Edit tour

Linux Analysis Report
Buj4LG5Eu4.elf

Overview

General Information

Sample name:	Buj4LG5Eu4.elf renamed because original name is a hash value
Original sample name:	75d9439f331bc01284c627f4a89d64f7.elf
Analysis ID:	1458305
MD5:	75d9439f331bc01284c627f4a89d64f7
SHA1:	de0c0d238ae1c473679ea39534c54274bce2e804
SHA256:	3261b241aed686cbc34f0972bdb5d07888fd20013c6c71fae03670d2359fe741
Tags:	32elfgafgytintel
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1458305
Start date and time:	2024-06-17 14:29:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Buj4LG5Eu4.elf renamed because original name is a hash value
Original Sample Name:	75d9439f331bc01284c627f4a89d64f7.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@19/0

Runtime Messages

Command:	/tmp/Buj4LG5Eu4.elf
PID:	5543
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

Buj4LG5Eu4.elf (PID: 5543, Parent: 5457, MD5: 75d9439f331bc01284c627f4a89d64f7) Arguments: /tmp/Buj4LG5Eu4.elf

Buj4LG5Eu4.elf New Fork (PID: 5544, Parent: 5543)

Buj4LG5Eu4.elf New Fork (PID: 5545, Parent: 5544)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Buj4LG5Eu4.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Buj4LG5Eu4.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Buj4LG5Eu4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Buj4LG5Eu4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13fc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1403c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1408c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1412c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Buj4LG5Eu4.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13ea4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Buj4LG5Eu4.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xf8cb:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
Buj4LG5Eu4.elf	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x115c9:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
Buj4LG5Eu4.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5d52:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5543.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5543.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5543.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5543.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13fc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1403c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1408c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1412c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5543.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13ea4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5543.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xf8cb:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5543.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x115c9:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
5543.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5d52:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: Buj4LG5Eu4.elf PID: 5543	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: Buj4LG5Eu4.elf PID: 5543	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: Buj4LG5Eu4.elf PID: 5543	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Buj4LG5Eu4.elf PID: 5543	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xacc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Buj4LG5Eu4.elf PID: 5543	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x966:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 8 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:18.626382
SID:	2030490
Source Port:	54350
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:21.881512
SID:	2030490
Source Port:	54330
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:51.556093
SID:	2030490
Source Port:	54338
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:54.336971
SID:	2030490
Source Port:	54340
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:14.006304
SID:	2030490
Source Port:	54348
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:09.648901
SID:	2030490
Source Port:	54362
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:57.967107
SID:	2030490
Source Port:	54342
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:15.237589
SID:	2030490
Source Port:	54328
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:28.250671
SID:	2030490
Source Port:	54352
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:36.123862
SID:	2030490
Source Port:	54334
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:59.588540
SID:	2030490
Source Port:	54344
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:26.506156
SID:	2030490
Source Port:	54332
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:45.853970
SID:	2030490
Source Port:	54336
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:08.606827
SID:	2030490
Source Port:	54326
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:38.143628
SID:	2030490
Source Port:	54354
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:58.394263
SID:	2030490
Source Port:	54358
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:01.022770
SID:	2030490
Source Port:	54360
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:06.218151
SID:	2030490
Source Port:	54346
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:48.767106
SID:	2030490
Source Port:	54356
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Buj4LG5Eu4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Buj4LG5Eu4.elf

ReversingLabs: Detection: 57%

Machine Learning detection for sample

Source: Buj4LG5Eu4.elf

Joe Sandbox ML: detected

Source: Buj4LG5Eu4.elf

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54326 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54328 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54330 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54332 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54334 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54336 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54338 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54340 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54342 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54344 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54346 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54348 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54350 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54352 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54354 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54356 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54358 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54360 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:54362 -> 146.185.209.82:47925

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 146.185.209.82 ports 47925,2,4,5,7,9

Source: global traffic

TCP traffic: 192.168.2.14:54326 -> 146.185.209.82:47925

Source: global traffic

DNS traffic detected: DNS query: seyfhg.work.gd

System Summary

Malicious sample detected (through community Yara rule)

Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: Buj4LG5Eu4.elf	ELF static info symbol of initial sample: execute_cfa_program
Source: Buj4LG5Eu4.elf	ELF static info symbol of initial sample: execute_stack_op

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: Buj4LG5Eu4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@19/0

Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3875/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3662/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/Buj4LG5Eu4.elf (PID: 5545)	File opened: /proc/260/cmdline	Jump to behavior

Source: /tmp/Buj4LG5Eu4.elf (PID: 5543)

Queries kernel information via 'uname':

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Buj4LG5Eu4.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: Buj4LG5Eu4.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Mirai

Source: Yara match	File source: Buj4LG5Eu4.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: Buj4LG5Eu4.elf, type: SAMPLE
Source: Yara match	File source: 5543.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Buj4LG5Eu4.elf PID: 5543, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label
Buj4LG5Eu4.elf	58%	ReversingLabs	Linux.Trojan.Mirai
Buj4LG5Eu4.elf	100%	Avira	EXP/ELF.Mirai.Z.A
Buj4LG5Eu4.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
seyfhg.work.gd	146.185.209.82	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
146.185.209.82	seyfhg.work.gd	Russian Federation		206233	MATTEOGB	true

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MATTEOGB	TradingView.exe	Get hash	malicious	RedLine	Browse	91.243.59.21
	3.apk	Get hash	malicious	TEABot	Browse	91.243.34.26
	fEOqmNHQhu.exe	Get hash	malicious	Cerber	Browse	31.184.234.34
	n2vBPxeTmB.exe	Get hash	malicious	DCRat, RedLine	Browse	91.243.32.178
	[Cracked By Grizzly] BLTools.exe	Get hash	malicious	RedLine	Browse	91.243.59.21
	4sEgS3BBbZ.exe	Get hash	malicious	RedLine	Browse	91.243.59.24
	p8pt2tWWQ5.exe	Get hash	malicious	RedLine	Browse	91.243.59.61
	nplv4.exe	Get hash	malicious	RedLine	Browse	91.243.59.6
	jUes01JMMh.exe	Get hash	malicious	RedLine	Browse	91.243.32.156
	vXx3qaOTj8.exe	Get hash	malicious	RedLine	Browse	91.243.59.43

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.2366143771580305
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Buj4LG5Eu4.elf
File size:	196'340 bytes
MD5:	75d9439f331bc01284c627f4a89d64f7
SHA1:	de0c0d238ae1c473679ea39534c54274bce2e804
SHA256:	3261b241aed686cbc34f0972bdb5d07888fd20013c6c71fae03670d2359fe741
SHA512:	fcb99fb1cbb33ea953ccc7310f92951612684d0a1f47aaa3e3ac613fab4075a84906751b9210421cb218d2f5b860e304b27347258c8956eee8aedb8ecabcd225
SSDEEP:	3072:ivmxdXVT7jFlZGgcbzScS3+P79c1vC9u9XXFHVByqqnnL/u:iuxdhjFlZGgcbzmuP79c1vC9u9HFHvqS
TLSH:	CD147B86E762C9BBC44A0779069B97354637E4A2072F5B02E36CBEB06E13391F585F0D
File Content Preview:	.ELF........................4....s......4. ...(......................c...c...............c..............Tl.............. x.. ... ...................Q.td............................U..S............h.....7..[]...$.............U......=.....t..5....d......d..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048184
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	160524
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80480b4	0xb4	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480d0	0xd0	0x13727	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x805b7f7	0x137f7	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x805b820	0x13820	0x2b7c	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x805f39c	0x1639c	0x1484	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x8060820	0x17820	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x8060824	0x17824	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x8060824	0x17824	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x806082c	0x1782c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8060834	0x17834	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x8060838	0x17838	0x4	0x4	0x3	WA	0	0	4
.got.plt	PROGBITS	0x806083c	0x1783c	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8060860	0x17860	0x318	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x8060b80	0x17b78	0x5470	0x0	0x3	WA	0	0	32
.stab	PROGBITS	0x0	0x17b78	0xfc	0xc	0x0		16	0	4
.stabstr	STRTAB	0x0	0x17c74	0xdb	0x0	0x0		0	0	1
.comment	PROGBITS	0x0	0x17d4f	0xe46	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x18b95	0x40	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x18bd5	0x2f3	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x18ec8	0x4eab	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1dd73	0x9c1	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1e734	0x13df	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1fb14	0xc38	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x2074c	0x1ebd	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x22609	0x3f8a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x26593	0xc70	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x27203	0x106	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x277bc	0x49c0	0x10	0x0		29	542	4
.strtab	STRTAB	0x0	0x2c17c	0x3d78	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1639c	0x1639c	6.5923	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x1639c	0x805f39c	0x805f39c	0x17dc	0x6c54	4.7978	0x6	RW	0x1000	.eh_frame .tdata .tbss .ctors .dtors .jcr .got .got.plt .data .bss
TLS	0x17820	0x8060820	0x8060820	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80480b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x805b7f7	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x805b820	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x805f39c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8060820	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8060824	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8060824	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x806082c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8060834	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8060838	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x806083c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x8060860	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x8060b80	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
.L117	.symtab	0x80514c0	0	NOTYPE	<unknown>	DEFAULT	2
.L122	.symtab	0x805149d	0	NOTYPE	<unknown>	DEFAULT	2
.L123	.symtab	0x8051577	0	NOTYPE	<unknown>	DEFAULT	2
.L124	.symtab	0x80515ba	0	NOTYPE	<unknown>	DEFAULT	2
.L125	.symtab	0x80515d9	0	NOTYPE	<unknown>	DEFAULT	2
.L126	.symtab	0x80515fe	0	NOTYPE	<unknown>	DEFAULT	2
.L127	.symtab	0x805161d	0	NOTYPE	<unknown>	DEFAULT	2
.L128	.symtab	0x805162f	0	NOTYPE	<unknown>	DEFAULT	2
.L129	.symtab	0x805164e	0	NOTYPE	<unknown>	DEFAULT	2
.L130	.symtab	0x805166d	0	NOTYPE	<unknown>	DEFAULT	2
.L131	.symtab	0x805169d	0	NOTYPE	<unknown>	DEFAULT	2
.L132	.symtab	0x80516de	0	NOTYPE	<unknown>	DEFAULT	2
.L133	.symtab	0x8051708	0	NOTYPE	<unknown>	DEFAULT	2
.L134	.symtab	0x805173d	0	NOTYPE	<unknown>	DEFAULT	2
.L135	.symtab	0x8051761	0	NOTYPE	<unknown>	DEFAULT	2
.L136	.symtab	0x805177e	0	NOTYPE	<unknown>	DEFAULT	2
.L137	.symtab	0x80517a7	0	NOTYPE	<unknown>	DEFAULT	2
.L138	.symtab	0x80517d6	0	NOTYPE	<unknown>	DEFAULT	2
.L139	.symtab	0x80517f2	0	NOTYPE	<unknown>	DEFAULT	2
.L140	.symtab	0x805183b	0	NOTYPE	<unknown>	DEFAULT	2
.L141	.symtab	0x805186a	0	NOTYPE	<unknown>	DEFAULT	2
.L142	.symtab	0x80518a3	0	NOTYPE	<unknown>	DEFAULT	2
.L143	.symtab	0x80518bc	0	NOTYPE	<unknown>	DEFAULT	2
.L144	.symtab	0x80518d9	0	NOTYPE	<unknown>	DEFAULT	2
.L145	.symtab	0x805190e	0	NOTYPE	<unknown>	DEFAULT	2
.L146	.symtab	0x805153c	0	NOTYPE	<unknown>	DEFAULT	2
.L258	.symtab	0x80522ef	0	NOTYPE	<unknown>	DEFAULT	2
.L259	.symtab	0x80522e2	0	NOTYPE	<unknown>	DEFAULT	2
.L260	.symtab	0x80522d6	0	NOTYPE	<unknown>	DEFAULT	2
.L261	.symtab	0x80522c3	0	NOTYPE	<unknown>	DEFAULT	2
.L262	.symtab	0x80522b5	0	NOTYPE	<unknown>	DEFAULT	2
.L264	.symtab	0x8051ef0	0	NOTYPE	<unknown>	DEFAULT	2
.L266	.symtab	0x8051f43	0	NOTYPE	<unknown>	DEFAULT	2
.L267	.symtab	0x8052243	0	NOTYPE	<unknown>	DEFAULT	2
.L268	.symtab	0x805222c	0	NOTYPE	<unknown>	DEFAULT	2
.L269	.symtab	0x8052209	0	NOTYPE	<unknown>	DEFAULT	2
.L270	.symtab	0x80521e9	0	NOTYPE	<unknown>	DEFAULT	2
.L271	.symtab	0x80521c7	0	NOTYPE	<unknown>	DEFAULT	2
.L272	.symtab	0x805219f	0	NOTYPE	<unknown>	DEFAULT	2
.L273	.symtab	0x8052161	0	NOTYPE	<unknown>	DEFAULT	2
.L274	.symtab	0x80520e8	0	NOTYPE	<unknown>	DEFAULT	2
.L275	.symtab	0x805209d	0	NOTYPE	<unknown>	DEFAULT	2
.L276	.symtab	0x805205d	0	NOTYPE	<unknown>	DEFAULT	2
.L277	.symtab	0x805204e	0	NOTYPE	<unknown>	DEFAULT	2
.L278	.symtab	0x8052043	0	NOTYPE	<unknown>	DEFAULT	2
.L279	.symtab	0x8051ffa	0	NOTYPE	<unknown>	DEFAULT	2
.L280	.symtab	0x8051fa1	0	NOTYPE	<unknown>	DEFAULT	2
.L281	.symtab	0x8051f4d	0	NOTYPE	<unknown>	DEFAULT	2
.L282	.symtab	0x8052254	0	NOTYPE	<unknown>	DEFAULT	2
.L283	.symtab	0x8051f18	0	NOTYPE	<unknown>	DEFAULT	2
.L350	.symtab	0x80523c4	0	NOTYPE	<unknown>	DEFAULT	2
.L351	.symtab	0x80523ce	0	NOTYPE	<unknown>	DEFAULT	2
.L352	.symtab	0x80523dd	0	NOTYPE	<unknown>	DEFAULT	2
.L353	.symtab	0x80523e7	0	NOTYPE	<unknown>	DEFAULT	2
.L354	.symtab	0x80523f6	0	NOTYPE	<unknown>	DEFAULT	2
.L355	.symtab	0x8052401	0	NOTYPE	<unknown>	DEFAULT	2
.L356	.symtab	0x805240b	0	NOTYPE	<unknown>	DEFAULT	2
.L357	.symtab	0x8052416	0	NOTYPE	<unknown>	DEFAULT	2
.L358	.symtab	0x8052422	0	NOTYPE	<unknown>	DEFAULT	2
.L359	.symtab	0x805242e	0	NOTYPE	<unknown>	DEFAULT	2
.L360	.symtab	0x805243a	0	NOTYPE	<unknown>	DEFAULT	2
.L361	.symtab	0x8052444	0	NOTYPE	<unknown>	DEFAULT	2
.L362	.symtab	0x8052456	0	NOTYPE	<unknown>	DEFAULT	2
.L363	.symtab	0x8052468	0	NOTYPE	<unknown>	DEFAULT	2
.L364	.symtab	0x805247a	0	NOTYPE	<unknown>	DEFAULT	2
.L365	.symtab	0x805248c	0	NOTYPE	<unknown>	DEFAULT	2
.L366	.symtab	0x805249e	0	NOTYPE	<unknown>	DEFAULT	2
.L374	.symtab	0x8051ed4	0	NOTYPE	<unknown>	DEFAULT	2
.L412	.symtab	0x8052655	0	NOTYPE	<unknown>	DEFAULT	2
.L413	.symtab	0x8052758	0	NOTYPE	<unknown>	DEFAULT	2
.L414	.symtab	0x80525fc	0	NOTYPE	<unknown>	DEFAULT	2
.L415	.symtab	0x8052713	0	NOTYPE	<unknown>	DEFAULT	2
.L416	.symtab	0x80526d8	0	NOTYPE	<unknown>	DEFAULT	2
.L417	.symtab	0x8052681	0	NOTYPE	<unknown>	DEFAULT	2
.L64	.symtab	0x8051210	0	NOTYPE	<unknown>	DEFAULT	2
.L66	.symtab	0x8051298	0	NOTYPE	<unknown>	DEFAULT	2
.L67	.symtab	0x8051288	0	NOTYPE	<unknown>	DEFAULT	2
.L70	.symtab	0x8051271	0	NOTYPE	<unknown>	DEFAULT	2
.L71	.symtab	0x8051280	0	NOTYPE	<unknown>	DEFAULT	2
.L72	.symtab	0x8051220	0	NOTYPE	<unknown>	DEFAULT	2
.L73	.symtab	0x805126a	0	NOTYPE	<unknown>	DEFAULT	2
.L87	.symtab	0x80534f0	0	NOTYPE	<unknown>	DEFAULT	2
.L89	.symtab	0x8053578	0	NOTYPE	<unknown>	DEFAULT	2
.L90	.symtab	0x8053568	0	NOTYPE	<unknown>	DEFAULT	2
.L93	.symtab	0x8053551	0	NOTYPE	<unknown>	DEFAULT	2
.L94	.symtab	0x8053560	0	NOTYPE	<unknown>	DEFAULT	2
.L95	.symtab	0x8053500	0	NOTYPE	<unknown>	DEFAULT	2
.L96	.symtab	0x805354a	0	NOTYPE	<unknown>	DEFAULT	2
C.11.5136	.symtab	0x805cf34	24	OBJECT	<unknown>	DEFAULT	4
C.9.5732	.symtab	0x805c8e0	64	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x8065a24	1	OBJECT	<unknown>	DEFAULT	14
LOCAL_ADDR	.symtab	0x8065a20	4	OBJECT	<unknown>	DEFAULT	14
POPBX1	.symtab	0x805930f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x805936f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x80593cf	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80592fb	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805935b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80593bb	0	NOTYPE	<unknown>	DEFAULT	2
RESTBX1	.symtab	0x80592b9	0	NOTYPE	<unknown>	DEFAULT	2
SAVEBX1	.symtab	0x80592ac	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x8054e84	66	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x806083c	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_L_lock_103	.symtab	0x8055902	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1055	.symtab	0x804f58a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_12	.symtab	0x8056e6f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1225	.symtab	0x804f59a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1261	.symtab	0x804f5ba	16	FUNC	<unknown>	DEFAULT	2
_L_lock_140	.symtab	0x8056eaf	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1402	.symtab	0x804f5ea	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1430	.symtab	0x804f60a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_160	.symtab	0x8056ecf	16	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x8056b5a	10	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x805af39	10	FUNC	<unknown>	DEFAULT	2
_L_lock_174	.symtab	0x804f4ea	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1750	.symtab	0x804f64a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_18	.symtab	0x80558c8	13	FUNC	<unknown>	DEFAULT	2
_L_lock_191	.symtab	0x8056eef	13	FUNC	<unknown>	DEFAULT	2
_L_lock_198	.symtab	0x8055cf0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_20	.symtab	0x8050898	16	FUNC	<unknown>	DEFAULT	2
_L_lock_205	.symtab	0x80508b8	16	FUNC	<unknown>	DEFAULT	2
_L_lock_209	.symtab	0x8055d00	16	FUNC	<unknown>	DEFAULT	2
_L_lock_27	.symtab	0x80591c4	16	FUNC	<unknown>	DEFAULT	2
_L_lock_29	.symtab	0x8056e7f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_32	.symtab	0x805afe1	10	FUNC	<unknown>	DEFAULT	2
_L_lock_34	.symtab	0x805b5ae	13	FUNC	<unknown>	DEFAULT	2
_L_lock_360	.symtab	0x804f50a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_447	.symtab	0x804fcd8	14	FUNC	<unknown>	DEFAULT	2
_L_lock_470	.symtab	0x804f52a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_473	.symtab	0x804fce6	14	FUNC	<unknown>	DEFAULT	2
_L_lock_512	.symtab	0x804fcf4	14	FUNC	<unknown>	DEFAULT	2
_L_lock_54	.symtab	0x80558d5	16	FUNC	<unknown>	DEFAULT	2
_L_lock_70	.symtab	0x80590a8	16	FUNC	<unknown>	DEFAULT	2
_L_lock_757	.symtab	0x804f54a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_893	.symtab	0x804f56a	16	FUNC	<unknown>	DEFAULT	2
_L_robust_lock_105	.symtab	0x804fcb6	17	FUNC	<unknown>	DEFAULT	2
_L_robust_unlock_179	.symtab	0x80500e8	17	FUNC	<unknown>	DEFAULT	2
_L_unlock_101	.symtab	0x805b5bb	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_102	.symtab	0x8056e9f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_110	.symtab	0x804fcc7	17	FUNC	<unknown>	DEFAULT	2
_L_unlock_113	.symtab	0x8055912	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_1234	.symtab	0x804f5aa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1315	.symtab	0x804f5ca	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1340	.symtab	0x804f5da	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1406	.symtab	0x804f5fa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1434	.symtab	0x804f61a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_152	.symtab	0x8056ebf	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_167	.symtab	0x80590b8	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_1671	.symtab	0x804f62a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_170	.symtab	0x8056edf	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1710	.symtab	0x804f63a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1820	.symtab	0x804f65a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_225	.symtab	0x8055d10	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_232	.symtab	0x8056efc	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_235	.symtab	0x8055d1d	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_285	.symtab	0x80508c8	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_338	.symtab	0x804f4fa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_40	.symtab	0x8056b64	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_452	.symtab	0x804f51a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_454	.symtab	0x80500f9	11	FUNC	<unknown>	DEFAULT	2
_L_unlock_518	.symtab	0x804f53a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_57	.symtab	0x805af43	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_61	.symtab	0x805afeb	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_64	.symtab	0x80508a8	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_66	.symtab	0x80558e5	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_787	.symtab	0x804f55a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_83	.symtab	0x80558f5	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_86	.symtab	0x8056e8f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_894	.symtab	0x804f57a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_90	.symtab	0x80591d4	13	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Backtrace	.symtab	0x8052b40	154	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x8051100	28	FUNC	<unknown>	HIDDEN	2
_Unwind_FindEnclosingFunction	.symtab	0x80513c0	52	FUNC	<unknown>	HIDDEN	2
_Unwind_Find_FDE	.symtab	0x8054ab0	489	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x8053060	184	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind_Phase2	.symtab	0x8052df0	219	FUNC	<unknown>	DEFAULT	2
_Unwind_GetCFA	.symtab	0x8051090	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x80510e0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetGR	.symtab	0x8051180	86	FUNC	<unknown>	HIDDEN	2
_Unwind_GetIP	.symtab	0x80510a0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetIPInfo	.symtab	0x8051400	22	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x80510c0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x80510d0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x80510f0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_IteratePhdrCallback	.symtab	0x8054550	1367	FUNC	<unknown>	DEFAULT	2
_Unwind_RaiseException	.symtab	0x8052c90	342	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException_Phase2	.symtab	0x8052be0	169	FUNC	<unknown>	DEFAULT	2
_Unwind_Resume	.symtab	0x8052fa0	184	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x8052ed0	196	FUNC	<unknown>	HIDDEN	2
_Unwind_SetGR	.symtab	0x8051120	86	FUNC	<unknown>	HIDDEN	2
_Unwind_SetIP	.symtab	0x80510b0	14	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8060828	0	OBJECT	<unknown>	DEFAULT	8
__CTOR_LIST__	.symtab	0x8060824	0	OBJECT	<unknown>	DEFAULT	8
__C_ctype_b	.symtab	0x8060b70	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805dfd0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8060830	0	OBJECT	<unknown>	DEFAULT	9
__DTOR_LIST__	.symtab	0x806082c	0	OBJECT	<unknown>	DEFAULT	9
__EH_FRAME_BEGIN__	.symtab	0x805f39c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x806081c	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8060b70	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x80592a0	80	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x80592aa	27	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x8060b74	4	OBJECT	<unknown>	HIDDEN	13
__GI___dl_iterate_phdr	.symtab	0x8059ad4	84	FUNC	<unknown>	HIDDEN	2
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x8054d60	83	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x80571bc	26	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x80592a0	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80592f0	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x80593b0	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x8059350	91	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x8059e78	27	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x8050abc	1	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x8050abd	1	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x80592f0	91	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x80592fa	33	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x8060c2c	8192	OBJECT	<unknown>	HIDDEN	14
__GI___pthread_register_cancel	.symtab	0x8050980	27	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unregister_cancel	.symtab	0x805099b	10	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind	.symtab	0x8050104	67	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x8050147	8	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x80593b0	91	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x80593ba	33	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x8059101	195	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x8060c0c	8	OBJECT	<unknown>	HIDDEN	14
__GI___uClibc_fini	.symtab	0x8059bab	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8059c0f	39	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x8059350	91	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x805935a	33	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80571d8	191	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8054e84	66	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80585f8	191	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x805734c	84	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8058a28	17	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x80573a0	40	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x805b35c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80592a0	80	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x80554ac	130	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x805a3fa	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x805a426	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x805a190	618	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x80573c8	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8058b6c	93	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x805574c	380	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8056cb0	447	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x805af50	145	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8056ae4	118	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8056f0c	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8055920	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x8058e9c	524	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x805a530	28	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8056f6c	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x805b4a0	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x805b4b8	246	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8059ec0	70	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8056f9c	111	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x8059f8c	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8059fac	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8059fb4	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8059fbc	8	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8054ec8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80591e4	49	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8054ee4	43	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x805741c	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8059fc4	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x805732c	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x805b2c8	148	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x80588eb	155	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x8059fcc	139	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x80572b0	27	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x8054f10	43	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x805747c	32	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x805b76c	90	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x805700c	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x805b0c4	37	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x80570d4	30	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x805b144	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8057038	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8054d44	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x805a058	59	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8054fd4	43	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8055029	61	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80592f0	91	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x80555b8	132	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8059218	100	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80586c0	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80587ec	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x805b758	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x80593b0	91	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x80556a8	127	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x805a10c	129	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x80550a4	47	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x805749c	92	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x80574f8	108	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x8055938	52	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x805a094	39	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x805a0bc	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80551e1	108	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8057564	92	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80575c0	108	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8055250	31	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x805762c	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8058986	161	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8054cab	80	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8055270	97	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x805596c	32	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8057664	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x805598c	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x805884b	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x80552d4	70	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x805b0ec	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x805b10c	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x805706c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x805706c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x805708c	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x805b1f8	45	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x80570a8	19	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x80570bc	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x805b2a4	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x805b128	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x805b228	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x80570f4	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8057298	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x805b254	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8058a3c	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8058c90	523	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x80572cc	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x805531c	16	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x805a0fc	16	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x805532c	39	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x8055354	39	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x805aea0	153	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80559ac	172	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x805a454	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x805a4b0	128	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x805a494	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8059350	91	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8060834	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x8060834	0	OBJECT	<unknown>	DEFAULT	10
__app_fini	.symtab	0x8065a00	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x8060b48	24	OBJECT	<unknown>	DEFAULT	13
__bss_start	.symtab	0x8060b78	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8059be3	44	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x80504d4	104	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x80592a0	80	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x80592aa	27	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x8060b74	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x8065a0c	4	OBJECT	<unknown>	HIDDEN	14
__deallocate_stack	.symtab	0x804e71b	127	FUNC	<unknown>	HIDDEN	2
__default_stacksize	.symtab	0x806096c	4	OBJECT	<unknown>	HIDDEN	13
__deregister_frame	.symtab	0x8054380	53	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x8054370	9	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x8054250	284	FUNC	<unknown>	HIDDEN	2
__dl_iterate_phdr	.symtab	0x8059ad4	84	FUNC	<unknown>	DEFAULT	2
__do_global_ctors_aux	.symtab	0x805b7d0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8060860	0	OBJECT	<unknown>	HIDDEN	13
__environ	.symtab	0x80659f8	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x804e178	13	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x8050537	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x8064f6c	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0x8054d60	83	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0x804e519	106	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__fini_array_start	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__fork	.symtab	0x804e088	5	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x8065be4	4	OBJECT	<unknown>	DEFAULT	14
__fork_generation_pointer	.symtab	0x8065fc0	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x8065fc4	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x8064f70	4	OBJECT	<unknown>	HIDDEN	14
__frame_state_for	.symtab	0x8051da0	206	FUNC	<unknown>	HIDDEN	2
__free_stacks	.symtab	0x804e6b0	107	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0x804e79a	68	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480d0	0	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x8059f08	131	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x805b388	280	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8054ec8	19	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x80591e4	49	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x80571bc	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__init_array_start	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__init_sched_fifo_prio	.symtab	0x80506bf	27	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x8065be0	4	OBJECT	<unknown>	HIDDEN	14
__libc_accept	.symtab	0x805734c	84	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x80592a0	80	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x80573c8	84	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x805940c	86	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x8059462	79	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	7
__libc_fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x8058e9c	524	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	7
__libc_longjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8055029	61	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80592f0	91	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x80590c8	28	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x80593b0	91	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x805749c	92	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x80574f8	108	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_select	.symtab	0x80551e1	108	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8057564	92	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80575c0	108	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x805950e	513	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8054cab	80	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80659f4	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x8059350	91	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x80590e4	29	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x8050280	41	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x8050250	40	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x80503c0	74	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x8050410	194	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x80502b0	65	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x8050350	112	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake	.symtab	0x8050320	33	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private	.symtab	0x8050300	32	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x8059e78	27	FUNC	<unknown>	DEFAULT	2
__make_stacks_executable	.symtab	0x804e5ba	6	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x80582d1	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x80576bc	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8060a6c	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x8065c48	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x8058254	125	FUNC	<unknown>	DEFAULT	2
__nptl_create_event	.symtab	0x8050abc	1	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x804e5c0	240	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x8050abd	1	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x8062c30	1	OBJECT	<unknown>	DEFAULT	14
__nptl_last_event	.symtab	0x8060c20	4	OBJECT	<unknown>	DEFAULT	14
__nptl_nthreads	.symtab	0x8060958	4	OBJECT	<unknown>	DEFAULT	13
__nptl_setxid	.symtab	0x804e2a2	372	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x8060c18	8	OBJECT	<unknown>	DEFAULT	14
__open	.symtab	0x80592f0	91	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x80592fa	33	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x80659fc	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__preinit_array_start	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__progname	.symtab	0x8060b68	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x8060b6c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_cleanup_pop	.symtab	0x80509ca	32	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x8050a3c	126	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x80509a8	34	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x80509ec	80	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0x804eb53	1826	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x805061c	163	FUNC	<unknown>	HIDDEN	2
__pthread_disable_asynccancel	.symtab	0x80508d8	86	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x805092e	79	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0x804f275	196	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x8050beb	858	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x8050beb	858	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x8060c2c	8192	OBJECT	<unknown>	DEFAULT	14
__pthread_mutex_lock	.symtab	0x804fb83	307	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x804f784	1023	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x804fb83	307	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x80500da	14	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x804fd04	862	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x80500da	14	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x8050062	120	FUNC	<unknown>	HIDDEN	2
__pthread_once	.symtab	0x8050540	201	FUNC	<unknown>	PROTECTED	2
__pthread_once_internal	.symtab	0x8050540	201	FUNC	<unknown>	DEFAULT	2
__pthread_register_cancel	.symtab	0x8050980	27	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8059b7c	3	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x80506da	446	FUNC	<unknown>	HIDDEN	2
__pthread_unregister_cancel	.symtab	0x805099b	10	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x8050104	67	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x8050147	8	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x80593b0	91	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x80593ba	33	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x804f339	433	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x8059101	195	FUNC	<unknown>	DEFAULT	2
__register_frame	.symtab	0x8053af0	55	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x8053270	28	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x80531d0	153	FUNC	<unknown>	HIDDEN	2
__register_frame_info_table	.symtab	0x8054460	28	FUNC	<unknown>	HIDDEN	2
__register_frame_info_table_bases	.symtab	0x80543c0	147	FUNC	<unknown>	HIDDEN	2
__register_frame_table	.symtab	0x8054480	46	FUNC	<unknown>	HIDDEN	2
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
__restore	.symtab	0x8054ca3	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8054c9c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x8065a04	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_max_prio	.symtab	0x8060974	4	OBJECT	<unknown>	HIDDEN	13
__sched_fifo_min_prio	.symtab	0x8060970	4	OBJECT	<unknown>	HIDDEN	13
__set_robust_list_avail	.symtab	0x8065bf0	4	OBJECT	<unknown>	HIDDEN	14
__sigaction	.symtab	0x804e154	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x805768c	46	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x8054cfc	33	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8059e94	43	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stack_user	.symtab	0x8060c0c	8	OBJECT	<unknown>	DEFAULT	14
__static_tls_align_m1	.symtab	0x8065be8	4	OBJECT	<unknown>	HIDDEN	14
__static_tls_size	.symtab	0x8065bec	4	OBJECT	<unknown>	HIDDEN	14
__stdin	.symtab	0x806098c	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x805b5c8	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x805a54c	139	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x805b608	154	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x805a5d8	232	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x805b6a4	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x805b728	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x805b6cc	92	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x805a6c0	154	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8055e38	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8060990	4	OBJECT	<unknown>	DEFAULT	13
__syscall_error	.symtab	0x805060c	15	FUNC	<unknown>	HIDDEN	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x8055000	41	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x8054e4c	53	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x80551a8	57	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x8059bab	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8059c0f	39	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8059c36	577	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8060b64	4	OBJECT	<unknown>	HIDDEN	13
__wait_lookup_done	.symtab	0x804e416	259	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x8059350	91	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x805935a	33	FUNC	<unknown>	DEFAULT	2
__xidcmd	.symtab	0x8065bf4	4	OBJECT	<unknown>	HIDDEN	14
__xpg_strerror_r	.symtab	0x80571d8	191	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x805541f	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x805537c	163	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x8064d84	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x8055e60	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x8065bf8	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x8065c20	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x8060a68	4	OBJECT	<unknown>	HIDDEN	13
_dl_add_to_slotinfo	.symtab	0x805973d	141	FUNC	<unknown>	DEFAULT	2
_dl_allocate_static_tls	.symtab	0x80597ca	128	FUNC	<unknown>	HIDDEN	2
_dl_allocate_tls	.symtab	0x8059a02	21	FUNC	<unknown>	DEFAULT	2
_dl_allocate_tls_init	.symtab	0x80598d7	220	FUNC	<unknown>	DEFAULT	2
_dl_allocate_tls_storage	.symtab	0x80599b3	79	FUNC	<unknown>	HIDDEN	2
_dl_aux_init	.symtab	0x8059a7c	18	FUNC	<unknown>	DEFAULT	2
_dl_deallocate_tls	.symtab	0x805984a	94	FUNC	<unknown>	DEFAULT	2
_dl_get_tls_static_info	.symtab	0x8059720	16	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x8060b60	4	OBJECT	<unknown>	DEFAULT	13
_dl_loaded_modules	.symtab	0x8065a08	4	OBJECT	<unknown>	DEFAULT	14
_dl_memalign	.symtab	0x8059730	13	FUNC	<unknown>	DEFAULT	2
_dl_next_tls_modid	.symtab	0x8059a17	101	FUNC	<unknown>	HIDDEN	2
_dl_nothread_init_static_tls	.symtab	0x8059a8e	68	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x8065fe8	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x8065fec	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x8065fdc	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x8065fd8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x8065fe0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x8065fd0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x80594de	48	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x8065fcc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x8065fe4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x8065fd4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x8065fc8	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x8060b78	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8065ff0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x8054e84	66	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x805b7f7	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8062d84	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8055e95	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x805a8d8	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80480b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x805a75c	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_longjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
_longjmp_unwind	.symtab	0x805927c	23	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x80564f0	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x80566d5	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8056558	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8056594	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x80566ac	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop	.symtab	0x80509ca	32	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8050a3c	126	FUNC	<unknown>	PROTECTED	2
_pthread_cleanup_push	.symtab	0x80509a8	34	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80509ec	80	FUNC	<unknown>	PROTECTED	2
_res	.symtab	0x8064d94	468	OBJECT	<unknown>	HIDDEN	14
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x8054d20	34	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x8048184	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8055a58	664	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8055d2c	59	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8060994	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x8062d64	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x8056b70	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x8062d80	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x8062d70	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x8062d7c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x806099c	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x8055d67	208	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8060998	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x8058a54	278	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x805a7b4	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805d004	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_thread_db___nptl_last_event	.symtab	0x805ca58	12	OBJECT	<unknown>	DEFAULT	4
_thread_db___nptl_nthreads	.symtab	0x805ca4c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db___pthread_keys	.symtab	0x805ca64	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_dtv_dtv	.symtab	0x805cab8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_dtv_t_pointer_val	.symtab	0x805cac4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_link_map_l_tls_modid	.symtab	0x805caac	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_list_t_next	.symtab	0x805ca10	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_list_t_prev	.symtab	0x805ca1c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_cancelhandling	.symtab	0x805c9b0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_dtvp	.symtab	0x805cad0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf	.symtab	0x805c9e0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf_eventmask	.symtab	0x805c9ec	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf_eventmask_event_bits	.symtab	0x805c9f8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_data	.symtab	0x805ca94	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_level2_data	.symtab	0x805caa0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_seq	.symtab	0x805ca88	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_struct_destr	.symtab	0x805ca7c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_struct_seq	.symtab	0x805ca70	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_list	.symtab	0x805c980	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_nextevent	.symtab	0x805ca04	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_report_events	.symtab	0x805c98c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_schedparam_sched_priority	.symtab	0x805c9c8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_schedpolicy	.symtab	0x805c9bc	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_specific	.symtab	0x805c9d4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_start_routine	.symtab	0x805c9a4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_tid	.symtab	0x805c998	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_register32_thread_area	.symtab	0x805cadc	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_register64_thread_area	.symtab	0x805cae8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_eventbuf_t_eventdata	.symtab	0x805ca40	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_eventbuf_t_eventnum	.symtab	0x805ca34	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_thr_events_t_event_bits	.symtab	0x805ca28	12	OBJECT	<unknown>	DEFAULT	4
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x805a7f4	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8055ef3	1530	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80585f8	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x805734c	84	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_fdes	.symtab	0x8053880	282	FUNC	<unknown>	DEFAULT	2
adds.6870	.symtab	0x8060978	8	OBJECT	<unknown>	DEFAULT	13
allocate_dtv	.symtab	0x80598a8	47	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8058a28	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8058a28	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x8048700	109	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x8048690	101	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0x80481b0	92	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0x80495f0	1243	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x8048770	1076	FUNC	<unknown>	DEFAULT	2
attack_kill_all	.symtab	0x80482d0	326	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0x804bb20	1350	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x8060bc0	32	OBJECT	<unknown>	DEFAULT	14
attack_parse	.symtab	0x8048420	613	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x8048210	192	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0x8049050	1433	FUNC	<unknown>	DEFAULT	2
attack_tcp_bypass	.symtab	0x804a5a0	1350	FUNC	<unknown>	DEFAULT	2
attack_tcp_legit	.symtab	0x8048bb0	1183	FUNC	<unknown>	DEFAULT	2
attack_tcp_sack2	.symtab	0x804a040	1366	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0x8049ad0	1391	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_custom	.symtab	0x804b720	1011	FUNC	<unknown>	DEFAULT	2
attack_udp_plain	.symtab	0x804ab00	683	FUNC	<unknown>	DEFAULT	2
attack_udp_stdhex	.symtab	0x804b440	731	FUNC	<unknown>	DEFAULT	2
attack_udp_thread	.symtab	0x804b1d0	615	FUNC	<unknown>	DEFAULT	2
attack_udp_vse	.symtab	0x804adb0	896	FUNC	<unknown>	DEFAULT	2
base_from_cb_data	.symtab	0x8053400	90	FUNC	<unknown>	DEFAULT	2
base_from_object	.symtab	0x8053460	90	FUNC	<unknown>	DEFAULT	2
base_of_encoded_value	.symtab	0x80512c0	107	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x8064f68	1	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x80573a0	40	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x805b35c	44	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
calloc	.symtab	0x8057e6c	236	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
change_stack_perm	.symtab	0x804e583	55	FUNC	<unknown>	DEFAULT	2
check_list.6872	.symtab	0x804e1c9	29	FUNC	<unknown>	DEFAULT	2
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x804c070	70	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x804c0c0	169	FUNC	<unknown>	DEFAULT	2
classify_object_over_fdes	.symtab	0x80539a0	329	FUNC	<unknown>	DEFAULT	2
cleanup	.symtab	0x804f66c	26	FUNC	<unknown>	DEFAULT	2
cleanup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cleanup_compat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cleanup_defer_compat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock	.symtab	0x8055728	34	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clone	.symtab	0x80504d4	104	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x80592a0	80	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x80554ac	130	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4963	.symtab	0x8060b80	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x80573c8	84	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
default_attr	.symtab	0x805caf4	32	OBJECT	<unknown>	DEFAULT	4
dl-core.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-iterate-phdr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl_iterate_phdr	.symtab	0x8059b28	84	FUNC	<unknown>	DEFAULT	2
do_clone	.symtab	0x804ea1e	309	FUNC	<unknown>	DEFAULT	2
dwarf_reg_size_table	.symtab	0x8062c38	18	OBJECT	<unknown>	DEFAULT	14
entries	.symtab	0x8065a60	4	OBJECT	<unknown>	DEFAULT	14
environ	.symtab	0x80659f8	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	7
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
events.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execute_cfa_program	.symtab	0x8051420	1307	FUNC	<unknown>	DEFAULT	2
execute_stack_op	.symtab	0x8051e70	1607	FUNC	<unknown>	DEFAULT	2
exit	.symtab	0x8058b6c	93	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x805e2f0	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x805574c	380	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x8060948	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x806094c	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x8055530	136	FUNC	<unknown>	DEFAULT	2
fde_mixed_encoding_compare	.symtab	0x80544b0	146	FUNC	<unknown>	DEFAULT	2
fde_single_encoding_compare	.symtab	0x80535a0	122	FUNC	<unknown>	DEFAULT	2
fde_unencoded_compare	.symtab	0x8053290	28	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x805563c	108	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8056cb0	447	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x805af50	145	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8056ae4	118	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8056f0c	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
first_connect	.symtab	0x8060be4	4	OBJECT	<unknown>	DEFAULT	14
fmt	.symtab	0x805e2d0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8055920	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804e088	5	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x8064f74	1348	OBJECT	<unknown>	DEFAULT	14
fprintf	.symtab	0x805a530	28	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8056f6c	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_downheap	.symtab	0x80532b0	177	FUNC	<unknown>	DEFAULT	2
frame_dummy	.symtab	0x8048130	0	FUNC	<unknown>	DEFAULT	2
frame_hdr_cache	.symtab	0x8062ca0	192	OBJECT	<unknown>	DEFAULT	14
frame_hdr_cache_head	.symtab	0x8062d60	4	OBJECT	<unknown>	DEFAULT	14
frame_heapsort	.symtab	0x8053370	139	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x805844c	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x805b4a0	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x805b4a0	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x805b4b8	246	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8059ec0	70	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x8056f9c	111	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_cie_encoding	.symtab	0x8053620	186	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x805af50	145	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x8059f8c	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8059fac	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8059fb4	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8059fbc	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8054ec8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80591e4	49	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x8054edc	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8054ee4	43	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x805741c	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8057444	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8059fc4	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x8	4	TLS	<unknown>	DEFAULT	7
httpd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
httpd_pid	.symtab	0x8060868	4	OBJECT	<unknown>	DEFAULT	13
httpd_port	.symtab	0x8060bec	4	OBJECT	<unknown>	DEFAULT	14
httpd_serve	.symtab	0x804c1d0	552	FUNC	<unknown>	DEFAULT	2
httpd_start	.symtab	0x804c400	456	FUNC	<unknown>	DEFAULT	2
httpd_started	.symtab	0x8060bf0	4	OBJECT	<unknown>	DEFAULT	14
id_buf	.symtab	0x8065a40	32	OBJECT	<unknown>	DEFAULT	14
in_flight_stack	.symtab	0x8060c28	4	OBJECT	<unknown>	DEFAULT	14
index	.symtab	0x805b0ec	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x805732c	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x805b2c8	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_dwarf_reg_size_table	.symtab	0x8051330	129	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x80594b4	42	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initialized.6260	.symtab	0x8062c2c	4	OBJECT	<unknown>	DEFAULT	14
initstate	.symtab	0x8058759	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x80588eb	155	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x8059fcc	139	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x80572b0	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
jmp-unwind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x8054f10	43	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_malware	.symtab	0x804c750	312	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x804c890	43	FUNC	<unknown>	DEFAULT	2
killer_kill	.symtab	0x804c5d0	29	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x8060be0	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc_pthread_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
linear_search_fdes	.symtab	0x8053740	306	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x805747c	32	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lock_commands	.symtab	0x804c5f0	337	FUNC	<unknown>	DEFAULT	2
lockdown	.symtab	0x8065a28	4	OBJECT	<unknown>	DEFAULT	14
longjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
longjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x805b76c	90	FUNC	<unknown>	DEFAULT	2
madvise	.symtab	0x8054f74	47	FUNC	<unknown>	DEFAULT	2
madvise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
main	.symtab	0x804c950	2958	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
main_pid	.symtab	0x8065a64	4	OBJECT	<unknown>	DEFAULT	14
malloc	.symtab	0x80576e2	1928	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x80585db	29	FUNC	<unknown>	DEFAULT	2
marker.6373	.symtab	0x8062c78	4	OBJECT	<unknown>	DEFAULT	14
memcpy	.symtab	0x805700c	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x805b0c4	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x80570d4	30	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x805b144	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8057038	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
methods	.symtab	0x8060ba0	4	OBJECT	<unknown>	DEFAULT	14
methods_len	.symtab	0x8060b9c	1	OBJECT	<unknown>	DEFAULT	14
mmap	.symtab	0x8054d44	27	FUNC	<unknown>	DEFAULT	2
mprotect	.symtab	0x8054fa4	47	FUNC	<unknown>	DEFAULT	2
mprotect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x805a058	59	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x8054fd4	43	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8060a84	24	OBJECT	<unknown>	DEFAULT	13
mylock	.symtab	0x8060a9c	24	OBJECT	<unknown>	DEFAULT	13
nanosleep	.symtab	0x8055029	61	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x8064d90	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x8058bcc	196	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
object.4975	.symtab	0x8060b84	24	OBJECT	<unknown>	DEFAULT	14
object_mutex	.symtab	0x8062c60	24	OBJECT	<unknown>	DEFAULT	14
once_regsizes.7294	.symtab	0x8062c34	4	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x80592f0	91	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x80555b8	132	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.4961	.symtab	0x8060864	0	OBJECT	<unknown>	DEFAULT	13
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
parse_request	.symtab	0x804c170	95	FUNC	<unknown>	DEFAULT	2
pending_connection	.symtab	0x8060bf4	1	OBJECT	<unknown>	DEFAULT	14
pgid	.symtab	0x8060bf8	4	OBJECT	<unknown>	DEFAULT	14
prctl	.symtab	0x8055068	59	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6454	.symtab	0x805cf5c	12	OBJECT	<unknown>	DEFAULT	4
program_invocation_name	.symtab	0x8060b6c	4	OBJECT	<unknown>	DEFAULT	13
program_invocation_short_name	.symtab	0x8060b68	4	OBJECT	<unknown>	DEFAULT	13
pseudo_cancel	.symtab	0x80592c5	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805931b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805937b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x80593db	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80592ef	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805934a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80593aa	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805940a	0	NOTYPE	<unknown>	DEFAULT	2
pt-__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_cancel	.symtab	0x8050f48	152	FUNC	<unknown>	DEFAULT	2
pthread_cancel.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_create	.symtab	0x804eb53	1826	FUNC	<unknown>	DEFAULT	2
pthread_create.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_getspecific.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_join	.symtab	0x804f686	252	FUNC	<unknown>	DEFAULT	2
pthread_join.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_key_create.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_key_delete.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_lock	.symtab	0x804fb83	307	FUNC	<unknown>	DEFAULT	2
pthread_mutex_lock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_trylock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_unlock	.symtab	0x80500da	14	FUNC	<unknown>	DEFAULT	2
pthread_mutex_unlock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_once	.symtab	0x8050540	201	FUNC	<unknown>	DEFAULT	2
pthread_setspecific.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.6463	.symtab	0x805cf70	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8059218	100	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80586b8	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_init	.symtab	0x804d520	63	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x804d4e0	64	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x804d560	218	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80586c0	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x805db60	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80587ec	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8060ac8	128	OBJECT	<unknown>	DEFAULT	13
rawmemchr	.symtab	0x805b758	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x80593b0	91	FUNC	<unknown>	DEFAULT	2
read_encoded_value_with_base	.symtab	0x80511e0	213	FUNC	<unknown>	DEFAULT	2
read_encoded_value_with_base	.symtab	0x80534c0	213	FUNC	<unknown>	DEFAULT	2
read_sleb128	.symtab	0x8051020	109	FUNC	<unknown>	DEFAULT	2
read_sleb128	.symtab	0x8053160	109	FUNC	<unknown>	DEFAULT	2
read_uleb128	.symtab	0x8050fe0	59	FUNC	<unknown>	DEFAULT	2
read_uleb128	.symtab	0x8053120	59	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x80556a8	127	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x805a10c	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x80550a4	47	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8057f58	763	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x805749c	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x80574f8	108	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
remove	.symtab	0x8055938	52	FUNC	<unknown>	DEFAULT	2
remove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
res_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_entries_free	.symtab	0x804d640	52	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x804d680	1192	FUNC	<unknown>	DEFAULT	2
resolve_cnc_addr	.symtab	0x804c8c0	135	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x8060950	4	OBJECT	<unknown>	DEFAULT	13
rindex	.symtab	0x805b128	26	FUNC	<unknown>	DEFAULT	2
rmdir	.symtab	0x805a094	39	FUNC	<unknown>	DEFAULT	2
rmdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sbrk	.symtab	0x805a0bc	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_get_priority_max	.symtab	0x80550d4	39	FUNC	<unknown>	DEFAULT	2
sched_get_priority_max.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_get_priority_min	.symtab	0x80550fc	39	FUNC	<unknown>	DEFAULT	2
sched_get_priority_min.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_getparam	.symtab	0x8055124	43	FUNC	<unknown>	DEFAULT	2
sched_getparam.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_getscheduler	.symtab	0x8055150	39	FUNC	<unknown>	DEFAULT	2
sched_getscheduler.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/17/24-14:31:18.626382	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54350	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:21.881512	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54330	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:51.556093	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54338	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:54.336971	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54340	47925	192.168.2.14	146.185.209.82
06/17/24-14:31:14.006304	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54348	47925	192.168.2.14	146.185.209.82
06/17/24-14:32:09.648901	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54362	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:57.967107	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54342	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:15.237589	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54328	47925	192.168.2.14	146.185.209.82
06/17/24-14:31:28.250671	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54352	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:36.123862	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54334	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:59.588540	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54344	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:26.506156	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54332	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:45.853970	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54336	47925	192.168.2.14	146.185.209.82
06/17/24-14:30:08.606827	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54326	47925	192.168.2.14	146.185.209.82
06/17/24-14:31:38.143628	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54354	47925	192.168.2.14	146.185.209.82
06/17/24-14:31:58.394263	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54358	47925	192.168.2.14	146.185.209.82
06/17/24-14:32:01.022770	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54360	47925	192.168.2.14	146.185.209.82
06/17/24-14:31:06.218151	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54346	47925	192.168.2.14	146.185.209.82
06/17/24-14:31:48.767106	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	54356	47925	192.168.2.14	146.185.209.82

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 17, 2024 14:30:08.601864100 CEST	54326	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:08.606740952 CEST	47925	54326	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:08.606805086 CEST	54326	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:08.606827021 CEST	54326	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:08.611764908 CEST	47925	54326	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:09.219027042 CEST	47925	54326	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:09.219140053 CEST	54326	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:09.224148035 CEST	47925	54326	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:15.230433941 CEST	54328	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:15.237504959 CEST	47925	54328	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:15.237588882 CEST	54328	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:15.237588882 CEST	54328	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:15.244575024 CEST	47925	54328	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:15.865647078 CEST	47925	54328	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:15.865782976 CEST	54328	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:15.870804071 CEST	47925	54328	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:21.876595020 CEST	54330	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:21.881434917 CEST	47925	54330	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:21.881496906 CEST	54330	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:21.881511927 CEST	54330	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:21.886339903 CEST	47925	54330	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:22.492427111 CEST	47925	54330	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:22.492594957 CEST	54330	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:22.497425079 CEST	47925	54330	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:26.501059055 CEST	54332	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:26.506062984 CEST	47925	54332	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:26.506124973 CEST	54332	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:26.506155968 CEST	54332	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:26.510982990 CEST	47925	54332	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:27.111057043 CEST	47925	54332	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:27.111207008 CEST	54332	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:27.116777897 CEST	47925	54332	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:36.118940115 CEST	54334	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:36.123729944 CEST	47925	54334	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:36.123800039 CEST	54334	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:36.123862028 CEST	54334	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:36.128571033 CEST	47925	54334	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:36.728358030 CEST	47925	54334	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:36.728490114 CEST	54334	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:36.733391047 CEST	47925	54334	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:45.846080065 CEST	54336	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:45.853849888 CEST	47925	54336	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:45.853945017 CEST	54336	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:45.853970051 CEST	54336	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:45.858980894 CEST	47925	54336	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:46.466063023 CEST	47925	54336	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:46.466212034 CEST	54336	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:46.471164942 CEST	47925	54336	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:51.550173998 CEST	54338	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:51.555991888 CEST	47925	54338	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:51.556071997 CEST	54338	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:51.556092978 CEST	54338	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:51.561028004 CEST	47925	54338	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:52.165520906 CEST	47925	54338	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:52.165714979 CEST	54338	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:52.171844959 CEST	47925	54338	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:54.331130028 CEST	54340	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:54.336848974 CEST	47925	54340	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:54.336932898 CEST	54340	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:54.336971045 CEST	54340	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:54.342118979 CEST	47925	54340	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:54.949655056 CEST	47925	54340	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:54.949939966 CEST	54340	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:54.954982042 CEST	47925	54340	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:57.961313963 CEST	54342	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:57.967020035 CEST	47925	54342	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:57.967107058 CEST	54342	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:57.967107058 CEST	54342	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:57.973058939 CEST	47925	54342	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:58.573102951 CEST	47925	54342	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:58.573242903 CEST	54342	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:58.578023911 CEST	47925	54342	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:59.583590031 CEST	54344	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:59.588432074 CEST	47925	54344	146.185.209.82	192.168.2.14
Jun 17, 2024 14:30:59.588522911 CEST	54344	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:59.588540077 CEST	54344	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:30:59.593545914 CEST	47925	54344	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:00.204257965 CEST	47925	54344	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:00.204411983 CEST	54344	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:00.209691048 CEST	47925	54344	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:06.212846041 CEST	54346	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:06.217993975 CEST	47925	54346	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:06.218151093 CEST	54346	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:06.218151093 CEST	54346	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:06.223283052 CEST	47925	54346	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:06.828975916 CEST	47925	54346	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:06.829180956 CEST	54346	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:06.834032059 CEST	47925	54346	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:14.001300097 CEST	54348	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:14.006191969 CEST	47925	54348	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:14.006273031 CEST	54348	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:14.006304026 CEST	54348	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:14.011143923 CEST	47925	54348	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:14.611352921 CEST	47925	54348	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:14.611498117 CEST	54348	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:14.616597891 CEST	47925	54348	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:18.621356010 CEST	54350	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:18.626296043 CEST	47925	54350	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:18.626360893 CEST	54350	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:18.626382113 CEST	54350	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:18.631695032 CEST	47925	54350	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:19.237881899 CEST	47925	54350	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:19.238009930 CEST	54350	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:19.242822886 CEST	47925	54350	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:28.245660067 CEST	54352	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:28.250533104 CEST	47925	54352	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:28.250627041 CEST	54352	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:28.250670910 CEST	54352	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:28.255547047 CEST	47925	54352	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:28.878118992 CEST	47925	54352	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:28.878274918 CEST	54352	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:28.883167028 CEST	47925	54352	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:38.138614893 CEST	54354	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:38.143517971 CEST	47925	54354	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:38.143579006 CEST	54354	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:38.143627882 CEST	54354	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:38.148641109 CEST	47925	54354	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:38.754184961 CEST	47925	54354	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:38.754303932 CEST	54354	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:38.759241104 CEST	47925	54354	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:48.762223005 CEST	54356	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:48.766998053 CEST	47925	54356	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:48.767081976 CEST	54356	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:48.767106056 CEST	54356	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:48.771898985 CEST	47925	54356	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:49.380014896 CEST	47925	54356	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:49.380153894 CEST	54356	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:49.385391951 CEST	47925	54356	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:58.389081955 CEST	54358	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:58.394186974 CEST	47925	54358	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:58.394243002 CEST	54358	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:58.394263029 CEST	54358	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:58.399044037 CEST	47925	54358	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:59.005068064 CEST	47925	54358	146.185.209.82	192.168.2.14
Jun 17, 2024 14:31:59.005196095 CEST	54358	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:31:59.010106087 CEST	47925	54358	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:01.017510891 CEST	54360	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:01.022675991 CEST	47925	54360	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:01.022769928 CEST	54360	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:01.022769928 CEST	54360	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:01.027662992 CEST	47925	54360	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:01.634586096 CEST	47925	54360	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:01.634773016 CEST	54360	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:01.639811039 CEST	47925	54360	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:09.643182039 CEST	54362	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:09.648828983 CEST	47925	54362	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:09.648883104 CEST	54362	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:09.648900986 CEST	54362	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:09.653863907 CEST	47925	54362	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:10.254091978 CEST	47925	54362	146.185.209.82	192.168.2.14
Jun 17, 2024 14:32:10.254240990 CEST	54362	47925	192.168.2.14	146.185.209.82
Jun 17, 2024 14:32:10.259203911 CEST	47925	54362	146.185.209.82	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 17, 2024 14:30:08.594650030 CEST	46845	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:08.601787090 CEST	53	46845	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:15.221486092 CEST	57152	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:15.230331898 CEST	53	57152	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:21.868998051 CEST	56154	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:21.876497984 CEST	53	56154	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:26.493849039 CEST	58048	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:26.500896931 CEST	53	58048	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:36.111926079 CEST	36620	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:36.118844032 CEST	53	36620	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:45.729329109 CEST	36985	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:45.845678091 CEST	53	36985	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:51.467336893 CEST	59377	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:51.550014973 CEST	53	59377	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:54.167256117 CEST	42342	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:54.330873013 CEST	53	42342	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:57.951339006 CEST	53057	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:57.961219072 CEST	53	53057	8.8.8.8	192.168.2.14
Jun 17, 2024 14:30:59.574414015 CEST	58351	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:30:59.583435059 CEST	53	58351	8.8.8.8	192.168.2.14
Jun 17, 2024 14:31:06.205894947 CEST	52739	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:31:06.212665081 CEST	53	52739	8.8.8.8	192.168.2.14
Jun 17, 2024 14:31:13.830307961 CEST	40574	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:31:14.001063108 CEST	53	40574	8.8.8.8	192.168.2.14
Jun 17, 2024 14:31:18.613224983 CEST	53858	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:31:18.621260881 CEST	53	53858	8.8.8.8	192.168.2.14
Jun 17, 2024 14:31:28.239135027 CEST	37096	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:31:28.245522022 CEST	53	37096	8.8.8.8	192.168.2.14
Jun 17, 2024 14:31:37.879362106 CEST	42404	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:31:38.138458014 CEST	53	42404	8.8.8.8	192.168.2.14
Jun 17, 2024 14:31:48.755203009 CEST	51866	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:31:48.762115002 CEST	53	51866	8.8.8.8	192.168.2.14
Jun 17, 2024 14:31:58.381414890 CEST	55658	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:31:58.388961077 CEST	53	55658	8.8.8.8	192.168.2.14
Jun 17, 2024 14:32:01.006617069 CEST	38629	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:32:01.017365932 CEST	53	38629	8.8.8.8	192.168.2.14
Jun 17, 2024 14:32:09.636115074 CEST	59444	53	192.168.2.14	8.8.8.8
Jun 17, 2024 14:32:09.643040895 CEST	53	59444	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 17, 2024 14:30:08.594650030 CEST	192.168.2.14	8.8.8.8	0xe32e	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:15.221486092 CEST	192.168.2.14	8.8.8.8	0x942	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:21.868998051 CEST	192.168.2.14	8.8.8.8	0xbf59	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:26.493849039 CEST	192.168.2.14	8.8.8.8	0x9099	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:36.111926079 CEST	192.168.2.14	8.8.8.8	0xbe67	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:45.729329109 CEST	192.168.2.14	8.8.8.8	0xa579	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:51.467336893 CEST	192.168.2.14	8.8.8.8	0x81fe	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:54.167256117 CEST	192.168.2.14	8.8.8.8	0x827e	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:57.951339006 CEST	192.168.2.14	8.8.8.8	0x1f98	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:59.574414015 CEST	192.168.2.14	8.8.8.8	0x50e3	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:06.205894947 CEST	192.168.2.14	8.8.8.8	0x8efa	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:13.830307961 CEST	192.168.2.14	8.8.8.8	0x9288	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:18.613224983 CEST	192.168.2.14	8.8.8.8	0x4633	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:28.239135027 CEST	192.168.2.14	8.8.8.8	0xe6e0	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:37.879362106 CEST	192.168.2.14	8.8.8.8	0x862c	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:48.755203009 CEST	192.168.2.14	8.8.8.8	0x7c2b	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:58.381414890 CEST	192.168.2.14	8.8.8.8	0x9a19	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:32:01.006617069 CEST	192.168.2.14	8.8.8.8	0xfe3d	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:32:09.636115074 CEST	192.168.2.14	8.8.8.8	0x3cec	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 17, 2024 14:30:08.601787090 CEST	8.8.8.8	192.168.2.14	0xe32e	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:15.230331898 CEST	8.8.8.8	192.168.2.14	0x942	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:21.876497984 CEST	8.8.8.8	192.168.2.14	0xbf59	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:26.500896931 CEST	8.8.8.8	192.168.2.14	0x9099	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:36.118844032 CEST	8.8.8.8	192.168.2.14	0xbe67	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:45.845678091 CEST	8.8.8.8	192.168.2.14	0xa579	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:51.550014973 CEST	8.8.8.8	192.168.2.14	0x81fe	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:54.330873013 CEST	8.8.8.8	192.168.2.14	0x827e	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:57.961219072 CEST	8.8.8.8	192.168.2.14	0x1f98	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:30:59.583435059 CEST	8.8.8.8	192.168.2.14	0x50e3	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:06.212665081 CEST	8.8.8.8	192.168.2.14	0x8efa	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:14.001063108 CEST	8.8.8.8	192.168.2.14	0x9288	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:18.621260881 CEST	8.8.8.8	192.168.2.14	0x4633	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:28.245522022 CEST	8.8.8.8	192.168.2.14	0xe6e0	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:38.138458014 CEST	8.8.8.8	192.168.2.14	0x862c	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:48.762115002 CEST	8.8.8.8	192.168.2.14	0x7c2b	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:31:58.388961077 CEST	8.8.8.8	192.168.2.14	0x9a19	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:32:01.017365932 CEST	8.8.8.8	192.168.2.14	0xfe3d	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false
Jun 17, 2024 14:32:09.643040895 CEST	8.8.8.8	192.168.2.14	0x3cec	No error (0)	seyfhg.work.gd	146.185.209.82	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Buj4LG5Eu4.elf PID: 5543, Parent PID: 5457

General

Start time (UTC):	12:30:07
Start date (UTC):	17/06/2024
Path:	/tmp/Buj4LG5Eu4.elf
Arguments:	/tmp/Buj4LG5Eu4.elf
File size:	196340 bytes
MD5 hash:	75d9439f331bc01284c627f4a89d64f7

Start time (UTC):	12:30:07
Start date (UTC):	17/06/2024
Path:	/tmp/Buj4LG5Eu4.elf
Arguments:	-
File size:	196340 bytes
MD5 hash:	75d9439f331bc01284c627f4a89d64f7

Start time (UTC):	12:30:07
Start date (UTC):	17/06/2024
Path:	/tmp/Buj4LG5Eu4.elf
Arguments:	-
File size:	196340 bytes
MD5 hash:	75d9439f331bc01284c627f4a89d64f7

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Buj4LG5Eu4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Buj4LG5Eu4.elf PID: 5543, Parent PID: 5457

General

Chronological Activities

Analysis Process: Buj4LG5Eu4.elf PID: 5544, Parent PID: 5543

General

Chronological Activities

Analysis Process: Buj4LG5Eu4.elf PID: 5545, Parent PID: 5544

General

Chronological Activities

Linux Analysis Report
Buj4LG5Eu4.elf