Edit tour

Linux Analysis Report
qqyt33.i586.elf

Overview

General Information

Sample name:	qqyt33.i586.elf
Analysis ID:	1448464
MD5:	f93ec1d5e3aba4a238a062638628094e
SHA1:	8c509d166f1e7ffb6bbbe7aa0b414c23cefc816f
SHA256:	afb90bfc1a6664682a57c4d5e77ab8f38f50e50db631214c6a6a581dd473bcd2
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448464
Start date and time:	2024-05-28 10:53:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	qqyt33.i586.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/qqyt33.i586.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

qqyt33.i586.elf (PID: 5435, Parent: 5357, MD5: f93ec1d5e3aba4a238a062638628094e) Arguments: /tmp/qqyt33.i586.elf

qqyt33.i586.elf New Fork (PID: 5436, Parent: 5435)

qqyt33.i586.elf New Fork (PID: 5437, Parent: 5436)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
qqyt33.i586.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
qqyt33.i586.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
qqyt33.i586.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc8a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
qqyt33.i586.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7eb:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
qqyt33.i586.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc6c0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
qqyt33.i586.elf	Linux_Trojan_Gafgyt_e6d75e6f	unknown	unknown	0x632e:$a: 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00
qqyt33.i586.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x888:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
qqyt33.i586.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x45bb:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
qqyt33.i586.elf	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x8a25:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5435.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc8a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5435.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7eb:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5435.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc6c0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5435.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_e6d75e6f	unknown	unknown	0x632e:$a: 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00
5435.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x888:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5435.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x45bb:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5435.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x8a25:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
5436.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5436.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5436.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc8a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5436.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7eb:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5436.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc6c0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5436.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_e6d75e6f	unknown	unknown	0x632e:$a: 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00
5436.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x888:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5436.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x45bb:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5436.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x8a25:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
Process Memory Space: qqyt33.i586.elf PID: 5435	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: qqyt33.i586.elf PID: 5435	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2e89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2eb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2eed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: qqyt33.i586.elf PID: 5435	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2e3c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x32ae:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: qqyt33.i586.elf PID: 5436	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: qqyt33.i586.elf PID: 5436	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: qqyt33.i586.elf PID: 5436	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2e23:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3295:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 19 entries

Snort Signatures

ETPRO TROJAN ELF/Mirai Variant CnC Checkin - Source IP: 192.168.2.13 - Destination IP: 80.253.246.4

Timestamp:	05/28/24-10:54:40.983548
SID:	2843713
Source Port:	39388
Destination Port:	777
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: qqyt33.i586.elf

Avira: detected

Found malware configuration

Source: qqyt33.i586.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "80.253.246.4:777"}

Multi AV Scanner detection for submitted file

Source: qqyt33.i586.elf	ReversingLabs: Detection: 68%
Source: qqyt33.i586.elf	Virustotal: Detection: 62%			Perma Link

Machine Learning detection for sample

Source: qqyt33.i586.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/qqyt33.i586.elf (PID: 5435)

Opens: /proc/net/route

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2843713 ETPRO TROJAN ELF/Mirai Variant CnC Checkin 192.168.2.13:39388 -> 80.253.246.4:777

Source: global traffic

TCP traffic: 192.168.2.13:39388 -> 80.253.246.4:777

Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	TCP traffic detected without corresponding DNS query: 80.253.246.4
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: qqyt33.i586.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: qqyt33.i586.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: qqyt33.i586.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: qqyt33.i586.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: qqyt33.i586.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f Author: unknown
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f Author: unknown
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f Author: unknown
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: Process Memory Space: qqyt33.i586.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: qqyt33.i586.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: qqyt33.i586.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: qqyt33.i586.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f reference_sample = 48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c, id = e6d75e6f-aa04-4767-8730-6909958044a7, last_modified = 2021-09-16
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: qqyt33.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f reference_sample = 48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c, id = e6d75e6f-aa04-4767-8730-6909958044a7, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f reference_sample = 48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c, id = e6d75e6f-aa04-4767-8730-6909958044a7, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.i586.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.i586.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.i586.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: qqyt33.i586.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: qqyt33.i586.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: qqyt33.i586.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qqyt33.i586.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qqyt33.i586.elf PID: 5436, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Checkin
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match	File source: qqyt33.i586.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: qqyt33.i586.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qqyt33.i586.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qqyt33.i586.elf PID: 5436, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "80.253.246.4:777"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
qqyt33.i586.elf	68%	ReversingLabs	Linux.Trojan.Mirai
qqyt33.i586.elf	63%	Virustotal		Browse
qqyt33.i586.elf	100%	Avira	EXP/ELF.Mirai.Z.A
qqyt33.i586.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
daisy.ubuntu.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	100%	URL Reputation	phishing
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
80.253.246.4:777	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	qqyt33.i586.elf	false		unknown
http://www.billybobbot.com/crawler/)	qqyt33.i586.elf	true	URL Reputation: phishing	unknown
http://fast.no/support/crawler.asp)	qqyt33.i586.elf	false	URL Reputation: safe URL Reputation: safe	unknown
http://feedback.redkolibri.com/	qqyt33.i586.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	qqyt33.i586.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.253.246.4	unknown	Turkey		202505	ONLINENETTR	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
80.253.246.4	qqyt33.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	qqyt33.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	qqyt33.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	qqyt33.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	qqyt33.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	qqyt33.x32.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	qqyt33.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	qqyt33.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	qqyt33.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	qqyt33.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	qqyt33.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	qqyt33.x32.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	qqyt33.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	3VNm34zbc7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	w3VAiTmVg0.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	o4GYRPqvvO.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	NOvCwMdIKO.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONLINENETTR	qqyt33.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	80.253.246.4
	qqyt33.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	80.253.246.4
	qqyt33.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	80.253.246.4
	qqyt33.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	80.253.246.4
	qqyt33.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	80.253.246.4
	qqyt33.x32.elf	Get hash	malicious	Mirai, Gafgyt	Browse	80.253.246.4
	qqyt33.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	80.253.246.4
	W0hcKR4emh.exe	Get hash	malicious	AsyncRAT, Luna Logger, zgRAT	Browse	80.253.246.12
	Neue_Ordnung_20220712.exe	Get hash	malicious	FormBook	Browse	2.59.119.2
	Outstanding SOA.exe	Get hash	malicious	FormBook	Browse	2.59.119.2

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.443648626026292
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	qqyt33.i586.elf
File size:	91'272 bytes
MD5:	f93ec1d5e3aba4a238a062638628094e
SHA1:	8c509d166f1e7ffb6bbbe7aa0b414c23cefc816f
SHA256:	afb90bfc1a6664682a57c4d5e77ab8f38f50e50db631214c6a6a581dd473bcd2
SHA512:	e7edb2af8b956a33328dbf68cbeabea107437d4da6bbd58ba8eb5ac8bfe010daf40c0affaa573b5459979e682145bc01d3889ffbe075ffdd53d0e16bb70408e8
SSDEEP:	1536:ZxfCQUQm1BFojRajZYm2jZIqK9XUnT5MHDG+mO5hHllCI9zmQ0AlV6ESYrr9:ZxfBUQm1v9jWjZ69kGHDG+mO5hHl0mzt
TLSH:	7F935A8EA391C173C4831A7502E7AB220533E9E31B5B5E06E37C2EF46F1A5893167F95
File Content Preview:	.ELF........................4...........4. ...(..............................................p...p.......z...................v...v..................Q.td............................U..S.......c....h........[]...$.............U......=.y...t..5....Dv.....Dv.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048184
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	67488
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80480b4	0xb4	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480d0	0xd0	0xabe8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8052cb8	0xacb8	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8052ce0	0xace0	0x40f4	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8057000	0xf000	0x60c	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x805760c	0xf60c	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x805760c	0xf60c	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8057614	0xf614	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x805761c	0xf61c	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8057620	0xf620	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8057640	0xf640	0x348	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x80579a0	0xf988	0x712c	0x0	0x3	WA	0	0	32
.stab	PROGBITS	0x0	0xf988	0x138	0xc	0x0		14	0	4
.stabstr	STRTAB	0x0	0xfac0	0xf6	0x0	0x0		0	0	1
.comment	PROGBITS	0x0	0xfbb6	0xb64	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1071a	0x84	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x10a98	0x32d0	0x10	0x0		18	316	4
.strtab	STRTAB	0x0	0x13d68	0x2720	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xedd4	0xedd4	6.7168	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xf000	0x8057000	0x8057000	0x988	0x7acc	4.8205	0x6	RW	0x1000	.eh_frame .tbss .ctors .dtors .jcr .got.plt .data .bss
TLS	0xf60c	0x805760c	0x805760c	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80480b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8052cb8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8052ce0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8057000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x805760c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805760c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8057614	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x805761c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8057620	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8057640	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x80579a0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.11.5136	.symtab	0x8056930	24	OBJECT	<unknown>	DEFAULT	4
C.70.5422	.symtab	0x8054360	104	OBJECT	<unknown>	DEFAULT	4
C.77.5521	.symtab	0x8054e00	1128	OBJECT	<unknown>	DEFAULT	4
POPBX1	.symtab	0x804dc9f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x804dcff	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x804dd5f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x804ddbf	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x804dc8b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x804dceb	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x804dd4b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x804ddab	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x80579e0	16384	OBJECT	<unknown>	DEFAULT	12
RESTBX1	.symtab	0x804dc49	0	NOTYPE	<unknown>	DEFAULT	2
Randhex	.symtab	0x8049409	368	FUNC	<unknown>	DEFAULT	2
SAVEBX1	.symtab	0x804dc3c	0	NOTYPE	<unknown>	DEFAULT	2
SendSTD	.symtab	0x80490a9	358	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x804930c	253	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x804ad00	66	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8057620	0	OBJECT	<unknown>	HIDDEN	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_L_lock_103	.symtab	0x804ec42	16	FUNC	<unknown>	DEFAULT	2
_L_lock_12	.symtab	0x804fd7b	16	FUNC	<unknown>	DEFAULT	2
_L_lock_140	.symtab	0x804fdbb	16	FUNC	<unknown>	DEFAULT	2
_L_lock_160	.symtab	0x804fddb	16	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x804fa66	10	FUNC	<unknown>	DEFAULT	2
_L_lock_18	.symtab	0x804ec08	13	FUNC	<unknown>	DEFAULT	2
_L_lock_191	.symtab	0x804fdfb	13	FUNC	<unknown>	DEFAULT	2
_L_lock_198	.symtab	0x804ef10	16	FUNC	<unknown>	DEFAULT	2
_L_lock_209	.symtab	0x804ef20	16	FUNC	<unknown>	DEFAULT	2
_L_lock_27	.symtab	0x804dab0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_29	.symtab	0x804fd8b	16	FUNC	<unknown>	DEFAULT	2
_L_lock_32	.symtab	0x804f9d9	10	FUNC	<unknown>	DEFAULT	2
_L_lock_34	.symtab	0x8050fda	13	FUNC	<unknown>	DEFAULT	2
_L_lock_54	.symtab	0x804ec15	16	FUNC	<unknown>	DEFAULT	2
_L_lock_70	.symtab	0x804d9b0	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_101	.symtab	0x8050fe7	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_102	.symtab	0x804fdab	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_113	.symtab	0x804ec52	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_152	.symtab	0x804fdcb	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_167	.symtab	0x804d9c0	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_170	.symtab	0x804fdeb	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_225	.symtab	0x804ef30	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_232	.symtab	0x804fe08	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_235	.symtab	0x804ef3d	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_40	.symtab	0x804fa70	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_61	.symtab	0x804f9e3	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_66	.symtab	0x804ec25	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_83	.symtab	0x804ec35	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_86	.symtab	0x804fd9b	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_90	.symtab	0x804dac0	13	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8057610	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x805760c	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x8057778	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8055300	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8057980	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8056ad4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8057780	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8055600	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8057618	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x8057614	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x8057000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8057608	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8057778	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_tolower	.symtab	0x8057980	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_toupper	.symtab	0x8057780	4	OBJECT	<unknown>	HIDDEN	11
__GI___close	.symtab	0x804dc30	80	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x804dc3a	27	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x805777c	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_tolower	.symtab	0x8057984	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_toupper	.symtab	0x8057784	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x804af30	13	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x804ac14	83	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x804fe18	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x804bee0	26	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x804dc30	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804ac67	153	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x804dc80	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x804dd40	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid	.symtab	0x804dda0	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x804dce0	91	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x804dc80	91	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x804dc8a	33	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x804dd40	91	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x804dd4a	33	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x804d9ed	195	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x804c36c	32	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x804c38c	32	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x804c348	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x804ded3	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x804df37	39	FUNC	<unknown>	HIDDEN	2
__GI___waitpid	.symtab	0x804dda0	91	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x804dce0	91	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x804dcea	33	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x804befc	191	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804ad00	66	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x804cf00	191	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x804d330	17	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8050bd4	44	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804ad44	39	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804dc30	80	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x804e46c	130	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x804e956	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x804e982	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x804e6ec	618	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804c0f4	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x804d474	93	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x804ea8c	380	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804ac67	153	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x804fbbc	447	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x804f948	145	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x804fe18	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x804f9f0	118	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x804fee4	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x804ec60	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804d7a4	524	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804bc90	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8050ecc	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8050ee4	246	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8050c00	70	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804bcc0	111	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x804fe18	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804e2b4	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x804e2d4	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x804e2dc	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x804e2e4	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x804c0a8	14	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x804c0b8	57	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8050238	666	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80523cc	684	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x8052678	89	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x804e2ec	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804dad0	49	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x804e300	43	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804c148	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x804e32c	8	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x804c00c	7	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x804c000	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x804c088	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80501a4	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x804c074	17	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x804c028	76	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8051596	432	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x80512e3	459	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x804d1f3	155	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804ad6c	139	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8050128	27	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x804aefc	17	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804adf8	43	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x80527bc	90	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804bd30	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x804ff44	37	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x805124c	30	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x804ffa4	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804bd5c	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x804e234	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x8050c48	59	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x804e334	43	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x804e389	61	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x804c01f	7	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x804c013	12	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804dc80	91	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x804e578	132	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8052701	72	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x804db04	100	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x804cfc8	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x804d0f4	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8051210	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804dd40	91	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x804e668	129	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804c1a8	92	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x804e3c8	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804ae5d	108	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804c204	92	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804aecc	31	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804c260	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x804d28e	161	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x804e1bf	80	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804c2c0	136	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804e408	97	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x804db68	195	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804c298	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804af40	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x804d153	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x805274c	70	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8052bcc	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804bd90	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x804ff6c	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x804bdb0	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x804bdb0	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804bdd0	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x8050058	45	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8052818	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804bdec	19	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8051224	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804be00	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8050104	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x804ff88	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8050088	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804be18	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804bfe8	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x80500b4	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x804d344	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x804d598	523	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8050144	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804aeec	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804af10	29	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x8052794	39	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804af60	172	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804dda0	91	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x804e9b0	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x804ea0c	128	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x804e9f0	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804dce0	91	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x805761c	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x805761c	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x805c128	4	OBJECT	<unknown>	HIDDEN	12
__atexit_lock	.symtab	0x8057868	24	OBJECT	<unknown>	DEFAULT	11
__bss_start	.symtab	0x8057988	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x804df0b	44	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x804dc30	80	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x8052340	96	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x804dc3a	27	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x805777c	4	OBJECT	<unknown>	DEFAULT	11
__ctype_tolower	.symtab	0x8057984	4	OBJECT	<unknown>	DEFAULT	11
__ctype_toupper	.symtab	0x8057784	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x805e68c	4	OBJECT	<unknown>	HIDDEN	12
__data_start	.symtab	0x8057648	0	NOTYPE	<unknown>	DEFAULT	11
__decode_dotted	.symtab	0x8051748	259	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8052900	166	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x805184c	1842	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8052c90	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8057640	0	OBJECT	<unknown>	HIDDEN	11
__encode_dotted	.symtab	0x8052c04	130	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8052848	182	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80529a8	82	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805c120	4	OBJECT	<unknown>	DEFAULT	12
__errno_location	.symtab	0x804af30	13	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805bbd0	4	OBJECT	<unknown>	HIDDEN	12
__fcntl_nocancel	.symtab	0x804ac14	83	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x804fe18	204	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x805760c	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x805760c	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x804d7a4	524	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x805ea88	4	OBJECT	<unknown>	HIDDEN	12
__fork_handlers	.symtab	0x805ea8c	4	OBJECT	<unknown>	HIDDEN	12
__fork_lock	.symtab	0x805bbd4	4	OBJECT	<unknown>	HIDDEN	12
__get_hosts_byname_r	.symtab	0x80523a0	41	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480d0	0	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x8050db4	280	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x804e2ec	19	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x804dad0	49	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x804bee0	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x805760c	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x805760c	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x804dc30	80	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804c0f4	84	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x804ddfc	86	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x804de52	79	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x804ac67	153	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804d7a4	524	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x804e389	61	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804dc80	91	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804dd40	91	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804c1a8	92	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804ae5d	108	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804c204	92	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x805096a	513	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x804e1bf	80	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805c11c	4	OBJECT	<unknown>	DEFAULT	12
__libc_waitpid	.symtab	0x804dda0	91	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804dce0	91	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x804d9d0	29	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x80508c0	40	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private	.symtab	0x80508f0	32	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x8056ab4	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x804cbd9	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804c3ac	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x805778c	24	OBJECT	<unknown>	DEFAULT	11
__malloc_state	.symtab	0x805e710	888	OBJECT	<unknown>	DEFAULT	12
__malloc_trim	.symtab	0x804cb5c	125	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805eac0	4	OBJECT	<unknown>	HIDDEN	12
__nameservers	.symtab	0x805eac4	4	OBJECT	<unknown>	HIDDEN	12
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x804dc80	91	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x80529fc	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8051fd3	876	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x804dc8a	33	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x805c124	4	OBJECT	<unknown>	DEFAULT	12
__preinit_array_end	.symtab	0x805760c	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x805760c	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x8057884	4	OBJECT	<unknown>	DEFAULT	11
__progname_full	.symtab	0x8057888	4	OBJECT	<unknown>	DEFAULT	11
__pthread_initialize_minimal	.symtab	0x8050b6b	15	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x804dea7	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x804dea4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x804dea4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x804dea4	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x804dea4	3	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x804dd40	91	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x8052a08	451	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x804dd4a	33	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x804d9ed	195	FUNC	<unknown>	DEFAULT	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x805eab8	4	OBJECT	<unknown>	HIDDEN	12
__resolv_attempts	.symtab	0x805797d	1	OBJECT	<unknown>	HIDDEN	11
__resolv_lock	.symtab	0x805e694	24	OBJECT	<unknown>	DEFAULT	12
__resolv_timeout	.symtab	0x805797c	1	OBJECT	<unknown>	HIDDEN	11
__restore	.symtab	0x804e1b7	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x804e1b0	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805c12c	4	OBJECT	<unknown>	HIDDEN	12
__searchdomain	.symtab	0x805eabc	4	OBJECT	<unknown>	HIDDEN	12
__searchdomains	.symtab	0x805eac8	4	OBJECT	<unknown>	HIDDEN	12
__sigaddset	.symtab	0x804c36c	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804c38c	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804c348	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x804e250	43	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8057898	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x8050ff4	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8051034	139	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80510c0	154	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x804ef4c	232	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x805115c	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80511e0	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8051184	92	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x804f140	154	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804f1dc	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x805789c	4	OBJECT	<unknown>	DEFAULT	11
__syscall_error	.symtab	0x804e1a0	15	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x804e360	41	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x80526d4	45	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x804e27c	53	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x804ae24	57	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x804ded3	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x804df37	39	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x804df5e	577	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8057880	4	OBJECT	<unknown>	HIDDEN	11
__waitpid	.symtab	0x804dda0	91	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel	.symtab	0x804ddaa	33	FUNC	<unknown>	DEFAULT	2
__write	.symtab	0x804dce0	91	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x804dcea	33	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x804befc	191	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x8050d27	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x8050c84	163	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x805b9e0	10	OBJECT	<unknown>	DEFAULT	12
_charpad	.symtab	0x804b00c	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x805e6b8	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_handler	.symtab	0x805e6e0	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_spec	.symtab	0x8057788	4	OBJECT	<unknown>	HIDDEN	11
_dl_aux_init	.symtab	0x8050b7c	18	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x8057974	4	OBJECT	<unknown>	DEFAULT	11
_dl_nothread_init_static_tls	.symtab	0x8050b8e	68	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x805eab0	4	OBJECT	<unknown>	DEFAULT	12
_dl_phnum	.symtab	0x805eab4	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_gaps	.symtab	0x805eaa4	1	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_slotinfo_list	.symtab	0x805eaa0	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_generation	.symtab	0x805eaa8	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_max_dtv_idx	.symtab	0x805ea98	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_setup	.symtab	0x805093a	48	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x805ea94	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_nelem	.symtab	0x805eaac	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_size	.symtab	0x805ea9c	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_used	.symtab	0x805ea90	4	OBJECT	<unknown>	DEFAULT	12
_edata	.symtab	0x8057988	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805eacc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x804ad00	66	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8052cb8	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x805c150	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804b041	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x804f380	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80480b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x804f204	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x804b69c	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804b881	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804b704	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804b740	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804b858	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x804debc	23	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x804deaa	18	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x804e210	34	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x805e708	8	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x8048184	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x804ec78	664	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804f034	59	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80578a0	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x805c130	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x804fa7c	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x805c14c	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_del_lock	.symtab	0x805c13c	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x805c148	4	OBJECT	<unknown>	DEFAULT	12
_stdio_streams	.symtab	0x80578a8	204	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x804f06f	208	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80578a4	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l	.symtab	0x804d35c	278	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x804f25c	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x80559b8	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x804f29c	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804b09f	1530	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x804cf00	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x804d330	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x804d330	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x804bfbc	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805bbcc	1	OBJECT	<unknown>	DEFAULT	12
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8050bd4	44	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804c2c0	136	FUNC	<unknown>	DEFAULT	2
buf.4562	.symtab	0x805b9f0	16	OBJECT	<unknown>	DEFAULT	12
buf.6699	.symtab	0x805ba00	440	OBJECT	<unknown>	DEFAULT	12
bzero	.symtab	0x804bfd4	19	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x8057770	4	OBJECT	<unknown>	DEFAULT	11
calloc	.symtab	0x80504d4	236	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x804ad44	39	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804dc30	80	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x804e46c	130	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x8057660	4	OBJECT	<unknown>	DEFAULT	11
completed.4963	.symtab	0x80579a0	1	OBJECT	<unknown>	DEFAULT	12
connect	.symtab	0x804c0f4	84	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048cec	459	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x805776c	4	OBJECT	<unknown>	DEFAULT	11
data_start	.symtab	0x8057648	0	NOTYPE	<unknown>	DEFAULT	11
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x8057664	4	OBJECT	<unknown>	DEFAULT	11
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805c120	4	OBJECT	<unknown>	DEFAULT	12
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x804d474	93	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8056970	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x804ea8c	380	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804ac67	153	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x804e4f0	136	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8048305	104	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x804e5fc	108	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x804fbbc	447	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x804f948	145	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x804fe18	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x804f9f0	118	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x804fee4	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x8056950	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x804ec60	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804d7a4	524	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x805bbd8	1348	OBJECT	<unknown>	DEFAULT	12
fputs_unlocked	.symtab	0x804bc90	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804cd54	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8050ecc	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8050ecc	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8050ee4	246	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8050c00	70	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x804bcc0	111	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x8049bb9	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048b20	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804836d	508	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x80482d5	48	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x804f948	145	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x804fe18	204	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x804e2b4	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x804e2d4	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x804e2dc	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x804e2e4	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x804c0a8	14	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x804c0b8	57	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8050238	666	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80523cc	684	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x8052678	89	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x804e2ec	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804dad0	49	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x804e300	43	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804c148	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804c170	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x804e32c	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6698	.symtab	0x805bbb8	20	OBJECT	<unknown>	DEFAULT	12
htonl	.symtab	0x804c00c	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x804c000	12	FUNC	<unknown>	DEFAULT	2
i.4841	.symtab	0x8057774	4	OBJECT	<unknown>	DEFAULT	11
index	.symtab	0x804bd90	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804c088	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80501a4	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x804c074	17	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x804c028	76	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8051596	432	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x80514ae	232	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x80512e3	459	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x805126c	119	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804a556	306	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x80481a8	111	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x8050910	42	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x804d061	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x804d1f3	155	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804ad6c	139	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8050128	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x804aefc	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804adf8	43	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6756	.symtab	0x8057978	2	OBJECT	<unknown>	DEFAULT	11
last_ns_num.6755	.symtab	0x805e690	4	OBJECT	<unknown>	DEFAULT	12
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8048eb7	273	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x80527bc	90	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x80579d0	6	OBJECT	<unknown>	DEFAULT	12
main	.symtab	0x804a688	1418	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x80579c0	4	OBJECT	<unknown>	DEFAULT	12
malloc	.symtab	0x804c3d2	1928	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x804cee3	29	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x804bd30	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x804ff44	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x805124c	30	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x804ffa4	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804bd5c	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x804e234	27	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x8050c48	59	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x804e334	43	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80577a4	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x80577bc	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x804e389	61	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x805b9ec	4	OBJECT	<unknown>	DEFAULT	12
nprocessors_onln	.symtab	0x804d4d4	196	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x804c01f	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x804c013	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x80579c8	8	OBJECT	<unknown>	DEFAULT	12
object.4975	.symtab	0x80579a4	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x804dc80	91	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x804e578	132	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805e6b0	4	OBJECT	<unknown>	DEFAULT	12
ovhl7	.symtab	0x8049579	1600	FUNC	<unknown>	DEFAULT	2
p.4961	.symtab	0x8057644	0	OBJECT	<unknown>	DEFAULT	11
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x805e6b4	4	OBJECT	<unknown>	DEFAULT	12
poll	.symtab	0x8052701	72	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6454	.symtab	0x8055910	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x804883d	581	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x804860a	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x804871b	290	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048644	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x8049bc3	2451	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x8057888	4	OBJECT	<unknown>	DEFAULT	11
program_invocation_short_name	.symtab	0x8057884	4	OBJECT	<unknown>	DEFAULT	11
pseudo_cancel	.symtab	0x804dc55	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x804dcab	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x804dd0b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x804dd6b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x804ddcb	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x804dc7f	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x804dcda	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x804dd3a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x804dd9a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x804ddfa	0	NOTYPE	<unknown>	DEFAULT	2
qual_chars.6463	.symtab	0x8055924	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x804db04	100	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x804cfc0	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x8048217	190	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x804cfc8	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8056514	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x804d0f4	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x80577e8	128	OBJECT	<unknown>	DEFAULT	11
rawmemchr	.symtab	0x8051210	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804dd40	91	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x804e668	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x80505c0	763	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x804c1a8	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048b5b	401	FUNC	<unknown>	DEFAULT	2
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6741	.symtab	0x805e6ac	4	OBJECT	<unknown>	DEFAULT	12
rindex	.symtab	0x804ff88	26	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x804e3c8	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x804ae5d	108	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804c204	92	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804aecc	31	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804c260	56	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x804d00a	87	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x804d28e	161	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x804e1bf	80	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x804c2c0	136	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804e408	97	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x8051fa8	43	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x8051f80	40	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x804db68	195	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804c298	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8048fc8	225	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048a82	158	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6462	.symtab	0x8055938	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6453	.symtab	0x805591c	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6459	.symtab	0x8055988	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6458	.symtab	0x80559a0	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6461	.symtab	0x8055948	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6460	.symtab	0x8055958	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804af40	30	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x804d0b6	61	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x804d0b6	61	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x804d153	160	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x805274c	70	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x805e150	512	OBJECT	<unknown>	DEFAULT	12
static_map	.symtab	0x805e658	52	OBJECT	<unknown>	DEFAULT	12
static_slotinfo	.symtab	0x805e350	776	OBJECT	<unknown>	DEFAULT	12
stderr	.symtab	0x8057894	4	OBJECT	<unknown>	DEFAULT	11
stdin	.symtab	0x805788c	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x8057890	4	OBJECT	<unknown>	DEFAULT	11
strcasecmp	.symtab	0x8052bcc	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x804bd90	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x804ff6c	25	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x804bdb0	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x804bdb0	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804bdd0	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x8050058	45	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8052818	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x804befc	191	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804bdec	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8051224	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804be00	24	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8050104	35	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x804ff88	26	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8050088	42	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804be18	197	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x804bfe8	22	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x80500b4	80	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x804d344	23	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x804d598	523	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x8050144	96	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x804aeec	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804af10	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x8048569	161	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8055964	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805597c	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x8052794	39	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1474	.symtab	0x80559a8	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80577d4	20	OBJECT	<unknown>	DEFAULT	11
useragents	.symtab	0x8057680	236	OBJECT	<unknown>	DEFAULT	11
vsnprintf	.symtab	0x804af60	172	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804dda0	91	FUNC	<unknown>	DEFAULT	2
wcrtomb	.symtab	0x804e9b0	63	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x804ea0c	128	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x804e9f0	27	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x804dce0	91	FUNC	<unknown>	DEFAULT	2
xdigits.4985	.symtab	0x8056a5c	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x804920f	253	FUNC	<unknown>	DEFAULT	2

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/28/24-10:54:40.983548	TCP	2843713	ETPRO TROJAN ELF/Mirai Variant CnC Checkin	39388	777	192.168.2.13	80.253.246.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 10:54:39.950882912 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:54:39.956098080 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:54:39.956167936 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:54:40.978137016 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:54:40.983319998 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:54:40.983437061 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:54:40.983547926 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:54:40.988507032 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:55:11.058078051 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:55:11.058495045 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:55:11.284013033 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:55:11.284357071 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:56:11.070708990 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:56:11.071078062 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:56:11.244232893 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:56:11.244468927 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:57:11.083002090 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:57:11.083252907 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:57:11.261667967 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:57:11.261775970 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:58:11.097183943 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:58:11.097774029 CEST	39388	777	192.168.2.13	80.253.246.4
May 28, 2024 10:58:11.263844967 CEST	777	39388	80.253.246.4	192.168.2.13
May 28, 2024 10:58:11.264075041 CEST	39388	777	192.168.2.13	80.253.246.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 10:57:25.099471092 CEST	42109	53	192.168.2.13	1.1.1.1
May 28, 2024 10:57:25.099623919 CEST	36460	53	192.168.2.13	1.1.1.1
May 28, 2024 10:57:25.107832909 CEST	53	42109	1.1.1.1	192.168.2.13
May 28, 2024 10:57:25.109637976 CEST	53	36460	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 28, 2024 10:57:25.099471092 CEST	192.168.2.13	1.1.1.1	0x10fe	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
May 28, 2024 10:57:25.099623919 CEST	192.168.2.13	1.1.1.1	0x604c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 28, 2024 10:57:25.107832909 CEST	1.1.1.1	192.168.2.13	0x10fe	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
May 28, 2024 10:57:25.107832909 CEST	1.1.1.1	192.168.2.13	0x10fe	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: qqyt33.i586.elf PID: 5435, Parent PID: 5357

General

Start time (UTC):	08:54:38
Start date (UTC):	28/05/2024
Path:	/tmp/qqyt33.i586.elf
Arguments:	/tmp/qqyt33.i586.elf
File size:	91272 bytes
MD5 hash:	f93ec1d5e3aba4a238a062638628094e

Chronological Activities

Analysis Process: qqyt33.i586.elf PID: 5436, Parent PID: 5435

General

Start time (UTC):	08:54:38
Start date (UTC):	28/05/2024
Path:	/tmp/qqyt33.i586.elf
Arguments:	-
File size:	91272 bytes
MD5 hash:	f93ec1d5e3aba4a238a062638628094e

Chronological Activities

Analysis Process: qqyt33.i586.elf PID: 5437, Parent PID: 5436

General

Start time (UTC):	08:54:38
Start date (UTC):	28/05/2024
Path:	/tmp/qqyt33.i586.elf
Arguments:	-
File size:	91272 bytes
MD5 hash:	f93ec1d5e3aba4a238a062638628094e

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report qqyt33.i586.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: qqyt33.i586.elf PID: 5435, Parent PID: 5357

General

Chronological Activities

Analysis Process: qqyt33.i586.elf PID: 5436, Parent PID: 5435

General

Chronological Activities

Analysis Process: qqyt33.i586.elf PID: 5437, Parent PID: 5436

General

Linux Analysis Report
qqyt33.i586.elf