Edit tour

Linux Analysis Report
s0OthAxkuM.elf

Overview

General Information

Sample name:	s0OthAxkuM.elf renamed because original name is a hash value
Original sample name:	f69e0d406a7c759169baaa059720edd4.elf
Analysis ID:	1447843
MD5:	f69e0d406a7c759169baaa059720edd4
SHA1:	685e4b6b15146c5ccef2ffd3602c30180d6b3e8e
SHA256:	de95008e1a69329b540fa5f42b9f327634cdeb32d03f6b27573adbde84952061
Tags:	32elfgafgytmotorola
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447843
Start date and time:	2024-05-27 09:12:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	s0OthAxkuM.elf renamed because original name is a hash value
Original Sample Name:	f69e0d406a7c759169baaa059720edd4.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/1@0/0

Runtime Messages

Command:	/tmp/s0OthAxkuM.elf
PID:	6249
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

s0OthAxkuM.elf (PID: 6249, Parent: 6174, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/s0OthAxkuM.elf

s0OthAxkuM.elf New Fork (PID: 6252, Parent: 6249)

s0OthAxkuM.elf New Fork (PID: 6253, Parent: 6249)

s0OthAxkuM.elf New Fork (PID: 6256, Parent: 6253)

dash New Fork (PID: 6262, Parent: 4331)

rm (PID: 6262, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.p3RgJauZEP /tmp/tmp.bAhgN5J8zq /tmp/tmp.1TdM82QiHF

dash New Fork (PID: 6263, Parent: 4331)

rm (PID: 6263, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.p3RgJauZEP /tmp/tmp.bAhgN5J8zq /tmp/tmp.1TdM82QiHF

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
s0OthAxkuM.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
s0OthAxkuM.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
s0OthAxkuM.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16f12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1702a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1703e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1708e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6252.1.00007f0700001000.00007f070001c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6252.1.00007f0700001000.00007f070001c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16f12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1702a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1703e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1708e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6253.1.00007f0700001000.00007f070001c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6253.1.00007f0700001000.00007f070001c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16f12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1702a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1703e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1708e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6249.1.00007f0700001000.00007f070001c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6249.1.00007f0700001000.00007f070001c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16f12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1702a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1703e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1708e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: s0OthAxkuM.elf PID: 6249	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: s0OthAxkuM.elf PID: 6249	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xeda5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedcd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xede1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeebd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeee5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeef9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: s0OthAxkuM.elf PID: 6252	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: s0OthAxkuM.elf PID: 6252	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x20f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x212c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x217c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x221c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x226c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: s0OthAxkuM.elf PID: 6253	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: s0OthAxkuM.elf PID: 6253	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf57c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf61c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf66c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Snort Signatures

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:15:05.186948
SID:	2839489
Source Port:	666
Destination Port:	35334
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:14:02.657876
SID:	2839489
Source Port:	666
Destination Port:	35326
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:14:49.557028
SID:	2839489
Source Port:	666
Destination Port:	35332
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:13:46.823682
SID:	2839489
Source Port:	666
Destination Port:	35324
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:14:18.297021
SID:	2839489
Source Port:	666
Destination Port:	35328
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:14:33.935290
SID:	2839489
Source Port:	666
Destination Port:	35330
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:16:39.110143
SID:	2839489
Source Port:	666
Destination Port:	35346
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:15:20.798754
SID:	2839489
Source Port:	666
Destination Port:	35336
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:15:36.423068
SID:	2839489
Source Port:	666
Destination Port:	35338
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:16:23.479243
SID:	2839489
Source Port:	666
Destination Port:	35344
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:15:52.141455
SID:	2839489
Source Port:	666
Destination Port:	35340
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:16:07.756166
SID:	2839489
Source Port:	666
Destination Port:	35342
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:13:15.530266
SID:	2839489
Source Port:	666
Destination Port:	35320
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response - Source IP: 176.123.4.187 - Destination IP: 192.168.2.23

Timestamp:	05/27/24-09:13:31.152726
SID:	2839489
Source Port:	666
Destination Port:	35322
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: s0OthAxkuM.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: s0OthAxkuM.elf	Virustotal: Detection: 65%			Perma Link
Source: s0OthAxkuM.elf	ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/s0OthAxkuM.elf (PID: 6249)

Opens: /proc/net/route

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35320
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35322
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35324
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35326
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35328
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35330
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35332
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35334
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35336
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35338
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35340
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35342
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35344
Source: Traffic	Snort IDS: 2839489 ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response 176.123.4.187:666 -> 192.168.2.23:35346

Source: global traffic

TCP traffic: 192.168.2.23:35320 -> 176.123.4.187:666

Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.4.187

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: s0OthAxkuM.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6252.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6253.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6249.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: s0OthAxkuM.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: s0OthAxkuM.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: s0OthAxkuM.elf PID: 6253, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: s0OthAxkuM.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6252.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6253.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6249.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: s0OthAxkuM.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: s0OthAxkuM.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: s0OthAxkuM.elf PID: 6253, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/1@0/0

Source: /usr/bin/dash (PID: 6262)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.p3RgJauZEP /tmp/tmp.bAhgN5J8zq /tmp/tmp.1TdM82QiHF			Jump to behavior
Source: /usr/bin/dash (PID: 6263)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.p3RgJauZEP /tmp/tmp.bAhgN5J8zq /tmp/tmp.1TdM82QiHF			Jump to behavior

Source: /tmp/s0OthAxkuM.elf (PID: 6249)

Queries kernel information via 'uname':

Jump to behavior

Source: s0OthAxkuM.elf, 6249.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.PBbP0K
Source: s0OthAxkuM.elf, 6249.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp, s0OthAxkuM.elf, 6252.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp, s0OthAxkuM.elf, 6253.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/s0OthAxkuM.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/s0OthAxkuM.elf
Source: s0OthAxkuM.elf, 6249.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp	Binary or memory string: ppU/tmp/qemu-open.PBbP0K\T
Source: s0OthAxkuM.elf, 6249.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp, s0OthAxkuM.elf, 6252.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp, s0OthAxkuM.elf, 6253.1.00007ffc9c64b000.00007ffc9c66c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: s0OthAxkuM.elf, 6249.1.0000557073384000.0000557073409000.rw-.sdmp, s0OthAxkuM.elf, 6252.1.0000557073384000.0000557073409000.rw-.sdmp, s0OthAxkuM.elf, 6253.1.0000557073384000.0000557073409000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: s0OthAxkuM.elf, 6249.1.0000557073384000.0000557073409000.rw-.sdmp, s0OthAxkuM.elf, 6252.1.0000557073384000.0000557073409000.rw-.sdmp, s0OthAxkuM.elf, 6253.1.0000557073384000.0000557073409000.rw-.sdmp	Binary or memory string: r8spUPp8spU!/etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: s0OthAxkuM.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: s0OthAxkuM.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: s0OthAxkuM.elf PID: 6249, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s0OthAxkuM.elf PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s0OthAxkuM.elf PID: 6253, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: s0OthAxkuM.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: s0OthAxkuM.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.00007f0700001000.00007f070001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: s0OthAxkuM.elf PID: 6249, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s0OthAxkuM.elf PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s0OthAxkuM.elf PID: 6253, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
s0OthAxkuM.elf	65%	Virustotal		Browse
s0OthAxkuM.elf	66%	ReversingLabs	Linux.Trojan.LnxGafgyt
s0OthAxkuM.elf	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
176.123.4.187	unknown	Moldova Republic of	200019	ALEXHOSTMD	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	A13Zu2Plc8.elf	Get hash	malicious	Muhstik, Tsunami	Browse
	5BV1oDzv8L.elf	Get hash	malicious	Muhstik, Tsunami	Browse
	zUCeX9wuiq.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	KFhNxvfU3w.elf	Get hash	malicious	Mirai, Moobot	Browse
	aBty1GtaQm.elf	Get hash	malicious	Unknown	Browse
	assailant.arm4.elf	Get hash	malicious	Mirai	Browse
	vgEeUy68no.elf	Get hash	malicious	Mirai	Browse
	ZN9V7cH5Wm.elf	Get hash	malicious	Unknown	Browse
	Hb7PI1DfNA.elf	Get hash	malicious	Mirai, Okiru	Browse
109.202.202.202	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	BEHmvgae4n.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	5ARZLTF5Xj.elf	Get hash	malicious	Gafgyt	Browse
	Jf5dTAe0ah.elf	Get hash	malicious	Gafgyt	Browse
	fW1ZGcjSZW.elf	Get hash	malicious	Gafgyt	Browse
	ZTQJcmS1JY.elf	Get hash	malicious	Mirai, Okiru	Browse
	gGi2o8tbgL.elf	Get hash	malicious	Mirai, Okiru	Browse
	SWiRbkENWK.elf	Get hash	malicious	Mirai	Browse
	Silverlining	Get hash	malicious	Sliver	Browse
176.123.4.187	Au4yf52Szd.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	PdZXqwmJYf.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	6eYKWxlBqa.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	4CB2w5yQL3.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	rV97CNwo30.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mZ2LgS47Z1.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.43	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	5ARZLTF5Xj.elf	Get hash	malicious	Gafgyt	Browse
	Jf5dTAe0ah.elf	Get hash	malicious	Gafgyt	Browse
	fW1ZGcjSZW.elf	Get hash	malicious	Gafgyt	Browse
	ZTQJcmS1JY.elf	Get hash	malicious	Mirai, Okiru	Browse
	gGi2o8tbgL.elf	Get hash	malicious	Mirai, Okiru	Browse
	SWiRbkENWK.elf	Get hash	malicious	Mirai	Browse
	Silverlining	Get hash	malicious	Sliver	Browse
	wbON6KJpx8.elf	Get hash	malicious	Muhstik, Tsunami	Browse
91.189.91.42	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	BEHmvgae4n.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	5ARZLTF5Xj.elf	Get hash	malicious	Gafgyt	Browse
	Jf5dTAe0ah.elf	Get hash	malicious	Gafgyt	Browse
	fW1ZGcjSZW.elf	Get hash	malicious	Gafgyt	Browse
	ZTQJcmS1JY.elf	Get hash	malicious	Mirai, Okiru	Browse
	gGi2o8tbgL.elf	Get hash	malicious	Mirai, Okiru	Browse
	SWiRbkENWK.elf	Get hash	malicious	Mirai	Browse
	Silverlining	Get hash	malicious	Sliver	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	4CB2w5yQL3.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	BEHmvgae4n.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	5ARZLTF5Xj.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	Jf5dTAe0ah.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	4FeEYSCLXC.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	fW1ZGcjSZW.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ZTQJcmS1JY.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
CANONICAL-ASGB	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	4CB2w5yQL3.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	BEHmvgae4n.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	5ARZLTF5Xj.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	Jf5dTAe0ah.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	4FeEYSCLXC.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	fW1ZGcjSZW.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ZTQJcmS1JY.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
ALEXHOSTMD	Au4yf52Szd.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.123.4.187
	PdZXqwmJYf.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.123.4.187
	6eYKWxlBqa.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.123.4.187
	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.123.4.187
	4CB2w5yQL3.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.123.4.187
	rV97CNwo30.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.123.4.187
	mZ2LgS47Z1.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.123.4.187
	472.rtf.doc	Get hash	malicious	SmokeLoader	Browse	45.84.0.173
	support.Client.exe.zip	Get hash	malicious	ScreenConnect Tool	Browse	176.123.10.70
	https://coanj.com/	Get hash	malicious	Unknown	Browse	45.142.212.163
AMAZON-02US	Ref19920830281982938RT.xls	Get hash	malicious	Remcos	Browse	54.241.153.192
	#U0426#U0438#U0442#U0430#U0442#U0430.exe	Get hash	malicious	FormBook	Browse	18.143.129.199
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse	18.156.141.44
	lrZL6K5Idl.exe	Get hash	malicious	Njrat	Browse	108.132.8.18
	https://fix-to-all-issues-review-verification-form-aa-submit-wheat.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	76.76.21.9
	https://sweet-moonbeam-28ccf4.netlify.app/appeal.html/	Get hash	malicious	Unknown	Browse	52.30.24.58
	https://origines-decoration.com/	Get hash	malicious	Unknown	Browse	18.159.147.43
	https://kruekanlogin.gitbook.io/	Get hash	malicious	Unknown	Browse	76.223.111.18
	https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	76.76.21.22
	https://fbrestriction.wixsite.com/facebook	Get hash	malicious	Unknown	Browse	108.156.60.112
INIT7CH	JhemwyNPBX.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	BEHmvgae4n.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	5ARZLTF5Xj.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	Jf5dTAe0ah.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	fW1ZGcjSZW.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	ZTQJcmS1JY.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	gGi2o8tbgL.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	SWiRbkENWK.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Silverlining	Get hash	malicious	Sliver	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.PBbP0K (deleted)

Download File

Process:	/tmp/s0OthAxkuM.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.142289714673083
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	s0OthAxkuM.elf
File size:	135'609 bytes
MD5:	f69e0d406a7c759169baaa059720edd4
SHA1:	685e4b6b15146c5ccef2ffd3602c30180d6b3e8e
SHA256:	de95008e1a69329b540fa5f42b9f327634cdeb32d03f6b27573adbde84952061
SHA512:	66f96d8f3f84dfca9f17c713f500bd065070576e1b19ece5076c3f2039c8526ad4206d647fe8c1abf31d959415c8b9a51adec1b631c64bebb1844c88fb36c4e1
SSDEEP:	3072:3v/xY5MqJdV3QeuacWjcW0JcWcBUsbWAxpk5k78tHZ2mm2s0UzZ6l0Nu:3+ldVQeuacWjcW0JcWcBzbWkWG78t52O
TLSH:	DCD31AB3F504DE66F00AE67208D38B257E70FEE30B63156263173A6AED361C5285BE45
File Content Preview:	.ELF.......................D...4.........4. ...(.......................^...^...... ........`...`...`...<..jd...... .dt.Q............................NV..a....da...]\N^NuNV..J9....f>"y...\| QJ.g.X.#....\|N."y...\| QJ.f.A.....J.g.Hy...`N.X.........N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	111348
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0x15d88	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x80015e30	0x15e30	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x80015e3e	0x15e3e	0x4420	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x8001c260	0x1a260	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x8001c264	0x1a264	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8001c26c	0x1a26c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8001c274	0x1a274	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x8001c278	0x1a278	0x324	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x8001c59c	0x1a59c	0x6728	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1a59c	0xcf0	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1b28c	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1b54c	0x3490	0x10	0x0		14	313	4
.strtab	STRTAB	0x0	0x1e9dc	0x27dd	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1a25e	0x1a25e	6.1249	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x1a260	0x8001c260	0x8001c260	0x33c	0x6a64	4.1909	0x6	RW	0x2000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80015e30	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80015e3e	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8001c260	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8001c264	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8001c26c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8001c274	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8001c278	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8001c59c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
KHcommSOCK	.symtab	0x8001c5b8	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x8001c328	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x80022814	4	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x8001c5d2	16384	OBJECT	<unknown>	DEFAULT	10
UserAgents	.symtab	0x8001c298	144	OBJECT	<unknown>	DEFAULT	9
_Exit	.symtab	0x80006bec	92	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8001c268	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8001c264	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8001c33c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x80018b8a	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8001c594	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x80019f5e	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8001c344	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x80018e8a	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8001c270	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8001c26c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8001c260	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8001c260	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8001c33c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x8001c594	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x8001c344	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x8001c340	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x8001c598	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x8001c348	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x800074d4	16	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x80006abe	302	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x800111c8	500	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x80009e8c	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8000edf0	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x80006990	302	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x8000a570	68	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x8000a5b4	72	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x8000a520	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8000dec0	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8000dfca	124	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80009eb0	266	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x80006bec	92	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x8000c50c	376	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8000ce3c	28	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80012678	64	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x8000e3d8	116	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80006cb8	96	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x8000e8cc	292	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x8000ee00	72	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x8000ee48	106	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x8000f0a2	744	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8000a1d8	48	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x80006d18	112	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x800205e8	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x8000d190	178	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8000e44c	128	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8000d0b4	220	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8000f4e8	476	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x80006990	302	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x80010faa	542	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x80010c98	278	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x800111c8	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x80010db0	158	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x800113bc	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8000f6c4	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x80006d88	86	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x80008f98	80	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x80012d2c	38	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80012d54	370	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x80012744	148	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x80008fe8	162	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x800111c8	500	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x80006de0	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8000e4cc	30	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80006e14	30	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8000e4ec	30	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8000a17c	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x8000a198	64	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8001226c	928	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80014e1c	1018	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x80015218	138	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8000e50c	42	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80006e34	28	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x80006e6c	126	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x8000a208	50	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8000e538	30	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x800205ec	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x8000a12a	12	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x8000a136	22	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x8000a14c	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x800120f4	376	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x80013bdc	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x800136fc	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8000cce6	342	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80006eec	172	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8000a01c	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x80007008	20	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x80015438	204	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x800114a0	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x800094b6	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x80011abc	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x80011bdc	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80011c08	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x800095a8	310	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8000e5ba	70	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x8000e600	150	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8000e698	112	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8000e77a	20	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x8000a108	12	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x8000a114	22	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x800070a8	80	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x8000eaf8	268	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x800070f8	96	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80015326	28	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8001260c	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8000c694	112	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8000ca24	270	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80013250	270	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x800071ec	128	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x8000eca4	330	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8000a280	56	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x8000a2b8	72	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8000e790	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80007300	36	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8000a300	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8000a338	70	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8000a380	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8000c87c	424	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80012628	34	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x8000a3f4	70	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x8000a43c	30	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8000a45c	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80007324	162	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8000d244	362	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8000a3c0	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x80007534	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8000cb32	436	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x80015344	148	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x80015c38	120	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x800096e0	386	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x80011d70	352	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x80009864	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x80009864	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x800098d4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x80011ed0	86	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x80015504	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x80009908	264	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x80009a10	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x80009b50	342	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8001209c	86	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x80011f28	112	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80011f98	104	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x80009ca8	484	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x80009ff8	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x80012000	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8000ce58	34	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8000d5ce	2068	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8000a050	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x800073c8	38	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x8000e7fc	38	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x80015dbc	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x80007494	64	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x800153d8	96	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x80006968	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80007568	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8000e8ac	32	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x800073f0	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8000f38c	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8000f418	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8000f3f0	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x80007414	128	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8001c274	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8001c274	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x800227e8	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x8001c568	24	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x8001c59c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8000df86	68	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x8000df2a	92	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x80014d50	130	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x8001c340	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x8001c598	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x8001c348	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x800227f0	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x8001c280	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x80013e7c	452	FUNC	<unknown>	DEFAULT	2
__decode_dotted	.symtab	0x80013c4c	400	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x80015724	478	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80014040	1838	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x80015dfc	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8001c278	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x80015cb0	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x80015554	464	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80015904	186	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x800227e0	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x800074d4	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x800227d8	4	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x80006abe	302	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x800111c8	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8001c264	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x8001c264	0	NOTYPE	<unknown>	HIDDEN	6
__get_hosts_byname_r	.symtab	0x80014dd4	50	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x80012b06	548	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8000e50c	42	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x80009e8c	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8000edf0	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8001c264	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x8001c264	0	NOTYPE	<unknown>	HIDDEN	6
__length_question	.symtab	0x80013ddc	160	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x80006cb8	96	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8000a1d8	48	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x80006990	302	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x80006d88	86	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x80015438	204	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8000e77a	20	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x800070a8	80	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x800071ec	128	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8000a280	56	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x8000a2b8	72	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x80007300	36	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8000a300	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8000a338	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80012628	34	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x800227dc	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x800073f0	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x80007414	128	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x80019f3e	16	OBJECT	<unknown>	HIDDEN	4
__malloc_alloc	.symtab	0x8000a6e8	1658	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x8000be46	592	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8000a5fc	236	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8001c48c	24	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x8002292e	888	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x8000c096	254	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x80022cb6	4	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x80022cba	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x800159c0	34	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8001482e	1314	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x800227e4	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x8001c264	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x8001c264	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x8001c584	4	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x8001c588	4	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8000de7a	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8000de70	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8000de70	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8000de70	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8000de70	10	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x800159e2	596	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x80022cae	4	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x8001c591	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x800227f8	24	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x8001c590	1	OBJECT	<unknown>	HIDDEN	9
__rtld_fini	.symtab	0x800227ec	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x80022cb2	4	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x80022cbe	4	OBJECT	<unknown>	HIDDEN	10
__set_h_errno	.symtab	0x80014e08	20	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x8000a570	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8000a5b4	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x8000a520	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8000e368	112	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8001c358	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x80012ec8	136	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8000f6ec	338	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80012f50	342	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8000fc30	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x8000768a	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4484	.symtab	0x8001918a	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x800130a8	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x800131e8	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80013104	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8000fe38	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x800077a4	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8001c35c	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_getdents64	.symtab	0x80012a84	130	FUNC	<unknown>	DEFAULT	2
__syscall_kill	.symtab	0x80006f98	112	FUNC	<unknown>	DEFAULT	2
__syscall_nanosleep	.symtab	0x8000e708	114	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x8000701c	140	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x800152a4	130	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x800126b8	138	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x8000726c	148	FUNC	<unknown>	DEFAULT	2
__syscall_wait4	.symtab	0x8000e824	136	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x8000dec0	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8000dfca	124	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8000e046	802	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8001c580	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x80006968	38	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x80009eb0	266	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x80012940	322	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x800127d8	360	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x800225f8	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x80007818	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x800228d6	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x800228fe	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x8001c488	4	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x8001264c	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x80022ca6	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x80022caa	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000790a	2310	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x8001c59c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x80022cc4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x800205e8	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x80006bec	92	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80015e30	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x800205f8	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x80007862	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x800102e4	2482	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x800205ec	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x80008814	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x8000ffd8	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_mmap	.symtab	0x8000e558	98	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x800083a4	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8000887a	1822	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x80008474	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x800084e0	736	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x800087c0	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8000de9e	34	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8000de84	26	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x80022926	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8000f840	1008	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x80007630	90	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8001c360	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x8001c364	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x80010e50	346	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x800205f4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x8001c37c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x800205f0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x8001c398	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x800076aa	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8001c394	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x8000ce7c	568	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x800100c8	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8001924f	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80010128	442	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x80008210	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x800115fc	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x8001187a	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x8000908c	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x800092c2	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x8000c50c	376	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x80006c48	112	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x80002faa	170	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x80005fac	120	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8000ce3c	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8000ce3c	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
axis_bp	.symtab	0x8001c294	4	OBJECT	<unknown>	DEFAULT	9
bb_get_chunk_with_continuation	.symtab	0x8000eeb2	496	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x80009fbc	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x800227d4	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x80012678	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8000a45c	196	FUNC	<unknown>	DEFAULT	2
buf.5403	.symtab	0x80022608	440	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x80009fdc	28	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x8001c330	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x80015e26	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x8000b5e8	382	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x8000016c	126	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x800001ea	288	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x8000030a	288	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x800074e4	78	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x8000e3d8	116	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x80006cb8	96	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x8000e8cc	292	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4531	.symtab	0x8001c59c	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x8000a1d8	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x80001670	476	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x80001994	228	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x8001c280	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x80006d18	112	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x800227e0	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x800205e8	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x8000d190	178	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8000e44c	128	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8000d0b4	220	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80019e7a	108	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8000f4e8	476	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x80006990	302	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x8000e9f0	264	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x800011ae	118	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x800205d2	4	OBJECT	<unknown>	DEFAULT	10
fdopendir	.symtab	0x8000ec04	160	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0x80001072	316	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x80000e70	514	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x80010faa	542	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x80010c98	278	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x800111c8	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x80010db0	158	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x800113bc	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x8000195c	56	FUNC	<unknown>	DEFAULT	2
fix_errno	.symtab	0x80006980	0	NOTYPE	<unknown>	DEFAULT	2
fmt	.symtab	0x80019e66	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8000f6c4	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x80006d88	86	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x80008f98	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8000c194	844	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x80012d2c	38	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x80012d2c	38	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80012d54	370	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x80012744	148	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x80008fe8	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x80004e5a	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x800013ba	56	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x80004c5a	512	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x80010c98	278	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x800111c8	500	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x80006de0	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8000e4cc	30	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80006e14	30	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8000e4ec	30	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8000a17c	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x8000a198	64	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8001226c	928	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80014e1c	1018	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x80015218	138	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8000e50c	42	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80006e34	28	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x80006e50	28	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x80006e6c	126	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x8000a208	50	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8000a23c	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8000e538	30	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x800205ec	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x8001c284	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x8001c288	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x8001c28c	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x8001c290	4	OBJECT	<unknown>	DEFAULT	9
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x80016af8	1024	OBJECT	<unknown>	DEFAULT	4
hoste.5402	.symtab	0x800227c0	20	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x8000a12a	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8000a136	22	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0x80003142	942	FUNC	<unknown>	DEFAULT	2
i.4846	.symtab	0x8001c334	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x800096e0	386	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8000a14c	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x800120f4	376	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x80013bdc	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8001375c	438	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x80013912	714	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x800136fc	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x80013360	284	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x8001347c	640	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x80004ac4	406	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x80000540	144	FUNC	<unknown>	DEFAULT	2
initstate	.symtab	0x8000c78a	136	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8000cce6	342	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80006eec	172	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8000a01c	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x80007008	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x8001c5c8	4	OBJECT	<unknown>	DEFAULT	10
last_id.5482	.symtab	0x8001c58c	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5481	.symtab	0x800227f4	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x8000184c	272	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x80015438	204	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8001c5cc	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x80004e64	1540	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x80001b30	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8000142a	118	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x80002a14	148	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8000ad62	2182	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_init_state	.symtab	0x8000bd84	194	FUNC	<unknown>	DEFAULT	2
malloc_trim	.symtab	0x8000c4e0	42	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x800114a0	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x800094b6	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x80011abc	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x80011bdc	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80011c08	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x800095a8	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8000e5ba	70	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x8000e600	150	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x8000e698	112	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8001c4a4	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x8001c4bc	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x8000e77a	20	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1305	.symtab	0x80022604	4	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x8002281c	4	OBJECT	<unknown>	DEFAULT	10
nprocessors_conf	.symtab	0x8000d4f0	222	FUNC	<unknown>	DEFAULT	2
nprocessors_onln	.symtab	0x8000d3b0	320	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8000a108	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8000a114	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8001c5c0	8	OBJECT	<unknown>	DEFAULT	10
object.4546	.symtab	0x8001c59e	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x800070a8	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x8000eaf8	268	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x80022818	4	OBJECT	<unknown>	DEFAULT	10
p.4529	.symtab	0x8001c27c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x80001224	84	FUNC	<unknown>	DEFAULT	2
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x80022824	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x800070f8	96	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x80015326	28	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x80007158	148	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4707	.symtab	0x800191af	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80000ac8	692	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8000087c	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80000996	306	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x800008c0	214	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x800034f0	5588	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x8001c588	4	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x8001c584	4	OBJECT	<unknown>	DEFAULT	9
qual_chars.4712	.symtab	0x800191c2	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8001260c	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8000c684	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x8000553c	118	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x800055b2	106	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x800007ba	194	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x800006a2	280	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x80005468	84	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x800054bc	128	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8000c694	112	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x80019daa	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8000ca24	270	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8001c4e8	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x80013250	270	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x800071ec	128	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x8000eca4	330	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8000b768	1562	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x8000a280	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x800014a0	464	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x8000a2b8	72	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5444	.symtab	0x80022810	4	OBJECT	<unknown>	DEFAULT	10
resolv_domain_to_hostname	.symtab	0x8000561c	140	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x80005cb6	56	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x80005746	1392	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x800056a8	158	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x80011f28	112	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x800024ec	876	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x8000e790	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x80022820	4	OBJECT	<unknown>	DEFAULT	10
select	.symtab	0x80007300	36	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8000a300	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x80002858	444	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8000a338	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8000a380	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8000c704	134	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8000c87c	424	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80012628	34	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x8000a3f4	70	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x8000a43c	30	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x8000a45c	196	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80007324	162	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x800147d0	94	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x80014770	96	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x8000d244	362	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x8000a3c0	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x80003054	238	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x80000dc8	168	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4711	.symtab	0x800191d6	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4706	.symtab	0x800191bb	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4708	.symtab	0x80019224	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4707	.symtab	0x80019239	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4710	.symtab	0x800191e6	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4709	.symtab	0x800191f6	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x80007534	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x8000c812	106	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x8000c812	106	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8000cb32	436	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x80015344	148	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stderr	.symtab	0x8001c354	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x8001c34c	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x8001c350	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x80015c38	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x800096e0	386	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x80011d70	352	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x80009864	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x80009864	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x800098d4	52	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x80011ed0	86	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x80015504	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x80009eb0	266	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x80009908	264	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x80009a10	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x80009b50	342	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8001209c	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x80011f28	112	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80011f98	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x80009ca8	484	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x80009ff8	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x80012000	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8000ce58	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x8000d5ce	2068	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x80000da0	40	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x80022828	174	OBJECT	<unknown>	DEFAULT	10
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x80005cf0	514	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x8001c338	4	OBJECT	<unknown>	DEFAULT	9
table_lock_val	.symtab	0x80005f2c	58	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x80005f66	70	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x80005ef2	58	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8000a050	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x8000206a	1154	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x80001a78	184	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x800073c8	38	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x8000e7fc	38	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x80006024	286	FUNC	<unknown>	DEFAULT	2
tolower	.symtab	0x80015dbc	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x80007494	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x800005d0	210	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x80019200	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x80019218	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x80001bb4	1206	FUNC	<unknown>	DEFAULT	2
uname	.symtab	0x800153d8	96	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1327	.symtab	0x80019241	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x8001c4d4	20	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x800013f2	56	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x8001c32c	4	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x8000dde4	140	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x80006324	444	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x800067f6	144	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x800068b6	64	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x80006936	48	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x800068f6	64	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x80006886	48	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x800064e0	260	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x80006742	180	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x800062c8	54	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x800065e4	122	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x80006292	54	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x800061ea	114	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x8000625c	54	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x8000665e	228	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x80006144	42	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x8000616e	124	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x800062fe	38	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x80006968	38	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x80002aa8	1282	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x80007568	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x800205e4	4	OBJECT	<unknown>	DEFAULT	10
wait4	.symtab	0x8000e8ac	32	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x800073f0	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x8000042c	276	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x8001c5bc	4	OBJECT	<unknown>	DEFAULT	10
wcrtomb	.symtab	0x8000f38c	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8000f418	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8000f3f0	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x80001278	322	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x80007414	128	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x800205d8	4	OBJECT	<unknown>	DEFAULT	10
xdigits.3400	.symtab	0x80019ee9	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x800205dc	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x800205e0	4	OBJECT	<unknown>	DEFAULT	10
zprintf	.symtab	0x80000d7c	36	FUNC	<unknown>	DEFAULT	2

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/27/24-09:15:05.186948	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35334	176.123.4.187	192.168.2.23
05/27/24-09:14:02.657876	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35326	176.123.4.187	192.168.2.23
05/27/24-09:14:49.557028	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35332	176.123.4.187	192.168.2.23
05/27/24-09:13:46.823682	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35324	176.123.4.187	192.168.2.23
05/27/24-09:14:18.297021	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35328	176.123.4.187	192.168.2.23
05/27/24-09:14:33.935290	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35330	176.123.4.187	192.168.2.23
05/27/24-09:16:39.110143	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35346	176.123.4.187	192.168.2.23
05/27/24-09:15:20.798754	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35336	176.123.4.187	192.168.2.23
05/27/24-09:15:36.423068	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35338	176.123.4.187	192.168.2.23
05/27/24-09:16:23.479243	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35344	176.123.4.187	192.168.2.23
05/27/24-09:15:52.141455	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35340	176.123.4.187	192.168.2.23
05/27/24-09:16:07.756166	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35342	176.123.4.187	192.168.2.23
05/27/24-09:13:15.530266	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35320	176.123.4.187	192.168.2.23
05/27/24-09:13:31.152726	TCP	2839489	ETPRO TROJAN ELF/BASHLITE Variant CnC Server Response	666	35322	176.123.4.187	192.168.2.23

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 09:13:14.605087042 CEST	35320	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:14.919476032 CEST	666	35320	176.123.4.187	192.168.2.23
May 27, 2024 09:13:14.919553041 CEST	35320	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:14.919986010 CEST	35320	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:14.924861908 CEST	666	35320	176.123.4.187	192.168.2.23
May 27, 2024 09:13:15.530266047 CEST	666	35320	176.123.4.187	192.168.2.23
May 27, 2024 09:13:15.530534029 CEST	666	35320	176.123.4.187	192.168.2.23
May 27, 2024 09:13:15.530677080 CEST	35320	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:15.531272888 CEST	35320	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:15.536715031 CEST	666	35320	176.123.4.187	192.168.2.23
May 27, 2024 09:13:15.856226921 CEST	43928	443	192.168.2.23	91.189.91.42
May 27, 2024 09:13:18.294394970 CEST	443	33606	54.171.230.55	192.168.2.23
May 27, 2024 09:13:18.294728994 CEST	33606	443	192.168.2.23	54.171.230.55
May 27, 2024 09:13:18.299751043 CEST	443	33606	54.171.230.55	192.168.2.23
May 27, 2024 09:13:19.439668894 CEST	42516	80	192.168.2.23	109.202.202.202
May 27, 2024 09:13:21.231549978 CEST	42836	443	192.168.2.23	91.189.91.43
May 27, 2024 09:13:30.530617952 CEST	35322	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:30.535840034 CEST	666	35322	176.123.4.187	192.168.2.23
May 27, 2024 09:13:30.536067963 CEST	35322	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:30.536844969 CEST	35322	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:30.541742086 CEST	666	35322	176.123.4.187	192.168.2.23
May 27, 2024 09:13:31.152725935 CEST	666	35322	176.123.4.187	192.168.2.23
May 27, 2024 09:13:31.152791977 CEST	666	35322	176.123.4.187	192.168.2.23
May 27, 2024 09:13:31.153052092 CEST	35322	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:31.153287888 CEST	35322	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:31.159282923 CEST	666	35322	176.123.4.187	192.168.2.23
May 27, 2024 09:13:37.101242065 CEST	43928	443	192.168.2.23	91.189.91.42
May 27, 2024 09:13:46.151856899 CEST	35324	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:46.202224970 CEST	666	35324	176.123.4.187	192.168.2.23
May 27, 2024 09:13:46.202351093 CEST	35324	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:46.202497959 CEST	35324	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:46.207377911 CEST	666	35324	176.123.4.187	192.168.2.23
May 27, 2024 09:13:46.823682070 CEST	666	35324	176.123.4.187	192.168.2.23
May 27, 2024 09:13:46.823744059 CEST	666	35324	176.123.4.187	192.168.2.23
May 27, 2024 09:13:46.824129105 CEST	35324	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:46.824129105 CEST	35324	666	192.168.2.23	176.123.4.187
May 27, 2024 09:13:46.831243038 CEST	666	35324	176.123.4.187	192.168.2.23
May 27, 2024 09:13:47.340028048 CEST	42836	443	192.168.2.23	91.189.91.43
May 27, 2024 09:13:49.387566090 CEST	42516	80	192.168.2.23	109.202.202.202
May 27, 2024 09:14:01.823116064 CEST	35326	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:01.828368902 CEST	666	35326	176.123.4.187	192.168.2.23
May 27, 2024 09:14:01.828680992 CEST	35326	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:01.828804016 CEST	35326	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:01.834007978 CEST	666	35326	176.123.4.187	192.168.2.23
May 27, 2024 09:14:02.657876015 CEST	666	35326	176.123.4.187	192.168.2.23
May 27, 2024 09:14:02.657939911 CEST	666	35326	176.123.4.187	192.168.2.23
May 27, 2024 09:14:02.657968998 CEST	666	35326	176.123.4.187	192.168.2.23
May 27, 2024 09:14:02.658303022 CEST	35326	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:02.658303022 CEST	35326	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:02.658303022 CEST	35326	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:02.663901091 CEST	666	35326	176.123.4.187	192.168.2.23
May 27, 2024 09:14:17.657301903 CEST	35328	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:17.662914991 CEST	666	35328	176.123.4.187	192.168.2.23
May 27, 2024 09:14:17.663461924 CEST	35328	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:17.663552046 CEST	35328	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:17.669575930 CEST	666	35328	176.123.4.187	192.168.2.23
May 27, 2024 09:14:18.055538893 CEST	43928	443	192.168.2.23	91.189.91.42
May 27, 2024 09:14:18.297020912 CEST	666	35328	176.123.4.187	192.168.2.23
May 27, 2024 09:14:18.297466993 CEST	35328	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:18.297689915 CEST	666	35328	176.123.4.187	192.168.2.23
May 27, 2024 09:14:18.298106909 CEST	35328	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:18.303294897 CEST	666	35328	176.123.4.187	192.168.2.23
May 27, 2024 09:14:33.297280073 CEST	35330	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:33.302717924 CEST	666	35330	176.123.4.187	192.168.2.23
May 27, 2024 09:14:33.303339005 CEST	35330	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:33.303339005 CEST	35330	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:33.308383942 CEST	666	35330	176.123.4.187	192.168.2.23
May 27, 2024 09:14:33.935290098 CEST	666	35330	176.123.4.187	192.168.2.23
May 27, 2024 09:14:33.935484886 CEST	666	35330	176.123.4.187	192.168.2.23
May 27, 2024 09:14:33.935880899 CEST	35330	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:33.935976028 CEST	35330	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:33.941168070 CEST	666	35330	176.123.4.187	192.168.2.23
May 27, 2024 09:14:38.532871008 CEST	42836	443	192.168.2.23	91.189.91.43
May 27, 2024 09:14:48.934916973 CEST	35332	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:48.940812111 CEST	666	35332	176.123.4.187	192.168.2.23
May 27, 2024 09:14:48.941375017 CEST	35332	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:48.941375017 CEST	35332	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:48.947326899 CEST	666	35332	176.123.4.187	192.168.2.23
May 27, 2024 09:14:49.557028055 CEST	666	35332	176.123.4.187	192.168.2.23
May 27, 2024 09:14:49.557360888 CEST	666	35332	176.123.4.187	192.168.2.23
May 27, 2024 09:14:49.557691097 CEST	35332	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:49.557838917 CEST	35332	666	192.168.2.23	176.123.4.187
May 27, 2024 09:14:49.562833071 CEST	666	35332	176.123.4.187	192.168.2.23
May 27, 2024 09:15:04.556767941 CEST	35334	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:04.562671900 CEST	666	35334	176.123.4.187	192.168.2.23
May 27, 2024 09:15:04.563173056 CEST	35334	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:04.563515902 CEST	35334	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:04.568797112 CEST	666	35334	176.123.4.187	192.168.2.23
May 27, 2024 09:15:05.186948061 CEST	666	35334	176.123.4.187	192.168.2.23
May 27, 2024 09:15:05.187163115 CEST	666	35334	176.123.4.187	192.168.2.23
May 27, 2024 09:15:05.187540054 CEST	35334	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:05.187942028 CEST	35334	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:05.193593025 CEST	666	35334	176.123.4.187	192.168.2.23
May 27, 2024 09:15:20.187098980 CEST	35336	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:20.192342043 CEST	666	35336	176.123.4.187	192.168.2.23
May 27, 2024 09:15:20.192826033 CEST	35336	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:20.192941904 CEST	35336	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:20.198002100 CEST	666	35336	176.123.4.187	192.168.2.23
May 27, 2024 09:15:20.798753977 CEST	666	35336	176.123.4.187	192.168.2.23
May 27, 2024 09:15:20.798973083 CEST	666	35336	176.123.4.187	192.168.2.23
May 27, 2024 09:15:20.799436092 CEST	35336	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:20.799535036 CEST	35336	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:20.807420015 CEST	666	35336	176.123.4.187	192.168.2.23
May 27, 2024 09:15:35.798573971 CEST	35338	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:35.804358959 CEST	666	35338	176.123.4.187	192.168.2.23
May 27, 2024 09:15:35.804817915 CEST	35338	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:35.804819107 CEST	35338	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:35.810139894 CEST	666	35338	176.123.4.187	192.168.2.23
May 27, 2024 09:15:36.423068047 CEST	666	35338	176.123.4.187	192.168.2.23
May 27, 2024 09:15:36.423564911 CEST	35338	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:36.423799992 CEST	666	35338	176.123.4.187	192.168.2.23
May 27, 2024 09:15:36.424345016 CEST	35338	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:36.429764032 CEST	666	35338	176.123.4.187	192.168.2.23
May 27, 2024 09:15:51.423199892 CEST	35340	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:51.512450933 CEST	666	35340	176.123.4.187	192.168.2.23
May 27, 2024 09:15:51.513288021 CEST	35340	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:51.513288975 CEST	35340	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:51.519130945 CEST	666	35340	176.123.4.187	192.168.2.23
May 27, 2024 09:15:52.141454935 CEST	666	35340	176.123.4.187	192.168.2.23
May 27, 2024 09:15:52.142168045 CEST	35340	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:52.142226934 CEST	666	35340	176.123.4.187	192.168.2.23
May 27, 2024 09:15:52.142913103 CEST	35340	666	192.168.2.23	176.123.4.187
May 27, 2024 09:15:52.148600101 CEST	666	35340	176.123.4.187	192.168.2.23
May 27, 2024 09:16:07.141627073 CEST	35342	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:07.147936106 CEST	666	35342	176.123.4.187	192.168.2.23
May 27, 2024 09:16:07.148276091 CEST	35342	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:07.148345947 CEST	35342	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:07.153753042 CEST	666	35342	176.123.4.187	192.168.2.23
May 27, 2024 09:16:07.756165981 CEST	666	35342	176.123.4.187	192.168.2.23
May 27, 2024 09:16:07.756422043 CEST	35342	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:07.756438017 CEST	666	35342	176.123.4.187	192.168.2.23
May 27, 2024 09:16:07.756532907 CEST	35342	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:07.761388063 CEST	666	35342	176.123.4.187	192.168.2.23
May 27, 2024 09:16:22.755618095 CEST	35344	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:22.869940042 CEST	666	35344	176.123.4.187	192.168.2.23
May 27, 2024 09:16:22.870584011 CEST	35344	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:22.870667934 CEST	35344	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:22.875973940 CEST	666	35344	176.123.4.187	192.168.2.23
May 27, 2024 09:16:23.479243040 CEST	666	35344	176.123.4.187	192.168.2.23
May 27, 2024 09:16:23.479681969 CEST	35344	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:23.480258942 CEST	666	35344	176.123.4.187	192.168.2.23
May 27, 2024 09:16:23.480803013 CEST	35344	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:23.486375093 CEST	666	35344	176.123.4.187	192.168.2.23
May 27, 2024 09:16:38.479907036 CEST	35346	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:38.485724926 CEST	666	35346	176.123.4.187	192.168.2.23
May 27, 2024 09:16:38.486181021 CEST	35346	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:38.486325026 CEST	35346	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:38.491413116 CEST	666	35346	176.123.4.187	192.168.2.23
May 27, 2024 09:16:39.110142946 CEST	666	35346	176.123.4.187	192.168.2.23
May 27, 2024 09:16:39.110323906 CEST	666	35346	176.123.4.187	192.168.2.23
May 27, 2024 09:16:39.110827923 CEST	35346	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:39.111008883 CEST	35346	666	192.168.2.23	176.123.4.187
May 27, 2024 09:16:39.115974903 CEST	666	35346	176.123.4.187	192.168.2.23

System Behavior

Analysis Process: s0OthAxkuM.elf PID: 6249, Parent PID: 6174

General

Start time (UTC):	07:13:13
Start date (UTC):	27/05/2024
Path:	/tmp/s0OthAxkuM.elf
Arguments:	/tmp/s0OthAxkuM.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: s0OthAxkuM.elf PID: 6252, Parent PID: 6249

General

Start time (UTC):	07:13:13
Start date (UTC):	27/05/2024
Path:	/tmp/s0OthAxkuM.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: s0OthAxkuM.elf PID: 6253, Parent PID: 6249

General

Start time (UTC):	07:13:13
Start date (UTC):	27/05/2024
Path:	/tmp/s0OthAxkuM.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: s0OthAxkuM.elf PID: 6256, Parent PID: 6253

General

Start time (UTC):	07:13:13
Start date (UTC):	27/05/2024
Path:	/tmp/s0OthAxkuM.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: dash PID: 6262, Parent PID: 4331

General

Start time (UTC):	07:13:17
Start date (UTC):	27/05/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6262, Parent PID: 4331

General

Start time (UTC):	07:13:17
Start date (UTC):	27/05/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.p3RgJauZEP /tmp/tmp.bAhgN5J8zq /tmp/tmp.1TdM82QiHF
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6263, Parent PID: 4331

General

Start time (UTC):	07:13:17
Start date (UTC):	27/05/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6263, Parent PID: 4331

General

Start time (UTC):	07:13:17
Start date (UTC):	27/05/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.p3RgJauZEP /tmp/tmp.bAhgN5J8zq /tmp/tmp.1TdM82QiHF
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report s0OthAxkuM.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.PBbP0K (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: s0OthAxkuM.elf PID: 6249, Parent PID: 6174

General

Chronological Activities

Analysis Process: s0OthAxkuM.elf PID: 6252, Parent PID: 6249

General

Chronological Activities

Analysis Process: s0OthAxkuM.elf PID: 6253, Parent PID: 6249

General

Chronological Activities

Analysis Process: s0OthAxkuM.elf PID: 6256, Parent PID: 6253

General

Analysis Process: dash PID: 6262, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6262, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6263, Parent PID: 4331

Linux Analysis Report
s0OthAxkuM.elf