Edit tour

Linux Analysis Report
Eov3h9U733.elf

Overview

General Information

Sample name:	Eov3h9U733.elf renamed because original name is a hash value
Original sample name:	1bfc55f5bbf811609b0d24e09d7ef260.elf
Analysis ID:	1447835
MD5:	1bfc55f5bbf811609b0d24e09d7ef260
SHA1:	5121cd3a70220e61b95fde4604fde2d81022663a
SHA256:	f5df02a958d8c0c4b48eaaba5befab65258f2fdd9917421d97a75a5ed0594755
Tags:	32armelfgafgyt
Infos:

Detection

Gafgyt, Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Executes the "rm" command used to delete files or directories

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447835
Start date and time:	2024-05-27 09:02:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Eov3h9U733.elf renamed because original name is a hash value
Original Sample Name:	1bfc55f5bbf811609b0d24e09d7ef260.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@0/0

Warnings

Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:	/tmp/Eov3h9U733.elf
PID:	6214
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6200, Parent: 4333)

rm (PID: 6200, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.r7hVrBNLf9 /tmp/tmp.Cu7wXPIxIQ /tmp/tmp.Prg1rYxNcG

dash New Fork (PID: 6201, Parent: 4333)

rm (PID: 6201, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.r7hVrBNLf9 /tmp/tmp.Cu7wXPIxIQ /tmp/tmp.Prg1rYxNcG

Eov3h9U733.elf (PID: 6214, Parent: 6129, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Eov3h9U733.elf

Eov3h9U733.elf New Fork (PID: 6216, Parent: 6214)

Eov3h9U733.elf New Fork (PID: 6218, Parent: 6214)

Eov3h9U733.elf New Fork (PID: 6220, Parent: 6218)

Eov3h9U733.elf New Fork (PID: 6226, Parent: 6220)

Eov3h9U733.elf New Fork (PID: 6278, Parent: 6220)

Eov3h9U733.elf New Fork (PID: 6331, Parent: 6220)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Eov3h9U733.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
Eov3h9U733.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Eov3h9U733.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1908c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1912c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1917c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Eov3h9U733.elf	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
Eov3h9U733.elf	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00

Memory Dumps

Source	Rule	Description	Author	Strings
6218.1.00007f8664017000.00007f8664034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6218.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1908c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1912c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1917c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6218.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6218.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6214.1.00007f8664017000.00007f8664034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6214.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1908c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1912c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1917c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6214.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6214.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6226.1.00007f8664017000.00007f8664034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6226.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1908c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1912c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1917c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6226.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6226.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6216.1.00007f8664017000.00007f8664034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6216.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1908c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1912c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1917c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6216.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6216.1.00007f8664017000.00007f8664034000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
Process Memory Space: Eov3h9U733.elf PID: 6214	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Eov3h9U733.elf PID: 6214	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16172:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16186:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1619a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16212:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16226:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1623a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1624e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16262:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16276:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1628a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1629e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16302:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Eov3h9U733.elf PID: 6216	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Eov3h9U733.elf PID: 6216	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1618d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1622d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1627d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1631d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Eov3h9U733.elf PID: 6218	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Eov3h9U733.elf PID: 6218	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x197b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x198f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Eov3h9U733.elf PID: 6226	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Eov3h9U733.elf PID: 6226	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5fb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5fc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5fd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5fec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x603c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x608c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x612c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 19 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Eov3h9U733.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Eov3h9U733.elf

Virustotal: Detection: 66%

Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/Eov3h9U733.elf (PID: 6214)

Opens: /proc/net/route

Jump to behavior

Source: /tmp/Eov3h9U733.elf (PID: 6226)

Reads hosts file: /etc/hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Eov3h9U733.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Eov3h9U733.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: Eov3h9U733.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: Process Memory Space: Eov3h9U733.elf PID: 6214, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Eov3h9U733.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Eov3h9U733.elf PID: 6218, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Eov3h9U733.elf PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Eov3h9U733.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Eov3h9U733.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Eov3h9U733.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: Eov3h9U733.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: Process Memory Space: Eov3h9U733.elf PID: 6214, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Eov3h9U733.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Eov3h9U733.elf PID: 6218, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Eov3h9U733.elf PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@0/0

Source: /usr/bin/dash (PID: 6200)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.r7hVrBNLf9 /tmp/tmp.Cu7wXPIxIQ /tmp/tmp.Prg1rYxNcG			Jump to behavior
Source: /usr/bin/dash (PID: 6201)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.r7hVrBNLf9 /tmp/tmp.Cu7wXPIxIQ /tmp/tmp.Prg1rYxNcG			Jump to behavior

Source: /tmp/Eov3h9U733.elf (PID: 6214)

Queries kernel information via 'uname':

Jump to behavior

Source: Eov3h9U733.elf, 6214.1.000055df68405000.000055df68554000.rw-.sdmp, Eov3h9U733.elf, 6216.1.000055df68405000.000055df68554000.rw-.sdmp, Eov3h9U733.elf, 6218.1.000055df68405000.000055df68554000.rw-.sdmp, Eov3h9U733.elf, 6226.1.000055df68405000.000055df68554000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Eov3h9U733.elf, 6214.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp, Eov3h9U733.elf, 6216.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp, Eov3h9U733.elf, 6218.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp, Eov3h9U733.elf, 6226.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Eov3h9U733.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Eov3h9U733.elf
Source: Eov3h9U733.elf, 6214.1.000055df68405000.000055df68554000.rw-.sdmp, Eov3h9U733.elf, 6216.1.000055df68405000.000055df68554000.rw-.sdmp, Eov3h9U733.elf, 6218.1.000055df68405000.000055df68554000.rw-.sdmp, Eov3h9U733.elf, 6226.1.000055df68405000.000055df68554000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Eov3h9U733.elf, 6214.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp, Eov3h9U733.elf, 6216.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp, Eov3h9U733.elf, 6218.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp, Eov3h9U733.elf, 6226.1.00007ffde79ec000.00007ffde7a0d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: Eov3h9U733.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: Eov3h9U733.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6214, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6218, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6226, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: Eov3h9U733.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: Eov3h9U733.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6214.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6216.1.00007f8664017000.00007f8664034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6214, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6218, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eov3h9U733.elf PID: 6226, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Eov3h9U733.elf	66%	Virustotal		Browse
Eov3h9U733.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.05893029380648
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Eov3h9U733.elf
File size:	181'882 bytes
MD5:	1bfc55f5bbf811609b0d24e09d7ef260
SHA1:	5121cd3a70220e61b95fde4604fde2d81022663a
SHA256:	f5df02a958d8c0c4b48eaaba5befab65258f2fdd9917421d97a75a5ed0594755
SHA512:	83d70717bb764d9d78a84dc6310c691dfbcc7250569beeb94f790228b81139efa9cef937b32a2dbcbbf8ed4d061446230544b5b20c4092c18177686719d0251a
SSDEEP:	3072:6PC+RjGkWa6s/qSPeAjQM6PBtCZbPgoixVsAfymUwwFB7DXNu:61fWa6s/qSGAYPB8ZbPgoixVsAfymUwr
TLSH:	5D042A34D6504B17C1D223FAA69A424E3F234F97A3E733195638BBB03FE279A0D61915
File Content Preview:	.ELF..............(.........4....2......4. ...(........p.....D...D.. ... ................................................................u..........................................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	144048
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x17e40	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1ff30	0x17f30	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1ff40	0x17f40	0x452c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2446c	0x1c46c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x24484	0x1c484	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2c5a4	0x1c5a4	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2c5a8	0x1c5a8	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2c5a8	0x1c5a8	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2c5ac	0x1c5ac	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2c5b0	0x1c5b0	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2c5b4	0x1c5b4	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2c664	0x1c664	0x2cc	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2c930	0x1c930	0x7224	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1c930	0xcf4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1d628	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1d768	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1d97b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1f9be	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x200a0	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x20f18	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x211d0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x21a9a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x22c29	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x23181	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x23197	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x23738	0x5e70	0x10	0x0		28	838	4
.strtab	STRTAB	0x0	0x295a8	0x30d2	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1c484	0x24484	0x24484	0x120	0x120	4.3818	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1c5a4	0x1c5a4	6.1989	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1c5a4	0x2c5a4	0x2c5a4	0x38c	0x75b0	4.1884	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1c5a8	0x2c5a8	0x2c5a8	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1ff30	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1ff40	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x2446c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x24484	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2c5a4	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2c5a8	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2c5a8	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2c5ac	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2c5b0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2c5b4	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2c664	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2c930	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ff30	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ff3c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x812c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf69c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1013c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1036c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1144c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1160c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1183c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1198c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1284c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1329c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1354c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1390c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1397c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1529c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1535c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1574c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1576c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17024	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1817c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18de8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1994c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b75c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c144	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d71c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d7f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1daf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dda8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eacc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ecec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eeb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1efdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1effc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f75c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1feb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fefc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c5ac	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c5a8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x2c668	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c66c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x877c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x89ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x994c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20c34	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x9aa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa0a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe798	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf37c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c720	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x102c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x11604	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11988	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c724	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22d78	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2c72c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23078	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11c5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x233a0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x127f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c734	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x233a8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2342c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x134e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1363c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1373c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13780	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1383c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x138c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13974	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x139c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c738	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x14744	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c750	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x151c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15280	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15340	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c768	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c800	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1548c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1555c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15740	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23f98	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15950	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c814	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15ac8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1628c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ba8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16bc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17010	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17070	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c82c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17560	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1765c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1769c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1772c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17804	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1791c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17af8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2402c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17d4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18558	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x189b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18cf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c83c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c838	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18de4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24090	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a8e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c920	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b3fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b918	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bfe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c924	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1cd34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d1a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c926	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2414c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d270	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d718	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d788	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d7f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d8a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dd2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dda0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c928	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2416c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1ecd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f678	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$t	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
C.11.5548	.symtab	0x24008	12	OBJECT	<unknown>	DEFAULT	4
C.147.6272	.symtab	0x22354	40	OBJECT	<unknown>	DEFAULT	4
C.177.6553	.symtab	0x223c0	16	OBJECT	<unknown>	DEFAULT	4
C.178.6554	.symtab	0x22394	20	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x2402c	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x24014	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x23378	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x24068	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x24044	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x2405c	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x24050	12	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x2c950	4	OBJECT	<unknown>	DEFAULT	14
KHserverHACKER	.symtab	0x2c710	4	OBJECT	<unknown>	DEFAULT	13
LOCAL_ADDR	.symtab	0x33640	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x12fc8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x12fe4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x2c96c	16384	OBJECT	<unknown>	DEFAULT	14
UserAgents	.symtab	0x2c680	144	OBJECT	<unknown>	DEFAULT	13
_Exit	.symtab	0x11700	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2c5b4	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1ea84	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1ea88	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1f738	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1ea7c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1eac0	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1f75c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1fefc	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1eab4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1f6cc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1f6f0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1f714	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1e9e4	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1effc	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1ea30	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2c724	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x22d78	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2c928	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x2416c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x2c72c	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x23078	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2c5a4	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2c5a4	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2c724	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x2c928	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x2c72c	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x16be0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x16bc4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2c728	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x2c92c	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x2c730	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x11c40	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x11574	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1a0c4	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13398	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x16be0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1160c	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x16c70	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x16d90	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x16d00	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x16c70	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x16c54	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x16d90	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x16d74	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x167c8	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x13c28	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x13c4c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x13c04	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x16fa8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x17078	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x16d00	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x16ce4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x133b0	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x11700	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x15000	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1574c	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1b3b0	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x16be0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x17920	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x18088	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x180bc	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x17d60	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13644	116	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x117a8	64	FUNC	<unknown>	HIDDEN	2
__GI_execl	.symtab	0x15a24	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x17660	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x15960	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x18238	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1160c	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x19d18	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x19808	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1a0c4	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1994c	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1a1f0	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x18568	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x16300	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12dbc	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1b738	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1b75c	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1b414	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12df4	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1a0c4	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x117e8	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x176a0	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x11814	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x176b4	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x13574	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x13590	112	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1ad0c	724	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1d2d4	836	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1d658	132	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x176c8	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x16950	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1183c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x136b8	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x176f0	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x17730	20	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x134fc	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x134ec	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1354c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1ac14	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1c144	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1bdcc	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x15568	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11874	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1ab74	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11954	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1d834	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1a720	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x12ed0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1d8b0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1bc28	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1a810	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x12ee0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x174bc	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x17744	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x17788	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x17808	96	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x1352c	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x1351c	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x16c70	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x17b00	196	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x1198c	64	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1d71c	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x16998	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x15140	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x15400	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1bc4c	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x16d90	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x17c74	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x13788	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x13840	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x17868	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11a54	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1390c	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x139c8	136	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13a50	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x15660	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x17564	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x13adc	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x13b2c	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13b40	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11ad8	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x16a88	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13a98	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11c94	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x15490	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1d790	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1dd3c	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x13000	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1a8f0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x12f80	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x12f80	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x130f0	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1a9dc	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1d8c0	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x12fa0	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x13114	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x131d0	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1ab34	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1aa20	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1aa70	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1329c	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x134bc	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1aabc	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1576c	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x15c1c	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1ab98	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11b64	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x178d4	20	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11c10	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1d7f4	64	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x16290	112	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11cc8	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x178e8	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11b94	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x18104	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1817c	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x18158	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x16d00	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2c5b0	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2c5b0	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1f738	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1f6cc	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1f6f0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1f714	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1dfa4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1e900	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1e900	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1e8e4	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1e990	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1dfa4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1e918	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1e960	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1e978	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1e948	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1e930	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1e644	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1e3b4	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1df98	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1dfa0	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1e300	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1e2d8	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1de54	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1df80	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1e354	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x17610	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1e2b4	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1144c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x11548	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1e340	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1f698	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1f690	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1f688	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x310b8	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2c814	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x33b54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2c930	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2c930	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x17024	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x16be0	100	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1d1f0	152	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x16bc4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1e860	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2c728	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x2c92c	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x2c730	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x3361c	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2c664	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x1c3e0	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1d9e0	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x17604	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x175f8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x11560	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1e644	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1de54	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1c4d8	2064	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x812c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2c5ac	0	OBJECT	<unknown>	DEFAULT	10
__dso_handle	.symtab	0x2c664	0	OBJECT	<unknown>	HIDDEN	13
__encode_dotted	.symtab	0x1dda8	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1d8f4	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1da94	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x33b54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x310b0	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1e860	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x11c40	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x162fc	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x245a4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x24484	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x30b60	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1e300	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x11574	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1a0c4	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2c5b0	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x2c5ac	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1e990	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1e354	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1e2d8	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1e340	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1e2b4	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x16300	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x33b0c	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x33b10	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x30b64	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2c5a8	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1e850	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1d288	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1b5f0	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x176c8	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x16950	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x13398	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1ee3c	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1ef24	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1f6bc	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1eeb8	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1efdc	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1f6c4	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1f7a0	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1feb4	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1f140	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1e850	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2c5ac	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2c5a8	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x1e858	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x16be0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13644	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x16e00	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x16e88	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x1160c	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x16300	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x33b14	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x17808	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x16c70	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x16d90	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x13788	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x13840	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11a54	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1390c	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x139c8	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b0e4	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x17564	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x310ac	4	OBJECT	<unknown>	DEFAULT	14
__libc_waitpid	.symtab	0x11b94	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x16d00	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x16764	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x166cc	152	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x2414c	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1e858	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x14bd0	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x13c70	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2c738	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x33794	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x14b20	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1e3b4	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x33b48	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x33b4c	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x1e860	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x16c70	100	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1daf4	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1cd94	1116	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x16c54	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x310b4	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2c5a8	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2c5a8	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x2c830	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2c834	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1b314	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x16f6c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x16f64	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x16f64	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x16f64	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x16f64	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x16d90	100	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1db24	536	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x16d74	24	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x167c8	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x33b40	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x2c927	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x33624	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x2c926	1	OBJECT	<unknown>	HIDDEN	13
__restore_core_regs	.symtab	0x1f6a0	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x310bc	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x33b44	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x33b50	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x13c28	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13c4c	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13c04	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1d618	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1b408	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2c848	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1b91c	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1b974	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1ba50	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x189e8	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1bb18	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1bbec	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1bb48	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x18d0c	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x18de8	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2c84c	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1dfa0	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x13600	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x13744	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x137f8	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x138c8	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x1397c	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x17538	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x177c8	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1d6dc	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x17620	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x11a10	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1b0c0	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x16fa8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x17078	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x170d0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2c82c	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x1144c	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x16290	112	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x16d00	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x16ce4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x133b0	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1b544	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1b478	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x30980	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x33b54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x811d	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8121	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8129	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x810d	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x8111	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x8115	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x8119	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8125	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x11d98	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x3373c	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x33764	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2c734	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1b320	56	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x2c920	4	OBJECT	<unknown>	DEFAULT	13
_dl_nothread_init_static_tls	.symtab	0x1b358	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x33b38	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x33b3c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x33b2c	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x33b28	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x33b30	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x33b20	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1b058	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x33b1c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x33b34	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x33b24	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x33b18	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2c930	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x33b54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x11700	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1ff30	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x310e0	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x11dec	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x19014	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x18e18	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1a290	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x12564	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

System Behavior

Analysis Process: dash PID: 6200, Parent PID: 4333

General

Start time (UTC):	07:02:44
Start date (UTC):	27/05/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6200, Parent PID: 4333

General

Start time (UTC):	07:02:44
Start date (UTC):	27/05/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.r7hVrBNLf9 /tmp/tmp.Cu7wXPIxIQ /tmp/tmp.Prg1rYxNcG
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6201, Parent PID: 4333

General

Start time (UTC):	07:02:44
Start date (UTC):	27/05/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6201, Parent PID: 4333

General

Start time (UTC):	07:02:44
Start date (UTC):	27/05/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.r7hVrBNLf9 /tmp/tmp.Cu7wXPIxIQ /tmp/tmp.Prg1rYxNcG
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6214, Parent PID: 6129

General

Start time (UTC):	07:02:54
Start date (UTC):	27/05/2024
Path:	/tmp/Eov3h9U733.elf
Arguments:	/tmp/Eov3h9U733.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6216, Parent PID: 6214

General

Start time (UTC):	07:02:54
Start date (UTC):	27/05/2024
Path:	/tmp/Eov3h9U733.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6218, Parent PID: 6214

General

Start time (UTC):	07:02:54
Start date (UTC):	27/05/2024
Path:	/tmp/Eov3h9U733.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6220, Parent PID: 6218

General

Start time (UTC):	07:02:54
Start date (UTC):	27/05/2024
Path:	/tmp/Eov3h9U733.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6226, Parent PID: 6220

General

Start time (UTC):	07:03:04
Start date (UTC):	27/05/2024
Path:	/tmp/Eov3h9U733.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6278, Parent PID: 6220

General

Start time (UTC):	07:04:01
Start date (UTC):	27/05/2024
Path:	/tmp/Eov3h9U733.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: Eov3h9U733.elf PID: 6331, Parent PID: 6220

General

Start time (UTC):	07:05:45
Start date (UTC):	27/05/2024
Path:	/tmp/Eov3h9U733.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Eov3h9U733.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

System Behavior

Analysis Process: dash PID: 6200, Parent PID: 4333

General

Chronological Activities

Analysis Process: rm PID: 6200, Parent PID: 4333

General

Chronological Activities

Analysis Process: dash PID: 6201, Parent PID: 4333

General

Chronological Activities

Analysis Process: rm PID: 6201, Parent PID: 4333

General

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6214, Parent PID: 6129

General

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6216, Parent PID: 6214

General

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6218, Parent PID: 6214

General

Chronological Activities

Analysis Process: Eov3h9U733.elf PID: 6220, Parent PID: 6218

Linux Analysis Report
Eov3h9U733.elf