Edit tour

Linux Analysis Report
Okami.m68k.elf

Overview

General Information

Sample name:	Okami.m68k.elf
Analysis ID:	1467991
MD5:	73918db227a2f4b44010e578ddd8d494
SHA1:	9effb3045d582124832085442d1741bdc2074416
SHA256:	67cdf3da7b337bbb50c4f212ccd11289f2d812f0d99718111063d8ec46fe4cf0
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467991
Start date and time:	2024-07-05 08:10:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Okami.m68k.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/1@2/0

Runtime Messages

Command:	/tmp/Okami.m68k.elf
PID:	5490
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

Okami.m68k.elf (PID: 5490, Parent: 5412, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/Okami.m68k.elf

Okami.m68k.elf New Fork (PID: 5492, Parent: 5490)

Okami.m68k.elf New Fork (PID: 5494, Parent: 5492)

Okami.m68k.elf New Fork (PID: 5496, Parent: 5494)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Okami.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Okami.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfebe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfed2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfefa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfffe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10012:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10026:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1003a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5490.1.00007ff59c001000.00007ff59c013000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5490.1.00007ff59c001000.00007ff59c013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfebe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfed2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfefa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfffe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10012:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10026:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1003a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5492.1.00007ff59c001000.00007ff59c013000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5492.1.00007ff59c001000.00007ff59c013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfebe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfed2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfefa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfffe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10012:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10026:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1003a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5494.1.00007ff59c001000.00007ff59c013000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5494.1.00007ff59c001000.00007ff59c013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfebe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfed2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfefa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfffe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10012:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10026:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1003a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Okami.m68k.elf PID: 5490	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Okami.m68k.elf PID: 5490	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1942:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1956:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x196a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x197e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1992:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Okami.m68k.elf PID: 5492	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Okami.m68k.elf PID: 5492	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4da0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4db4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4df0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4eb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Okami.m68k.elf PID: 5494	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Okami.m68k.elf PID: 5494	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x91c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x91dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x91f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x922d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x927d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x931d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Okami.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Okami.m68k.elf

Virustotal: Detection: 63%

Perma Link

Source: global traffic

TCP traffic: 192.168.2.14:44510 -> 93.123.85.246:6963

Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.246

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: Okami.m68k.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: Okami.m68k.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: Okami.m68k.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: Okami.m68k.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: Okami.m68k.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: Okami.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5490.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5492.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5494.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Okami.m68k.elf PID: 5490, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Okami.m68k.elf PID: 5492, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Okami.m68k.elf PID: 5494, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: pkill -9 busybox
Source: Initial sample	String containing 'busybox' found: rm -rf /tmp/* /var/* /var/run/* /var/tmp/rm -rf /var/log/wtmprm -rf /tmp/rm -rf /bin/netstatiptables -Fpkill -9 busyboxpkill -9 perlpkill -9 pythonservice iptables stop/sbin/iptables -F; /sbin/iptables -Xservice firewalld stoprm -rf ~/.bash_historyhistory -c;history -wBIG_ENDIANLITTLE_ENDIANBIG_ENDIAN_WLITTLE_ENDIAN_WUNKNOWN/[ INFECTED ] Arch: %s \|\| Type: %s]DUP

Source: Okami.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5490.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5492.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5494.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Okami.m68k.elf PID: 5490, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Okami.m68k.elf PID: 5492, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Okami.m68k.elf PID: 5494, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/1@2/0

Source: Okami.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crt1.S
Source: Okami.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crti.S
Source: Okami.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crtn.S
Source: Okami.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/vfork.S

Source: /tmp/Okami.m68k.elf (PID: 5490)

Queries kernel information via 'uname':

Jump to behavior

Source: Okami.m68k.elf, 5490.1.000055b4043aa000.000055b40440e000.rw-.sdmp, Okami.m68k.elf, 5492.1.000055b4043aa000.000055b40440e000.rw-.sdmp, Okami.m68k.elf, 5494.1.000055b4043aa000.000055b40440e000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: Okami.m68k.elf, 5490.1.00007fff538b2000.00007fff538d3000.rw-.sdmp, Okami.m68k.elf, 5492.1.00007fff538b2000.00007fff538d3000.rw-.sdmp, Okami.m68k.elf, 5494.1.00007fff538b2000.00007fff538d3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: Okami.m68k.elf, 5490.1.000055b4043aa000.000055b40440e000.rw-.sdmp, Okami.m68k.elf, 5492.1.000055b4043aa000.000055b40440e000.rw-.sdmp, Okami.m68k.elf, 5494.1.000055b4043aa000.000055b40440e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: Okami.m68k.elf, 5490.1.00007fff538b2000.00007fff538d3000.rw-.sdmp, Okami.m68k.elf, 5492.1.00007fff538b2000.00007fff538d3000.rw-.sdmp, Okami.m68k.elf, 5494.1.00007fff538b2000.00007fff538d3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/Okami.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Okami.m68k.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Okami.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5490.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5492.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Okami.m68k.elf PID: 5490, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Okami.m68k.elf PID: 5492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Okami.m68k.elf PID: 5494, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Okami.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5490.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5492.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007ff59c001000.00007ff59c013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Okami.m68k.elf PID: 5490, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Okami.m68k.elf PID: 5492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Okami.m68k.elf PID: 5494, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Okami.m68k.elf	100%	Avira	EXP/ELF.Mirai.Z.A
Okami.m68k.elf	64%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
daisy.ubuntu.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.billybobbot.com/crawler/)	100%	URL Reputation	malware
http://www.billybobbot.com/crawler/)	100%	URL Reputation	malware
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://www.baidu.com/search/spider.html)	0%	Avira URL Cloud	safe
http://www.baidu.com/search/spider.htm)	0%	Avira URL Cloud	safe
http://www.baidu.com/search/spider.html)	0%	Virustotal		Browse
http://www.baidu.com/search/spider.htm)	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	Okami.m68k.elf	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.billybobbot.com/crawler/)	Okami.m68k.elf	true	URL Reputation: malware URL Reputation: malware	unknown
http://fast.no/support/crawler.asp)	Okami.m68k.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	Okami.m68k.elf	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	Okami.m68k.elf	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
93.123.85.246	unknown	Bulgaria		43561	NET1-ASBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
93.123.85.246	Okami.mpsl.elf	Get hash	malicious	Mirai	Browse
	Okami.mips.elf	Get hash	malicious	Mirai	Browse
	Okami.sh4.elf	Get hash	malicious	Mirai	Browse
	Okami.ppc.elf	Get hash	malicious	Mirai	Browse
	Okami.sparc.elf	Get hash	malicious	Mirai	Browse
	Okami.x86.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Okami.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Okami.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Okami.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Okami.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	1eMpWRaDQE.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	PMcyGpR57k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	UhtzOix2fn.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	oF0U7TguWy.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	CgiHyL88Yf.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	NSWk4vIsis.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	Okami.mpsl.elf	Get hash	malicious	Mirai	Browse	93.123.85.246
	Okami.mips.elf	Get hash	malicious	Mirai	Browse	93.123.85.246
	Okami.sh4.elf	Get hash	malicious	Mirai	Browse	93.123.85.246
	Okami.ppc.elf	Get hash	malicious	Mirai	Browse	93.123.85.246
	Okami.sparc.elf	Get hash	malicious	Mirai	Browse	93.123.85.246
	Okami.x86.elf	Get hash	malicious	Mirai	Browse	93.123.85.246
	Leaked.exe	Get hash	malicious	XWorm	Browse	94.156.79.213
	file.exe	Get hash	malicious	Socks5Systemz	Browse	94.156.8.80
	94.156.79.13-bot.mips-2024-07-01T10_28_04.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	94.156.79.13
	6RjPHp1yLG.exe	Get hash	malicious	Socks5Systemz	Browse	94.156.8.80

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf

Download File

Process:	/tmp/Okami.m68k.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.3918926446809334
Encrypted:	false
SSDEEP:	3:KkZRAkd:KaAu
MD5:	C7EA09D26E26605227076E0514A33038
SHA1:	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E
SHA-256:	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
SHA-512:	17D0088725EB9991E9EB82E8A3DE0878E45E6F394BBC2AD260AA59C786FF0AD565E145E21256425D1C0ABE15F3ECB402EBB0A6A5E1C2D5BA7A4D95EC93A2861F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	nameserver 8.8.8.8.nameserver 8.8.4.4.

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.103450233774202
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Okami.m68k.elf
File size:	98'107 bytes
MD5:	73918db227a2f4b44010e578ddd8d494
SHA1:	9effb3045d582124832085442d1741bdc2074416
SHA256:	67cdf3da7b337bbb50c4f212ccd11289f2d812f0d99718111063d8ec46fe4cf0
SHA512:	902ab34f4f7fce97590b9ef97419b8ae91177dfcc31f601a11e88df60bf44deab5c6e75779b17508941628a5d1f6c9cc29033f96ed15799861ef67d3eb92d983
SSDEEP:	1536:hZubYDIJ8FLAYd4bV2vgUrOhfAJGhxyyVE0J3YO5YLf4SmMk0yD2PKqjyun:hbDI8P4Rk6OGhxyyVE0J3YOuzPmMk0yK
TLSH:	EFA30793F801DEB3F40ED67604D74B217630FBA60E931662731739A6AE722D53826F85
File Content Preview:	.ELF.......................D...4.........4. ...(.......................,...,...... ........,..>,..>,...\|..g....... .dt.Q............................NV..a....da.....N^NuNV..J9..B.f>"y..>D QJ.g.X.#...>DN."y..>D QJ.f.A.....J.g.Hy...(N.X.......B.N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	77336
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0xea08	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x8000eab0	0xeab0	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x8000eabe	0xeabe	0x3368	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x80011e28	0x11e28	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x80013e2c	0x11e2c	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x80013e34	0x11e34	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x80013e3c	0x11e3c	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x80013e40	0x11e40	0x468	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x800142a8	0x122a8	0x635c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x122a8	0xb0a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x12db2	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x13070	0x2c90	0x10	0x0		14	275	4
.strtab	STRTAB	0x0	0x15d00	0x223b	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x11e2c	0x11e2c	6.1424	0x5	R E	0x2000	.init .text .fini .rodata .eh_frame
LOAD	0x11e2c	0x80013e2c	0x80013e2c	0x47c	0x67d8	3.4734	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8000eab0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8000eabe	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x80011e28	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x80013e2c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x80013e34	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x80013e3c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x80013e40	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x800142a8	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.104.5151	.symtab	0x800104ae	104	OBJECT	<unknown>	DEFAULT	4
Okami.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
Q	.symtab	0x800142d6	16384	OBJECT	<unknown>	DEFAULT	10
RemoveTempDirs	.symtab	0x80002e64	190	FUNC	<unknown>	DEFAULT	2
SendHTTP	.symtab	0x800022a6	348	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x80001864	362	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x80001752	274	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0x80001d16	1184	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x800019ce	840	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0x80002dee	118	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x80013e30	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x80013e2c	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x80013f48	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x80010774	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8001426c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x800119d4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x80013f50	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x80010a74	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x80013e38	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x80013e34	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x80011e28	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x80011e28	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x80013f48	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x80010774	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x8001426c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x800119d4	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x80013f50	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x80010a74	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x80013f4c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x80014270	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x80013f54	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x80003d2c	16	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8000e370	500	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8000651c	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x80008fe4	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x80003594	188	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x800036a8	54	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80003926	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x800087e4	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80008900	74	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80006540	264	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x80003718	16	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x8000bb48	390	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x80008210	28	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x80008210	28	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8000bcfc	64	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x800037ae	16	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x800037c0	60	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x80006e20	48	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8001a508	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x80008500	178	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x80008c08	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x80008484	124	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8000bdf4	416	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x80003594	188	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x800036a8	54	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8000c886	510	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8000e370	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8000c6c8	134	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8000ca84	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8000bf94	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x800037fc	56	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x800055f0	80	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8000bfbc	40	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8000bfe4	346	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x80005640	162	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8000e370	500	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x80008c5c	60	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80008c98	60	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x80008cd4	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x80006958	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80006994	1164	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80003834	56	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80008d10	60	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8001a50c	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x80006928	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8000acc8	362	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x80006908	30	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x80006868	160	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8000d6f2	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8000d200	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x80007f46	330	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80008d4c	130	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x80006738	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x800038b4	20	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8000e302	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8000a304	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x80005b0e	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8000a920	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8000aa40	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8000aa6c	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x80005c00	310	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80008dd0	78	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80003926	80	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8000bd9c	88	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8000e284	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80007960	94	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80007c96	266	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8000cb68	274	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x800039f8	84	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x80006e94	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80008e20	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80003a4c	100	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x80006ecc	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80006f04	70	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x80003ab0	112	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x80003b20	88	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x80003b78	78	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80006f4c	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x80007b00	406	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8000ba60	232	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x80006fc0	238	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80008e8c	160	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x800085b4	558	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x80006f8c	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x80003d3c	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x80007da0	422	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8000e564	120	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x80006668	170	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x80005d38	390	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x80005ec0	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x80005ec0	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x80005f30	92	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8000ce1c	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x80005f8c	268	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8000cc7c	310	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x80006098	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x800061d8	350	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8000ac70	86	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8000cdb4	104	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x80006338	484	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x80006714	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8000abd4	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8000822c	34	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8000676c	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x80003c0c	62	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x80008fa4	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x80003cec	64	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x80008b94	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80003d70	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x80008f86	30	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x80003c4c	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x80008ff4	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x80009080	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x80009058	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x80003c70	84	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x80013e3c	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x80013e3c	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8001a4fc	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x80014250	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x80006fc0	238	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x800142a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x800088bc	68	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x80008860	92	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x80013f4c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x80014270	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x80013f54	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x8001a530	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x80013e48	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x8000dc34	460	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8000e6e8	340	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8000d954	480	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8000ae34	2224	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8000ea7c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x80013e40	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x8000e5dc	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8000d764	494	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8000db34	198	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x8001a4f4	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x80003d2c	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8001a4ec	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x8000e370	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x80013e2c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x80013e2c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__free_to_heap	.symtab	0x80007460	342	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x8000ba2c	50	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x8000651c	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x80008fe4	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_add_free_area	.symtab	0x8000777a	66	FUNC	<unknown>	DEFAULT	2
__heap_alloc	.symtab	0x80007672	150	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x80007408	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x800075d8	88	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x800077bc	404	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x80007630	66	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x80007708	70	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x8000774e	44	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x80013e2c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x80013e2c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x8000e83c	114	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x8000dbfc	56	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x800037c0	60	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x80006e20	48	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x80003976	30	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x80003594	188	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x800036a8	54	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x800037fc	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x80003834	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8000e302	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80008dd0	78	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80003926	80	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x8000bd9c	88	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x800039f8	84	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x80006e94	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x80003a4c	100	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x80006ecc	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80006f04	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8000ba60	232	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x8001a4f0	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x80008090	382	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x80003c4c	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x80003c70	84	FUNC	<unknown>	DEFAULT	2
__malloc_from_heap	.symtab	0x8000718c	466	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x80014094	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x8001a4d4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x8001a5c0	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x8001a5e8	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x8001a5f4	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x8000de00	72	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8000b6e4	840	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x8001a4f8	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x80013e2c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x80013e2c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8000884e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8000884e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8000884e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8000884e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8000884e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x80008858	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8000e284	28	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8000de48	1084	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x80014278	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x8001a500	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x8001a5d8	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x8001a5f8	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x80007100	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x80007144	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x800070b0	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80008bbc	74	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x80013f64	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x8000e8b0	138	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80009150	314	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8000c140	352	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8000928c	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x80003ea0	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3828	.symtab	0x80010d74	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x8000e93c	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8000c660	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8000e998	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x80009494	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x80003fb8	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x80013f68	4	OBJECT	<unknown>	DEFAULT	9
__syscall_chdir	.symtab	0x80003770	62	FUNC	<unknown>	DEFAULT	2
__syscall_exit	.symtab	0x800036e0	56	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64	.symtab	0x80003650	88	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_kill	.symtab	0x8000386c	72	FUNC	<unknown>	DEFAULT	2
__syscall_llseek	.symtab	0x8000e2a0	98	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x800038c8	94	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x8000bd3c	94	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_wait4	.symtab	0x80008f2c	90	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x800087e4	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80008900	74	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8000894a	584	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80014268	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x80008b94	38	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x80006540	264	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8000402c	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8000bcd0	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8001a5fc	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x8001a600	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000411e	2118	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x800142a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8001a604	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x8001a508	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x80003718	16	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8000eab0	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x800182e0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x80004076	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8000993c	2502	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8001a50c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x80004f58	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x80009634	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x80004af8	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x80004fbe	1584	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x80004bc8	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x80004c34	718	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x80004f04	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x80008858	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80008858	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x8001a540	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8000c2a0	960	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x80003e38	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80013f6c	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x80013f70	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x8000c750	310	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x800182dc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x80013f88	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x800182d8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x80013fa4	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x80003ec0	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80013fa0	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x80008250	562	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x80009724	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x80010e38	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80009784	438	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x80004964	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x8000a460	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x8000a6de	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x800056e4	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x8000591a	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x8000bb48	390	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x80003728	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x800004d0	84	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x80008210	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x80008210	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x80006648	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8001a52c	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2790	.symtab	0x8001a504	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x8000bcfc	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x80006fc0	238	FUNC	<unknown>	DEFAULT	2
buf.2603	.symtab	0x8001a2e4	16	OBJECT	<unknown>	DEFAULT	10
buf.4831	.symtab	0x8001a2f4	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x80013f40	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x8000eaa6	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x800037ae	16	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x800037c0	60	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x80013e4c	4	OBJECT	<unknown>	DEFAULT	9
completed.2170	.symtab	0x800142a8	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x80006e20	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x80000fc8	462	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x80000324	110	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x80003976	30	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x800014f8	228	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x80013f3c	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x80013e48	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x8001a4f4	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x8001a508	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x80008500	178	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x80008c08	84	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x80008484	124	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80011d30	108	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8000bdf4	416	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x80003594	188	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x800036a8	54	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8000c886	510	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8000e370	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8000c6c8	134	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8000ca84	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fix_errno	.symtab	0x80008bac	0	NOTYPE	<unknown>	DEFAULT	2
fmt	.symtab	0x80011d1c	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8000bf94	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x800037fc	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x800055f0	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x800075b6	32	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8000bfbc	40	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8000bfbc	40	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8000bfe4	346	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x80005640	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x8000016c	16	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0x80002f22	142	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x80000d44	56	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x800014c0	56	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x800004ac	36	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x8000e370	500	FUNC	<unknown>	DEFAULT	2
getegid	.symtab	0x80008c5c	60	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80008c98	60	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x80008cd4	60	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x80006958	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80006994	1164	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80003834	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80006e50	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80008d10	60	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4830	.symtab	0x8001a4c0	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x8001a50c	4	OBJECT	<unknown>	DEFAULT	10
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x80006846	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x80006852	22	FUNC	<unknown>	DEFAULT	2
i.4260	.symtab	0x80013f44	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x80005d38	390	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x80006928	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8000acc8	362	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x80006908	30	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x80006868	160	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8000d6f2	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8000d260	464	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x8000d430	706	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8000d200	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8000ce6c	282	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x8000cf86	634	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x80002ca8	326	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8000017c	144	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x80014098	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x80007a32	118	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x80007f46	330	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80008d4c	130	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x80006738	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x80003cc4	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x800038b4	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x80001196	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8000e302	108	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x800142d0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x80002fb0	1506	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x800142c4	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x800016a2	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x80000d7c	118	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8000735e	168	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x800013cc	244	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x8000a304	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x80005b0e	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8000a920	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8000aa40	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8000aa6c	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x80005c00	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8001419c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x8001a510	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80014290	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x80008dd0	78	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x800012a2	298	FUNC	<unknown>	DEFAULT	2
next_start.1067	.symtab	0x8001a2e0	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x80006824	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x80006830	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x800142c8	8	OBJECT	<unknown>	DEFAULT	10
object.2251	.symtab	0x800142aa	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x80003926	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x8001a534	4	OBJECT	<unknown>	DEFAULT	10
p.2168	.symtab	0x80013e44	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x8001a53c	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x8000bd9c	88	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x80003994	98	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4042	.symtab	0x80010d99	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80000844	688	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x800005f2	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8000070c	312	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x80000636	214	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x80002402	2214	FUNC	<unknown>	DEFAULT	2
qual_chars.4045	.symtab	0x80010dac	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8000e284	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80007950	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x8000020c	280	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80007960	94	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x80011992	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80007c96	266	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x800141d0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x8000cb68	274	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x800039f8	84	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x80000446	102	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x80000392	180	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x80006e94	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x80000df2	470	FUNC	<unknown>	DEFAULT	2
reset_telstate	.symtab	0x80000524	32	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x80008e20	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x8001a538	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x80001726	44	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x80003a4c	100	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x80006ecc	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x80006f04	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0x80003ab0	112	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0x80003b20	88	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0x80003b78	78	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80006f4c	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x800079be	116	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x80007b00	406	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0x80003bc8	66	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x8000ba60	232	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x80006fc0	238	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80008e8c	160	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x800085b4	558	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x80006f8c	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x800021b6	240	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x80000b40	194	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4044	.symtab	0x80010dc0	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4041	.symtab	0x80010da5	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4041	.symtab	0x80010de9	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4040	.symtab	0x80010dfe	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4043	.symtab	0x80010dd0	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4042	.symtab	0x80010de0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x80003d3c	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x80007aa8	88	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80007aa8	88	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x80007da0	422	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x80014274	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x8001a528	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x80013f60	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x80013f58	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x80013f5c	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x8000e564	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x80006668	170	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x80005d38	390	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x80005ec0	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x80005ec0	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x80005f30	92	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8000ce1c	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x80006540	264	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x80005f8c	268	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8000cc7c	310	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x80006098	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x800061d8	350	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8000ac70	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8000cdb4	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x80006338	484	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x80006714	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8000abd4	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8000822c	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x80008090	382	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x80000b18	40	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8000676c	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x800015dc	198	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x80003c0c	62	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x80008fa4	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x80003cec	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x80000544	174	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x80010e06	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x80010e1e	12	OBJECT	<unknown>	DEFAULT	4
unknown.1089	.symtab	0x80010e2a	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x800141b4	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x80013e50	236	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x80008b94	38	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x80003d70	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x80008f86	30	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x80003c4c	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x80008ff4	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x80009080	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x80009058	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x80000c02	322	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x80003c70	84	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3095	.symtab	0x80011df6	17	OBJECT	<unknown>	DEFAULT	4
zprintf	.symtab	0x80000af4	36	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 08:11:32.751651049 CEST	44510	6963	192.168.2.14	93.123.85.246
Jul 5, 2024 08:11:32.756556034 CEST	6963	44510	93.123.85.246	192.168.2.14
Jul 5, 2024 08:11:32.756624937 CEST	44510	6963	192.168.2.14	93.123.85.246
Jul 5, 2024 08:11:33.040185928 CEST	44510	6963	192.168.2.14	93.123.85.246
Jul 5, 2024 08:11:33.045093060 CEST	6963	44510	93.123.85.246	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 08:14:18.303592920 CEST	52380	53	192.168.2.14	8.8.8.8
Jul 5, 2024 08:14:18.303592920 CEST	52380	53	192.168.2.14	8.8.8.8
Jul 5, 2024 08:14:18.310488939 CEST	53	52380	8.8.8.8	192.168.2.14
Jul 5, 2024 08:14:18.310512066 CEST	53	52380	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 08:14:18.303592920 CEST	192.168.2.14	8.8.8.8	0xcfc6	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 08:14:18.303592920 CEST	192.168.2.14	8.8.8.8	0xe93a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 08:14:18.310488939 CEST	8.8.8.8	192.168.2.14	0xcfc6	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jul 5, 2024 08:14:18.310488939 CEST	8.8.8.8	192.168.2.14	0xcfc6	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Okami.m68k.elf PID: 5490, Parent PID: 5412

General

Start time (UTC):	06:11:31
Start date (UTC):	05/07/2024
Path:	/tmp/Okami.m68k.elf
Arguments:	/tmp/Okami.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Okami.m68k.elf PID: 5492, Parent PID: 5490

General

Start time (UTC):	06:11:31
Start date (UTC):	05/07/2024
Path:	/tmp/Okami.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Okami.m68k.elf PID: 5494, Parent PID: 5492

General

Start time (UTC):	06:11:31
Start date (UTC):	05/07/2024
Path:	/tmp/Okami.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Okami.m68k.elf PID: 5496, Parent PID: 5494

General

Start time (UTC):	06:11:31
Start date (UTC):	05/07/2024
Path:	/tmp/Okami.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Okami.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Okami.m68k.elf PID: 5490, Parent PID: 5412

General

Chronological Activities

Analysis Process: Okami.m68k.elf PID: 5492, Parent PID: 5490

General

Chronological Activities

Analysis Process: Okami.m68k.elf PID: 5494, Parent PID: 5492

General

Chronological Activities

Analysis Process: Okami.m68k.elf PID: 5496, Parent PID: 5494

General

Chronological Activities

Linux Analysis Report
Okami.m68k.elf