Edit tour

Linux Analysis Report
qqyt33.x86.elf

Overview

General Information

Sample name:	qqyt33.x86.elf
Analysis ID:	1448457
MD5:	12eece98ef3afae965515cdd3d79db98
SHA1:	c3e599e7ff3a847b78bb2ad33e0df9b09487b9ad
SHA256:	f320fdbc806a883c3e4369ea4757d7f7bab230b61ed73cbd0cf3d2832ea19581
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448457
Start date and time:	2024-05-28 10:45:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	qqyt33.x86.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: qqyt33.x86.elf

Runtime Messages

Command:	/tmp/qqyt33.x86.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

qqyt33.x86.elf (PID: 5435, Parent: 5358, MD5: 12eece98ef3afae965515cdd3d79db98) Arguments: /tmp/qqyt33.x86.elf

qqyt33.x86.elf New Fork (PID: 5436, Parent: 5435)

qqyt33.x86.elf New Fork (PID: 5437, Parent: 5436)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
qqyt33.x86.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
qqyt33.x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
qqyt33.x86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
qqyt33.x86.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a8:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
qqyt33.x86.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5664:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
qqyt33.x86.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7ce:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
qqyt33.x86.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xdb0c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
qqyt33.x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3682:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x36e6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x37fd:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
qqyt33.x86.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf0a:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0xfbf:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1200:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
qqyt33.x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x8dd2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
qqyt33.x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5a15:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
qqyt33.x86.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6f0:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
qqyt33.x86.elf	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
qqyt33.x86.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3441:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
qqyt33.x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x5d0b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
qqyt33.x86.elf	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Click to see the 11 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5435.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a8:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5664:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7ce:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xdb0c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3682:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x36e6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x37fd:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf0a:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0xfbf:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1200:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x8dd2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5a15:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6f0:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3441:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x5d0b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5435.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5436.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5436.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x8a8:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5664:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x7ce:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xdb0c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3682:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x36e6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x37fd:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0xf0a:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0xfbf:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1200:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x8dd2:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x5a15:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x6f0:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x323:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3441:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x5d0b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5436.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x317:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
Process Memory Space: qqyt33.x86.elf PID: 5435	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: qqyt33.x86.elf PID: 5435	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3091:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3109:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x311d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3131:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3145:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3159:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x316d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3181:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3195:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x320d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3221:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: qqyt33.x86.elf PID: 5435	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3044:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x34b6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: qqyt33.x86.elf PID: 5436	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: qqyt33.x86.elf PID: 5436	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3091:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3109:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x311d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3131:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3145:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3159:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x316d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3181:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3195:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x320d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3221:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: qqyt33.x86.elf PID: 5436	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3044:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x34b6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 33 entries

Snort Signatures

ETPRO TROJAN ELF/Mirai Variant CnC Checkin - Source IP: 192.168.2.13 - Destination IP: 80.253.246.4

Timestamp:	05/28/24-10:45:53.455899
SID:	2843713
Source Port:	39388
Destination Port:	777
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: qqyt33.x86.elf

Avira: detected

Found malware configuration

Source: qqyt33.x86.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "80.253.246.4:777"}

Multi AV Scanner detection for submitted file

Source: qqyt33.x86.elf

ReversingLabs: Detection: 65%

Machine Learning detection for sample

Source: qqyt33.x86.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/qqyt33.x86.elf (PID: 5435)

Opens: /proc/net/route

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2843713 ETPRO TROJAN ELF/Mirai Variant CnC Checkin 192.168.2.13:39388 -> 80.253.246.4:777

Source: global traffic

TCP traffic: 192.168.2.13:39388 -> 80.253.246.4:777

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: qqyt33.x86.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: qqyt33.x86.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: qqyt33.x86.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: qqyt33.x86.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: qqyt33.x86.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: Process Memory Space: qqyt33.x86.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: qqyt33.x86.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: qqyt33.x86.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: qqyt33.x86.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: qqyt33.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.x86.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.x86.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.x86.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.x86.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: qqyt33.x86.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: qqyt33.x86.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qqyt33.x86.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qqyt33.x86.elf PID: 5436, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Checkin
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match	File source: qqyt33.x86.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: qqyt33.x86.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qqyt33.x86.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qqyt33.x86.elf PID: 5436, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "80.253.246.4:777"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
qqyt33.x86.elf	66%	ReversingLabs	Linux.Trojan.Mirai
qqyt33.x86.elf	100%	Avira	EXP/ELF.Mirai.Z.A
qqyt33.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	100%	URL Reputation	phishing
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
80.253.246.4:777	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	qqyt33.x86.elf	false		unknown
http://www.billybobbot.com/crawler/)	qqyt33.x86.elf	true	URL Reputation: phishing	unknown
http://fast.no/support/crawler.asp)	qqyt33.x86.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	qqyt33.x86.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	qqyt33.x86.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.253.246.4	unknown	Turkey		202505	ONLINENETTR	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	3VNm34zbc7.elf	Get hash	malicious	Mirai	Browse
	Mgij6Jzyp3.elf	Get hash	malicious	Mirai	Browse
	vOgT7Ozf3x.elf	Get hash	malicious	Mirai, Okiru	Browse
	kjW1k5ppWE.elf	Get hash	malicious	Mirai	Browse
	r0tEgU8WOn.elf	Get hash	malicious	Mirai	Browse
	hb6HIMj9J2.elf	Get hash	malicious	Mirai, Okiru	Browse
	SlVpIUg14p.elf	Get hash	malicious	Okiru	Browse
	l1U28fBk2K.elf	Get hash	malicious	Unknown	Browse
	XEAKpgXJyR.elf	Get hash	malicious	Unknown	Browse
	cmd.arm.elf	Get hash	malicious	Mirai, Moobot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	3VNm34zbc7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	w3VAiTmVg0.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	o4GYRPqvvO.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	NOvCwMdIKO.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	1gy1Nce0Kj.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	n7VzBE8J78.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	vOgT7Ozf3x.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	i0GHEh10ne.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	SlVpIUg14p.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	iwt8Lq1pyb.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONLINENETTR	W0hcKR4emh.exe	Get hash	malicious	AsyncRAT, Luna Logger, zgRAT	Browse	80.253.246.12
	Neue_Ordnung_20220712.exe	Get hash	malicious	FormBook	Browse	2.59.119.2
	Outstanding SOA.exe	Get hash	malicious	FormBook	Browse	2.59.119.2
	Linux_amd64	Get hash	malicious	Unknown	Browse	2.59.119.2
	mTUrqv2ZdZ.exe	Get hash	malicious	AsyncRAT	Browse	2.59.119.84
	http://meta-helpteams.com/case/9875154231408/	Get hash	malicious	Unknown	Browse	2.59.119.21
	https://notifications.google.com/g/p/APNL1TirmAeCyygwQxqQ4cYrz-vlkxJqotX4ApGvOIhnf5plw8E2q_X2gwM8OxvaJt_wwRTzdZzH9ToK3dqRiUwObbj835EZayDFX0Y1N7t8dgIKvjKA	Get hash	malicious	Unknown	Browse	2.59.119.21
	K8SoQjttTZ.dll	Get hash	malicious	Wannacry	Browse	80.253.246.94
	OEwNPiTklk.exe	Get hash	malicious	AsyncRAT	Browse	80.253.246.144
	8FtgrFWb8L.exe	Get hash	malicious	RedLine	Browse	2.59.119.56
CANONICAL-ASGB	3VNm34zbc7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	jJx8xXJR14.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	pOjsjNU93I.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Mgij6Jzyp3.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	3u1OQe0ELd.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vOgT7Ozf3x.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	TI2hVT11mr.elf	Get hash	malicious	PupyRAT	Browse	91.189.91.42
	testupdatas.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	kjW1k5ppWE.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	SecuriteInfo.com.ELF.Remotehack-A.30964.4562.elf	Get hash	malicious	Unknown	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.867100681177333
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	qqyt33.x86.elf
File size:	108'918 bytes
MD5:	12eece98ef3afae965515cdd3d79db98
SHA1:	c3e599e7ff3a847b78bb2ad33e0df9b09487b9ad
SHA256:	f320fdbc806a883c3e4369ea4757d7f7bab230b61ed73cbd0cf3d2832ea19581
SHA512:	95886f9086e7a4bf2c049fc1b6c27fa23f686952e21fcb969b43657e373c6f65442c863602542a31c80affe225c29452b5537445e060212739923629f6608e80
SSDEEP:	3072:oEUVxoss3+8Cbpha/+6WBhSYcCyKcm4RWaLHgb4:vubbpha/rYty1m4RWaDgb4
TLSH:	0AB34B03DA11C47AC09743B32BDFD6159A33B4F9077262067398AEE86F05689DF6D782
File Content Preview:	.ELF..............>.......@.....@........@..........@.8...@.......................@.......@.....P.......P......... .............P.......P.a.....P.a.....8)......8......... .....Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	81936
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xbf04	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40c004	0xc004	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40c020	0xc020	0x4b30	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x610b50	0x10b50	0x22fc	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x612e50	0x12e50	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x612e60	0x12e60	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x612e70	0x12e70	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x612e80	0x12e80	0x608	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x6134a0	0x13488	0x6ae8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x13488	0xb1c	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x13fa4	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x143d0	0x4380	0x18	0x0		14	249	8
.strtab	STRTAB	0x0	0x18750	0x2226	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10b50	0x10b50	6.3898	0x5	R E	0x200000	.init .text .fini .rodata
LOAD	0x10b50	0x610b50	0x610b50	0x2938	0x9438	3.5724	0x6	RW	0x200000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40c004	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40c020	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x610b50	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x612e50	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x612e60	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x612e70	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x612e80	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x6134a0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
C.1.3849	.symtab	0x410640	40	OBJECT	<unknown>	DEFAULT	4
C.53.5637	.symtab	0x40d740	208	OBJECT	<unknown>	DEFAULT	4
C.60.5739	.symtab	0x40e260	2256	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x613520	16384	OBJECT	<unknown>	DEFAULT	10
Randhex	.symtab	0x401841	385	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x4014b4	405	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x401745	252	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x403744	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x612e58	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x612e50	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x6130a8	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40ebd0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x613478	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x410850	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x6130b8	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40eed0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x612e68	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x612e60	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x610b50	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x612e48	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x6130a8	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x613478	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x6130b8	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x6130b0	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x613480	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x6130c0	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x4039e0	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x4036e0	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x408b04	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x4052f4	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x4076f4	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x40367c	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x405768	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x405784	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x405748	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x406ee4	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x406f5f	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x405304	196	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x403744	43	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x4064ac	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x406950	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x409c24	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x403770	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x407280	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x403798	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x407428	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x4079be	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x4079e9	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x4076fc	706	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x405554	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x619778	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x406ac4	95	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x407ae8	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x40367c	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x4089c0	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x4087f4	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x408b04	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x408874	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x408be4	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x407bf8	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x4037c4	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x404adc	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x409ff4	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x409ffc	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x409c50	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x409c50	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x404b14	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x408b04	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x4072ac	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x4072d0	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x4072d8	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x4072e0	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x405504	10	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x405510	65	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x409494	761	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x40b6a0	802	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x40b9c4	94	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x4072e8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x4037ec	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x4072fc	40	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x405580	41	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x407324	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x61977c	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x405478	5	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x405470	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x4054e4	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40940c	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x4054d9	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x40548c	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40a77f	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40a49f	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x406894	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x4037f4	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x4053e4	25	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x4039ac	18	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x40385c	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40bec4	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40bac8	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x408dd0	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x404c80	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x408ebc	702	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x408c60	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40917c	233	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x404cf0	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x407250	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x409ca4	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40732c	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x407354	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x405485	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x40547d	8	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x403888	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x407551	157	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40ba24	41	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x409790	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x406580	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x406783	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40a2d4	189	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x4038f4	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x407664	143	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x4055e0	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x4055ec	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40737c	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x40391c	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x40561c	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x405628	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x403948	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x405658	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x4066d8	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x4071dd	114	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x4056c0	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x4073c8	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x406b24	142	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x405690	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x4039e8	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x4067dd	183	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x40ba50	79	FUNC	<unknown>	HIDDEN	2
__GI_stat64	.symtab	0x40ba50	79	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40bef4	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x404dd0	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x409268	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x404f74	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x404f74	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x404fa0	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x408cc0	135	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40bad0	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x405080	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x40a394	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x405164	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40a248	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x409374	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x408d48	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x405230	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x4053d8	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x4093ac	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x406964	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x406964	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x406c93	560	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x405400	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x403970	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x4039c0	30	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x40baa0	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x403a80	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x4073f8	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x403978	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x407a18	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x407a6c	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x407a5c	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x403980	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x612e70	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x612e70	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x619768	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x613430	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x613488	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x406f2a	53	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x40b600	109	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x6130b0	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x613480	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x6130c0	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x619780	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x612e90	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x40a988	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40bbcc	156	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40aaa0	1853	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40bfd0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x612e80	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40bf24	162	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40bb08	193	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40bc68	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x619758	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x4039e0	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x619748	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x4036e0	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x408b04	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x612e4c	0	NOTYPE	<unknown>	HIDDEN	5
__fini_array_start	.symtab	0x612e4c	0	NOTYPE	<unknown>	HIDDEN	5
__get_hosts_byname_r	.symtab	0x40b670	48	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x409ed4	288	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x409ed4	288	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x4072e8	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x4052f4	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x4076f4	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x612e4c	0	NOTYPE	<unknown>	HIDDEN	5
__init_array_start	.symtab	0x612e4c	0	NOTYPE	<unknown>	HIDDEN	5
__libc_close	.symtab	0x403798	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x405554	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x40367c	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x4037c4	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40bec4	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40bac8	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x407354	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x403888	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x4038f4	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x4055e0	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x4055ec	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x40391c	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x40561c	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x405628	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x4071dd	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x619750	8	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x403978	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x403980	42	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x410830	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x406136	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x4057a4	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x6132f0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x619880	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x4060a0	150	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x619f78	8	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x619f80	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40bcb8	10	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40b235	968	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x619760	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x612e4c	0	NOTYPE	<unknown>	HIDDEN	5
__preinit_array_start	.symtab	0x612e4c	0	NOTYPE	<unknown>	HIDDEN	5
__progname	.symtab	0x613460	8	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x613468	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x406ec7	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x406ec4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x406ec4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x406ec4	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x406ec4	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x40bcc2	511	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x619f68	8	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x613475	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x619790	40	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x613474	1	OBJECT	<unknown>	HIDDEN	9
__restore_rt	.symtab	0x4071d4	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x619770	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x619f70	8	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x619f84	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x405768	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x405784	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x405748	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x6130e8	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40a0e0	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x407c04	171	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40a11c	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x407ee4	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x403b9f	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4920	.symtab	0x40f1d0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40a1a0	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40a224	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40a1c8	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x407fe8	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x403c38	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x6130f0	8	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x406ee4	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x406f5f	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x406f99	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x613458	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x405304	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x409d7c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x409cd0	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x409e28	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x619530	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x403c60	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x6197d0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x619820	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x6132e0	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x409c0c	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x619f58	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x619f60	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x613488	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x619f88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x619778	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x403744	43	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40c004	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x617530	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x403cad	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x4081d4	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x61977c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x408080	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x4043dc	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x404676	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x404450	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x404494	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x404648	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x406ed2	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x406eca	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x619870	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x407cb0	563	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x403b40	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x6130f8	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x613100	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x4088e8	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x617524	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x613130	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x617520	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x613160	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x403bae	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x613158	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x406970	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x4080d8	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40f2d0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x408108	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x403d25	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x4064ac	200	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x406950	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x4053c8	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x619740	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x409c24	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x4056c0	133	FUNC	<unknown>	DEFAULT	2
buf.3312	.symtab	0x619550	16	OBJECT	<unknown>	DEFAULT	10
buf.5843	.symtab	0x619560	448	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x404ba0	210	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x61309c	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x4097a4	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x403770	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x407280	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x403798	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x407428	147	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x612ea0	8	OBJECT	<unknown>	DEFAULT	9
completed.5156	.symtab	0x6134a0	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x405554	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4010c3	582	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x613098	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x612e90	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x612ea8	8	OBJECT	<unknown>	DEFAULT	9
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x619758	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x619778	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x406ac4	95	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x410690	208	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x407ae8	269	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x40367c	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x4074bc	149	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x400323	130	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x4075ee	115	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x4089c0	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x4087f4	128	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x408b04	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x408874	116	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x408be4	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x410670	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x407bf8	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4037c4	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x404adc	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x4062cd	451	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x409ff4	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x409ff4	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x409ffc	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x409c50	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x409c50	82	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x404b14	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x4026b9	11	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x400e44	65	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x4003a5	485	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x4002f4	47	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x4087f4	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x408b04	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x4072ac	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x4072d0	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x4072d8	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x4072e0	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x405504	10	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x405510	65	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x409494	761	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x40b6a0	802	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x40b9c4	94	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x4072e8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x4037ec	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x4072fc	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x4072fc	40	FUNC	<unknown>	DEFAULT	2
getsockname	.symtab	0x405580	41	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x4055ac	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x407324	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x61977c	4	OBJECT	<unknown>	DEFAULT	10
hoste.5842	.symtab	0x619720	32	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x405478	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x405470	8	FUNC	<unknown>	DEFAULT	2
i.4975	.symtab	0x6130a0	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x404dd0	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x4054e4	29	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40940c	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x4054d9	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x40548c	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40a77f	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40a68c	243	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40a49f	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40a418	135	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x403077	296	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001c0	126	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x406622	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x406894	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x4037f4	101	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x4053e4	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x4039ac	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x40385c	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5904	.symtab	0x613470	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5903	.symtab	0x619788	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x401309	211	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40bec4	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40bac8	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x613510	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x40319f	1243	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x613500	4	OBJECT	<unknown>	DEFAULT	10
malloc	.symtab	0x405812	2187	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x406490	28	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x408dd0	236	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x404c80	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x408ebc	702	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x408c60	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x40917c	233	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x404cf0	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x407250	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x409ca4	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x40732c	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x613320	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x613350	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x407354	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1699	.symtab	0x619540	8	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x406bb4	223	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x405485	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x40547d	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x613508	8	OBJECT	<unknown>	DEFAULT	10
object.5168	.symtab	0x6134c0	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x403888	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x407551	157	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x6197c0	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0x4019c2	3319	FUNC	<unknown>	DEFAULT	2
p.5154	.symtab	0x612e88	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x6197c8	8	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x40ba24	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5143	.symtab	0x40f208	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x4008b3	1084	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400640	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x400772	321	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x40068b	231	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x4026c4	2483	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x613468	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x613460	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5150	.symtab	0x40f220	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x409790	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x406574	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40023e	182	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x406580	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x40fe30	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x406783	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x6133b0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40a2d4	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x4038f4	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x407664	143	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40989c	878	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x4055e0	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x400e85	574	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x4055ec	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5885	.symtab	0x6197b8	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x409374	53	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x40737c	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x40391c	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x40561c	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x405628	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x403948	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x405658	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x4065c8	90	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x4066d8	171	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x4071dd	114	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x4056c0	133	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x4073c8	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x40b209	44	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x40b1e0	41	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x406b24	142	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x405690	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x4013dc	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x400cef	341	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5149	.symtab	0x40f240	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5142	.symtab	0x40f214	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5146	.symtab	0x40f2a0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5145	.symtab	0x40f2b8	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5148	.symtab	0x40f250	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5147	.symtab	0x40f260	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x4039e8	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x406690	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x406690	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x4067dd	183	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x40ba50	79	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stat64	.symtab	0x40ba50	79	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x6130e0	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x6130d0	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x6130d8	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40bef4	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x404dd0	417	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x409268	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x404f74	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x404f74	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x404fa0	213	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x408cc0	135	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40bad0	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x405304	196	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x405080	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x40a394	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x405164	201	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40a248	140	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x409374	53	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x408d48	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x405230	193	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x406964	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x4053d8	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x4093ac	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x406964	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x406964	10	FUNC	<unknown>	DEFAULT	2
strtoq	.symtab	0x406964	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x406c93	560	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x405400	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x403970	8	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x4039c0	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x40058a	182	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x40f270	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40f288	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x40baa0	38	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1721	.symtab	0x40f2c0	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x613380	40	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x612ec0	472	OBJECT	<unknown>	DEFAULT	9
vsnprintf	.symtab	0x403a80	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x4073f8	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x403978	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x407a18	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x407a6c	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x407a5c	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x403980	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3743	.symtab	0x4107c0	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x401649	252	FUNC	<unknown>	DEFAULT	2

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/28/24-10:45:53.455899	TCP	2843713	ETPRO TROJAN ELF/Mirai Variant CnC Checkin	39388	777	192.168.2.13	80.253.246.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 10:45:53.450918913 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:45:53.455809116 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:45:53.455867052 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:45:53.455899000 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:45:53.461133003 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:46:05.679652929 CEST	48202	443	192.168.2.13	185.125.190.26
May 28, 2024 10:46:10.945540905 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:46:10.945820093 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:46:11.113590956 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:46:11.113825083 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:46:36.912444115 CEST	48202	443	192.168.2.13	185.125.190.26
May 28, 2024 10:47:10.959997892 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:47:10.960233927 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:47:11.129496098 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:47:11.129659891 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:48:10.969306946 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:48:10.969759941 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:48:11.145207882 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:48:11.145514011 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:49:10.979520082 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:49:10.979744911 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:49:11.144742012 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:49:11.145119905 CEST	39388	777	192.168.2.13	80.253.246.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 10:48:39.646287918 CEST	35372	53	192.168.2.13	8.8.8.8
May 28, 2024 10:48:39.646343946 CEST	57550	53	192.168.2.13	8.8.8.8
May 28, 2024 10:48:39.652795076 CEST	53	35372	8.8.8.8	192.168.2.13
May 28, 2024 10:48:39.654819965 CEST	53	57550	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 28, 2024 10:48:39.646287918 CEST	192.168.2.13	8.8.8.8	0x22ce	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
May 28, 2024 10:48:39.646343946 CEST	192.168.2.13	8.8.8.8	0xaf86	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 28, 2024 10:48:39.652795076 CEST	8.8.8.8	192.168.2.13	0x22ce	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
May 28, 2024 10:48:39.652795076 CEST	8.8.8.8	192.168.2.13	0x22ce	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: qqyt33.x86.elf PID: 5435, Parent PID: 5358

General

Start time (UTC):	08:45:52
Start date (UTC):	28/05/2024
Path:	/tmp/qqyt33.x86.elf
Arguments:	/tmp/qqyt33.x86.elf
File size:	108918 bytes
MD5 hash:	12eece98ef3afae965515cdd3d79db98

Chronological Activities

Analysis Process: qqyt33.x86.elf PID: 5436, Parent PID: 5435

General

Start time (UTC):	08:45:52
Start date (UTC):	28/05/2024
Path:	/tmp/qqyt33.x86.elf
Arguments:	-
File size:	108918 bytes
MD5 hash:	12eece98ef3afae965515cdd3d79db98

Chronological Activities

Analysis Process: qqyt33.x86.elf PID: 5437, Parent PID: 5436

General

Start time (UTC):	08:45:52
Start date (UTC):	28/05/2024
Path:	/tmp/qqyt33.x86.elf
Arguments:	-
File size:	108918 bytes
MD5 hash:	12eece98ef3afae965515cdd3d79db98

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report qqyt33.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: qqyt33.x86.elf PID: 5435, Parent PID: 5358

General

Chronological Activities

Analysis Process: qqyt33.x86.elf PID: 5436, Parent PID: 5435

General

Chronological Activities

Analysis Process: qqyt33.x86.elf PID: 5437, Parent PID: 5436

General

Linux Analysis Report
qqyt33.x86.elf