13b30	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11bd4	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14b70	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13abc	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11cfc	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x14708	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x19158	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x12fb0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x12f30	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x12f30	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x130b8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x18278	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x12f50	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x18160	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x130d4	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1318c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x168a4	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x18228	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1326c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13460	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16830	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x148a8	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1348c	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11c28	44	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x15320	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x18ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11c88	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x11790	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11d30	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1534c	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11c54	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x15384	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x153f4	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x153d4	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x11c5c	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x265b4	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x265b4	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x19624	736	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmpeq	.symtab	0x19ff4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmple	.symtab	0x19ff4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdrcmple	.symtab	0x19fd8	48	FUNC	<unknown>	DEFAULT	2
__aeabi_d2uiz	.symtab	0x1a06c	84	FUNC	<unknown>	DEFAULT	2
__aeabi_dadd	.symtab	0x19624	736	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpeq	.symtab	0x1a008	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpge	.symtab	0x1a044	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpgt	.symtab	0x1a058	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmple	.symtab	0x1a030	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmplt	.symtab	0x1a01c	20	FUNC	<unknown>	DEFAULT	2
__aeabi_ddiv	.symtab	0x19d40	516	FUNC	<unknown>	DEFAULT	2
__aeabi_dmul	.symtab	0x19a18	808	FUNC	<unknown>	DEFAULT	2
__aeabi_drsub	.symtab	0x19618	0	FUNC	<unknown>	DEFAULT	2
__aeabi_dsub	.symtab	0x19620	740	FUNC	<unknown>	DEFAULT	2
__aeabi_f2d	.symtab	0x19958	64	FUNC	<unknown>	DEFAULT	2
__aeabi_i2d	.symtab	0x1992c	44	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv	.symtab	0x194d8	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x11738	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x19600	24	FUNC	<unknown>	DEFAULT	2
__aeabi_l2d	.symtab	0x199ac	108	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x11738	4	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x19904	40	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x11478	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x11570	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ul2d	.symtab	0x19998	128	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2cc48	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x269a0	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x13b30	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x269e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x269e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14dd8	56	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x19f54	132	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x26684	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x269dc	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x2668c	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2cc78	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x265b8	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x18b58	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x1927c	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18a30	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x151bc	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x151b8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x11738	4	FUNC	<unknown>	DEFAULT	2
__divdf3	.symtab	0x19d40	516	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x194d8	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x169d0	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1a0c0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x265bc	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x191d4	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x18948	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x18ae8	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2cc40	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x19f54	132	FUNC	<unknown>	DEFAULT	2
__errno_location	.symtab	0x11cbc	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x117b4	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2cc38	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x19958	64	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fixunsdfsi	.symtab	0x1a06c	84	FUNC	<unknown>	DEFAULT	2
__floatdidf	.symtab	0x199ac	108	FUNC	<unknown>	DEFAULT	2
__floatsidf	.symtab	0x1992c	44	FUNC	<unknown>	DEFAULT	2
__floatundidf	.symtab	0x19998	128	FUNC	<unknown>	DEFAULT	2
__floatunsidf	.symtab	0x19904	40	FUNC	<unknown>	DEFAULT	2
__gedf2	.symtab	0x19f44	148	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x174b0	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x13364	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x19f44	148	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x15378	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x14008	148	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x1409c	140	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1415c	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x14128	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x14148	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__ledf2	.symtab	0x19f4c	140	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x19348	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x18b44	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x118d8	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13944	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x11b0c	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x117c0	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x11834	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x11930	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x119b0	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x18f90	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1529c	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x11ab0	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x17570	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x11b78	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x139cc	44	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x139f8	52	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11ba4	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13a2c	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13a58	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x150b8	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2cc3c	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x11c54	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x11c5c	44	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x19f4c	140	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x267cc	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x2cc1c	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x2cdf8	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x11654	228	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x19a18	808	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x1173c	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x2ce20	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2ce2c	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x19f54	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x18c34	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x171dc	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2cc44	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x265a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14dcc	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x14dd4	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x174f8	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x18c68	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x269c0	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2cc4c	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2ce10	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2ce30	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x13c0c	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13c30	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13be8	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2669c	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x19394	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x154b0	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17864	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1556c	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x11e50	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1d548	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x193f0	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17c28	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1941c	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x156a4	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x11f18	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x266a0	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x19620	740	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1519c	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x151c0	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x14d60	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14e10	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14e6c	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x269b8	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x11478	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x11588	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x11790	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x13378	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x11f48	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x17510	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2ce34	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2ce38	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x269e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2ce3c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2cc54	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x11884	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1a0fc	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2aa38	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x11f94	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1599c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2cc58	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x157a8	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16190	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x1260c	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x128c4	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x126a4	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x126dc	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x12878	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x14dd4	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14dd4	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2cd78	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x17930	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x11de0	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x266a4	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x266a8	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x17cec	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x2aa34	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x266c0	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x2aa30	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x266dc	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x11e60	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x266d8	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x148b0	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15818	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1d618	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1584c	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x12018	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x14250	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x118ac	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0xc490	220	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x10478	144	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x1489c	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1489c	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
axis_bp	.symtab	0x265d8	4	OBJECT	<unknown>	DEFAULT	9
bcopy	.symtab	0x12e70	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2cc34	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x2cc50	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x17534	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x13b30	184	FUNC	<unknown>	DEFAULT	2
buf.4901	.symtab	0x2ca3c	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x26674	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1a0f4	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x13da8	88	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x81cc	228	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x82b0	448	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x8470	448	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x11cc8	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x118d8	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2555	.symtab	0x269e4	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x13944	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0xa030	640	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x11b0c	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xa4a8	344	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x265c4	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x11904	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2cc40	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2cc54	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x14adc	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x151ec	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x14a48	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1e1bc	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1759c	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x117c0	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x11834	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x9920	208	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x2aa1c	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x979c	388	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x9514	648	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x17e2c	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17c58	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x18010	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0xa448	96	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x1e1a8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1771c	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x265b8	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x269e0	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x11930	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x12d88	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x13e00	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x17728	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x17728	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17734	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x12dbc	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0xea94	16	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x9c18	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0xe7b0	740	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x19028	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x1195c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x15218	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x11984	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x15244	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1358c	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x135d0	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x119b0	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x119dc	44	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x11a08	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x13970	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1399c	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x15270	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4900	.symtab	0x2cc08	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2cc58	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x265c8	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x265cc	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x265d0	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x265d4	4	OBJECT	<unknown>	DEFAULT	9
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x1ae04	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x13530	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x13554	20	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0xc6b8	980	FUNC	<unknown>	DEFAULT	2
i.4419	.symtab	0x26678	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x12fb0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x13568	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x168e4	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x186e8	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x18584	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x18374	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x182a8	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xe58c	548	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8778	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x267d0	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x144a4	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x147d4	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x11a34	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1346c	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x11a84	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x26a10	4	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0xa2b0	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x18f90	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x26a14	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xeaa4	2356	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0xa710	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x9cd4	136	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0xbc30	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x13c54	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x16630	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x12e80	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x16620	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x1672c	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x16744	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x12e90	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x268d4	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x268ec	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2cc5c	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x1529c	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x2ca38	4	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x2cc84	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x134f8	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1351c	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x26a08	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x269e8	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x11ab0	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2cc80	4	OBJECT	<unknown>	DEFAULT	10
p.2553	.symtab	0x265c0	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x99f0	128	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x2cc8c	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x11b1c	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x17570	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x11b48	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x1d570	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8fd8	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8c00	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8df0	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8c6c	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xca8c	6912	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x1d584	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x174f8	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x14398	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0xf52c	232	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0xf614	172	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x8ae8	280	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x89b0	312	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0xf3d8	136	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0xf460	204	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1439c	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1e174	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x14678	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x26920	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x180a8	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x11b78	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x13ef0	280	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x139cc	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 21:44:43.539442062 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 8, 2022 21:44:44.078453064 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:44:44.105607033 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:44:44.105715036 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:44:44.106146097 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:44:44.133390903 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:44:44.311275005 CEST	42516	80	192.168.2.23	109.202.202.202
Aug 8, 2022 21:44:58.080240965 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:44:58.080420017 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:44:58.107866049 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:44:58.108027935 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:44:58.642712116 CEST	43928	443	192.168.2.23	91.189.91.42
Aug 8, 2022 21:45:10.930129051 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 8, 2022 21:45:15.025823116 CEST	42516	80	192.168.2.23	109.202.202.202
Aug 8, 2022 21:45:39.600486994 CEST	43928	443	192.168.2.23	91.189.91.42
Aug 8, 2022 21:45:58.095509052 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:45:58.095902920 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:45:58.123043060 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:45:58.123389006 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:46:58.126835108 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:46:58.127084017 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:46:58.156166077 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:46:58.156383991 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:47:58.177408934 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:47:58.177666903 CEST	35072	29448	192.168.2.23	109.206.241.200
Aug 8, 2022 21:47:58.204710007 CEST	29448	35072	109.206.241.200	192.168.2.23
Aug 8, 2022 21:47:58.205029964 CEST	35072	29448	192.168.2.23	109.206.241.200

System Behavior

Analysis Process: 08QmkdUS4O PID: 6230, Parent PID: 6126

General

Start time:	21:44:42
Start date:	08/08/2022
Path:	/tmp/08QmkdUS4O
Arguments:	/tmp/08QmkdUS4O
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: 08QmkdUS4O PID: 6232, Parent PID: 6230

General

Start time:	21:44:43
Start date:	08/08/2022
Path:	/tmp/08QmkdUS4O
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: 08QmkdUS4O PID: 6233, Parent PID: 6230

General

Start time:	21:44:43
Start date:	08/08/2022
Path:	/tmp/08QmkdUS4O
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: 08QmkdUS4O PID: 6236, Parent PID: 6233

General

Start time:	21:44:43
Start date:	08/08/2022
Path:	/tmp/08QmkdUS4O
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 08QmkdUS4O

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: 08QmkdUS4O PID: 6230, Parent PID: 6126

General

Chronological Activities

Analysis Process: 08QmkdUS4O PID: 6232, Parent PID: 6230

General

Chronological Activities

Analysis Process: 08QmkdUS4O PID: 6233, Parent PID: 6230

General

Chronological Activities

Analysis Process: 08QmkdUS4O PID: 6236, Parent PID: 6233

General

Linux Analysis Report
08QmkdUS4O