Edit tour

Linux Analysis Report
hidakibest.ppc.elf

Overview

General Information

Sample name:	hidakibest.ppc.elf
Analysis ID:	1543176
MD5:	577294d22557723f626b32b88f43c4a8
SHA1:	8d8453b3063122bf8a5b0ea358eca11abb122a79
SHA256:	27a16188568d10260142ac8cbd9457c89cca685a60a31bb7992d017cd8289c31
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543176
Start date and time:	2024-10-27 10:19:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	hidakibest.ppc.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/1@2/0

Warnings

VT rate limit hit for: hidakibest.ppc.elf

Runtime Messages

Command:	/tmp/hidakibest.ppc.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

hidakibest.ppc.elf (PID: 5435, Parent: 5359, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/hidakibest.ppc.elf

hidakibest.ppc.elf New Fork (PID: 5437, Parent: 5435)

hidakibest.ppc.elf New Fork (PID: 5439, Parent: 5437)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hidakibest.ppc.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
hidakibest.ppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
hidakibest.ppc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
hidakibest.ppc.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5437.1.00007ff784001000.00007ff784015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5437.1.00007ff784001000.00007ff784015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5437.1.00007ff784001000.00007ff784015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5437.1.00007ff784001000.00007ff784015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5435.1.00007ff784001000.00007ff784015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5435.1.00007ff784001000.00007ff784015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.00007ff784001000.00007ff784015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1179c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5435.1.00007ff784001000.00007ff784015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11738:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.ppc.elf PID: 5435	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.ppc.elf PID: 5435	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3b46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3baa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3be6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bfa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.ppc.elf PID: 5435	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3af9:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3f6b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hidakibest.ppc.elf PID: 5437	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hidakibest.ppc.elf PID: 5437	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x42c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4301:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4315:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4329:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x433d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4351:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4365:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4379:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x438d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4405:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4419:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x442d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4441:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4455:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hidakibest.ppc.elf PID: 5437	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x4278:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x46ea:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hidakibest.ppc.elf

Avira: detected

Found malware configuration

Source: hidakibest.ppc.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "94.141.123.127:4258"}

Multi AV Scanner detection for submitted file

Source: hidakibest.ppc.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/hidakibest.ppc.elf (PID: 5435)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:45286 -> 94.141.123.127:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.123.127

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: hidakibest.ppc.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: hidakibest.ppc.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: hidakibest.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: hidakibest.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: hidakibest.ppc.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hidakibest.ppc.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: hidakibest.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hidakibest.ppc.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/1@2/0

Source: /tmp/hidakibest.ppc.elf (PID: 5435)

Queries kernel information via 'uname':

Jump to behavior

Source: hidakibest.ppc.elf, 5435.1.000055619f6ca000.000055619f77a000.rw-.sdmp, hidakibest.ppc.elf, 5437.1.000055619f6ca000.000055619f77a000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: hidakibest.ppc.elf, 5435.1.00007ffed41c0000.00007ffed41e1000.rw-.sdmp, hidakibest.ppc.elf, 5437.1.00007ffed41c0000.00007ffed41e1000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/hidakibest.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hidakibest.ppc.elf
Source: hidakibest.ppc.elf, 5435.1.000055619f6ca000.000055619f77a000.rw-.sdmp, hidakibest.ppc.elf, 5437.1.000055619f6ca000.000055619f77a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: hidakibest.ppc.elf, 5435.1.00007ffed41c0000.00007ffed41e1000.rw-.sdmp, hidakibest.ppc.elf, 5437.1.00007ffed41c0000.00007ffed41e1000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: hidakibest.ppc.elf, 5435.1.00007ffed41c0000.00007ffed41e1000.rw-.sdmp	Binary or memory string: aU/tmp/qemu-open.jg0Ofa\
Source: hidakibest.ppc.elf, 5435.1.00007ffed41c0000.00007ffed41e1000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.jg0Ofa

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5437, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: hidakibest.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007ff784001000.00007ff784015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hidakibest.ppc.elf PID: 5437, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "94.141.123.127:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hidakibest.ppc.elf	66%	ReversingLabs	Linux.Trojan.Mirai
hidakibest.ppc.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
94.141.123.127:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	hidakibest.ppc.elf	false		unknown
http://www.billybobbot.com/crawler/)	hidakibest.ppc.elf	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	hidakibest.ppc.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	hidakibest.ppc.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	hidakibest.ppc.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.141.123.127	unknown	Russian Federation		43429	UNITLINE_RST_NET1RostovnaDonuRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.141.123.127	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	bot-x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	jklarm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNITLINE_RST_NET1RostovnaDonuRU	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	94.141.123.127
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	fd5P4igezR.exe	Get hash	malicious	Stealc	Browse	94.141.122.159
	uCEeVGAWIB.exe	Get hash	malicious	Stealc	Browse	94.141.122.159

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.jg0Ofa (deleted)

Download File

Process:	/tmp/hidakibest.ppc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.152477289240827
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	hidakibest.ppc.elf
File size:	108'983 bytes
MD5:	577294d22557723f626b32b88f43c4a8
SHA1:	8d8453b3063122bf8a5b0ea358eca11abb122a79
SHA256:	27a16188568d10260142ac8cbd9457c89cca685a60a31bb7992d017cd8289c31
SHA512:	48e97168101ef46b575afb9abdcb49a9120e58053941d0eaa5c66cf635c5279dfd4cbe35ac7c28bdd4e3b8c4aa435f942f5cd42ea9e109b21b559e25a8f92550
SSDEEP:	3072:gQiBqcL95J6qEWLE3SW5h7wLYm7ArEfT3n:gQiBClWLK5hkEm7ArEfT3n
TLSH:	D2B34C03A3190F43D5CB49B02DEB27F143AAE9E112B36182A61EAF9457B37791153F86
File Content Preview:	.ELF...........................4..O......4. ...(......................>h..>h..............@...@...@.......t...............@T..@T..@T................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........D,..../...@..`= .

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10000218
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	85932
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100000b4	0xb4	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000d8	0xd8	0xfa1c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1000faf4	0xfaf4	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1000fb18	0xfb18	0x4350	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x10024000	0x14000	0x54	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x10024054	0x14054	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x10024054	0x14054	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002405c	0x1405c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x10024064	0x14064	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x10024068	0x14068	0x2c2	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x1002432c	0x1432c	0x10	0x4	0x7	WAX	0	0	4
.sdata	PROGBITS	0x1002433c	0x1433c	0x56	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x10024398	0x14392	0x94	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x1002442c	0x14392	0x708c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x14392	0xb9a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x14f2c	0x7e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x152a4	0x30e0	0x10	0x0		18	281	4
.strtab	STRTAB	0x0	0x18384	0x2633	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x13e68	0x13e68	6.2419	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x14000	0x10024000	0x10024000	0x392	0x74b8	4.5409	0x7	RWE	0x10000	.eh_frame .tbss .ctors .dtors .jcr .data .got .sdata .sbss .bss
TLS	0x14054	0x10024054	0x10024054	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x100000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000d8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1000faf4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1000fb18	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x10024000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1002405c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x10024064	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x10024068	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1002432c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1002433c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x10024398	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x1002442c	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.3.5322	.symtab	0x100139dc	12	OBJECT	<unknown>	DEFAULT	4
C.3.6030	.symtab	0x10012980	12	OBJECT	<unknown>	DEFAULT	4
C.3.6052	.symtab	0x10013d24	12	OBJECT	<unknown>	DEFAULT	4
C.3.6106	.symtab	0x10013d18	12	OBJECT	<unknown>	DEFAULT	4
C.4.5416	.symtab	0x10013d00	24	OBJECT	<unknown>	DEFAULT	4
C.4.6053	.symtab	0x10013d30	12	OBJECT	<unknown>	DEFAULT	4
C.6.6061	.symtab	0x10013d3c	12	OBJECT	<unknown>	DEFAULT	4
C.69.5522	.symtab	0x100111e0	104	OBJECT	<unknown>	DEFAULT	4
C.7.5462	.symtab	0x100139e8	12	OBJECT	<unknown>	DEFAULT	4
C.76.5621	.symtab	0x10011e74	1128	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x10024448	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0x100022a4	424	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x10001e64	424	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x10002158	332	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x10024330	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_SDA_BASE_	.symtab	0x1002c33c	0	NOTYPE	<unknown>	DEFAULT	12
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x10024058	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x10024054	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x10012380	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x100139fe	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x10012680	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x10024060	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x1002405c	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x10024000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x10024050	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	HIDDEN	12
__GI___close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	HIDDEN	2
__GI___waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x100047b8	92	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x10007a4c	248	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10008064	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1000d06c	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x10004814	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x10009928	212	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1000a034	80	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1000a084	84	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x10009d00	820	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10006814	120	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x10008230	136	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1000a200	640	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1000a480	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x10008670	824	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x100096a0	16	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x100096c0	16	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x10008b40	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x10009720	16	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x100066a4	4	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x100066a8	4	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x10004574	228	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1000c478	44	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x1000497c	24	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x10004848	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10005e64	144	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x10009730	52	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1000d150	52	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x10009764	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1000f37c	120	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10008b78	148	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x10007b48	104	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x10007d18	140	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x10006928	128	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x100048b0	136	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x100069dc	128	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x10004938	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x10006a90	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10006028	32	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1000f514	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10006048	160	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1000c358	72	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x100061d4	240	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1000647c	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x10008070	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x10008400	624	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1000496c	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x10004994	32	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1000f470	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x100243dc	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x10024244	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10009238	96	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1000ee94	144	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x10024414	4	OBJECT	<unknown>	DEFAULT	13
__data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x1000e25c	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1000f64c	188	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x1000e374	1672	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1000fa88	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000d8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x10024068	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x1000f9bc	204	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1000f564	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1000f708	124	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
__errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x100243c0	4	OBJECT	<unknown>	HIDDEN	13
__fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x100243c4	4	OBJECT	<unknown>	HIDDEN	13
__fork_handlers	.symtab	0x100243c8	4	OBJECT	<unknown>	HIDDEN	13
__fork_lock	.symtab	0x100243cc	4	OBJECT	<unknown>	HIDDEN	13
__get_hosts_byname_r	.symtab	0x1000ef24	88	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1000d334	344	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1000902c	124	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x100090a8	172	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1000cd5c	464	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x100243d0	4	OBJECT	<unknown>	DEFAULT	13
__libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x100089a8	52	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x10008d30	120	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x10013df0	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x10007634	460	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x10006bfc	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x10024168	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x1002b140	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x1000757c	184	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x10024420	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x10024424	4	OBJECT	<unknown>	HIDDEN	13
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1000f784	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1000ea80	1044	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x100243d8	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x1000cf2c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1000915c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1000f790	556	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x10024418	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x10024391	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x1002b0d8	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x10024390	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x100243e0	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x1002441c	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x10024428	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1000f268	88	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1000cfc0	172	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x1002437c	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1000d630	120	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1000d6a8	264	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1000d7b0	212	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1000a874	364	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1000d884	72	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1000d97c	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1000d8cc	176	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1000ab9c	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1000aca0	76	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x10024380	4	OBJECT	<unknown>	DEFAULT	12
__sys_connect	.symtab	0x100067e0	52	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x100068f4	52	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x100069a8	52	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x10009644	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x10009798	52	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1000f348	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1000d0a0	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1000487c	52	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x100092fc	840	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1002435c	4	OBJECT	<unknown>	HIDDEN	12
__waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel	.symtab	0x10008fb4	16	FUNC	<unknown>	DEFAULT	2
__write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1000d268	204	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1000d184	228	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x10028448	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x10004b30	100	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x1002b0f0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x1002b118	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x10024358	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x1000cf38	28	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x1002438c	4	OBJECT	<unknown>	DEFAULT	12
_dl_nothread_init_static_tls	.symtab	0x1000cf54	108	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x1002440c	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x10024410	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_gaps	.symtab	0x10024400	1	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_slotinfo_list	.symtab	0x100243fc	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_generation	.symtab	0x10024404	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_max_dtv_idx	.symtab	0x100243f4	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_setup	.symtab	0x1000cd0c	80	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x100243f0	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_nelem	.symtab	0x10024408	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_size	.symtab	0x100243f8	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_used	.symtab	0x100243ec	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x1002b4b8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1000faf4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x10028b94	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x10004b94	152	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1000aea0	1784	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x100000b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1000acec	128	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x10005324	188	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x100056dc	1488	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x100053e0	92	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1000543c	608	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1000569c	64	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x10009170	56	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10009164	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x10009660	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x100243b8	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x10000218	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1000a48c	1000	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1000a9e0	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x10024384	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x10028b7c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1000b7bc	540	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x100243e8	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x10028b88	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x100243e4	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x1002425c	204	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x1000aa60	316	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x10024388	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x10008078	440	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1000ad6c	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x10012a4c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1000ada8	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x10004c2c	1784	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x10007a4c	248	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x10006410	16	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x10028634	4	OBJECT	<unknown>	DEFAULT	14
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1000d06c	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
buf.4826	.symtab	0x10028458	16	OBJECT	<unknown>	DEFAULT	14
buf.6501	.symtab	0x1002847c	440	OBJECT	<unknown>	DEFAULT	14
bzero	.symtab	0x10006420	12	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x10024160	4	OBJECT	<unknown>	DEFAULT	10
call___do_global_ctors_aux	.symtab	0x1000fad8	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x10000170	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001fc	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1000c830	264	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x10004814	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x10009928	212	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x1002433c	4	OBJECT	<unknown>	DEFAULT	12
completed.5580	.symtab	0x1002442c	0	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x100018c0	656	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x10024344	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x10024340	4	OBJECT	<unknown>	DEFAULT	12
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x10008230	136	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x10013d60	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1000a200	640	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x100099fc	184	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x10000510	232	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x10009b84	184	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x10013d48	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1000a480	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x10028638	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x1000018c	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x10007800	524	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x100031b8	40	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10001550	124	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x100005f8	648	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x100004a0	112	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x100096a0	16	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x100096c0	16	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x100068c0	52	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x10009720	16	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6500	.symtab	0x10028468	20	OBJECT	<unknown>	DEFAULT	14
htonl	.symtab	0x100066a4	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x100066a8	4	FUNC	<unknown>	DEFAULT	2
i.4865	.symtab	0x10024164	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x1000de30	340	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x1000db48	220	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10003bd0	412	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x10000260	232	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x1000ccd0	60	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x10007c2c	132	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x10004574	228	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1000c478	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x1000497c	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x10004848	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6558	.symtab	0x10024328	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.6557	.symtab	0x1002b0d0	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x10001b50	460	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x100243a8	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0x10003d6c	2056	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x10024398	4	OBJECT	<unknown>	DEFAULT	13
malloc	.symtab	0x10006c6c	2320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x10007a0c	64	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x10005e64	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x10009730	52	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x1000d150	52	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x10009764	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x10024180	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x10024198	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1347	.symtab	0x10028454	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x100082b8	328	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x100243a0	8	OBJECT	<unknown>	DEFAULT	13
object.5595	.symtab	0x10024430	0	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x100243b0	4	OBJECT	<unknown>	DEFAULT	13
ovhl7	.symtab	0x1000244c	3436	FUNC	<unknown>	DEFAULT	2
p.5578	.symtab	0x1002406c	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x100243b4	4	OBJECT	<unknown>	DEFAULT	13
poll	.symtab	0x1000f37c	120	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6256	.symtab	0x10012994	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10000e00	1568	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x100009dc	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10000c00	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10000a5c	420	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x100031e0	2544	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
program_invocation_short_name	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
qual_chars.6264	.symtab	0x100129dc	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x10008b78	148	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x10007b44	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10000348	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x10007b48	104	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x100135a8	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x10007d18	140	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x100241c4	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1000c938	920	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x100015cc	756	FUNC	<unknown>	DEFAULT	2
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6540	.symtab	0x1002b0d4	4	OBJECT	<unknown>	DEFAULT	14
rindex	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x10004938	52	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x10007bb0	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x1000ea3c	68	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x1000e9fc	64	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x10006a90	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x10001d1c	328	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x10001420	304	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6263	.symtab	0x10012a0a	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6255	.symtab	0x1001298c	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6260	.symtab	0x10012a1c	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6259	.symtab	0x10012a34	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6262	.symtab	0x100129fa	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6261	.symtab	0x100129f0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x1002ae9c	512	OBJECT	<unknown>	DEFAULT	14
static_map	.symtab	0x1002b09c	52	OBJECT	<unknown>	DEFAULT	14
static_slotinfo	.symtab	0x1002ab94	776	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x10024378	4	OBJECT	<unknown>	DEFAULT	12
stdin	.symtab	0x10024370	4	OBJECT	<unknown>	DEFAULT	12
stdout	.symtab	0x10024374	4	OBJECT	<unknown>	DEFAULT	12
strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x10006028	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x1000f514	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x10006048	160	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x1000c358	72	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x100061d4	240	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1000647c	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x10008070	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x10008400	624	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x1000496c	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x10004994	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x10000880	348	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x100129b8	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x100129d0	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x1000f470	52	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1370	.symtab	0x10012a3c	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x100241b0	20	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x10024074	236	OBJECT	<unknown>	DEFAULT	10
vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
xdigits.5264	.symtab	0x10013dd4	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x1000200c	332	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 10:20:41.944638014 CET	45286	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:41.950227976 CET	4258	45286	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:41.950320005 CET	45286	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:41.952263117 CET	45286	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:41.957627058 CET	4258	45286	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:50.445473909 CET	4258	45286	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:50.445930004 CET	45286	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:50.446471930 CET	45288	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:50.451354027 CET	4258	45286	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:50.451812029 CET	4258	45288	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:50.451878071 CET	45288	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:50.451994896 CET	45288	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:50.457397938 CET	4258	45288	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:58.949991941 CET	4258	45288	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:58.950426102 CET	45288	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:58.951242924 CET	45290	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:58.956299067 CET	4258	45288	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:58.957178116 CET	4258	45290	94.141.123.127	192.168.2.13
Oct 27, 2024 10:20:58.957252979 CET	45290	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:58.957290888 CET	45290	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:20:58.963208914 CET	4258	45290	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:07.464598894 CET	4258	45290	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:07.465281010 CET	45290	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:07.466804028 CET	45292	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:07.471232891 CET	4258	45290	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:07.472667933 CET	4258	45292	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:07.472868919 CET	45292	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:07.473031044 CET	45292	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:07.478486061 CET	4258	45292	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:15.962881088 CET	4258	45292	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:15.963779926 CET	45292	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:15.965549946 CET	45294	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:15.969670057 CET	4258	45292	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:15.971086979 CET	4258	45294	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:15.971247911 CET	45294	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:15.971465111 CET	45294	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:15.976824999 CET	4258	45294	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:24.462346077 CET	4258	45294	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:24.462697983 CET	45294	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:24.463793039 CET	45296	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:24.468170881 CET	4258	45294	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:24.469225883 CET	4258	45296	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:24.469301939 CET	45296	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:24.469377995 CET	45296	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:24.474679947 CET	4258	45296	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:32.952853918 CET	4258	45296	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:32.953442097 CET	45296	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:32.954514980 CET	45298	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:32.958844900 CET	4258	45296	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:32.960051060 CET	4258	45298	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:32.960186958 CET	45298	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:32.960314989 CET	45298	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:32.965859890 CET	4258	45298	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:41.437865019 CET	4258	45298	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:41.438388109 CET	45298	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:41.439992905 CET	45300	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:41.444051027 CET	4258	45298	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:41.445574999 CET	4258	45300	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:41.445804119 CET	45300	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:41.445893049 CET	45300	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:41.451416969 CET	4258	45300	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:49.920836926 CET	4258	45300	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:49.921282053 CET	45300	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:49.923151016 CET	45302	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:49.926718950 CET	4258	45300	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:49.928548098 CET	4258	45302	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:49.928616047 CET	45302	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:49.928761005 CET	45302	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:49.934103012 CET	4258	45302	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:58.423896074 CET	4258	45302	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:58.424289942 CET	45302	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:58.425065994 CET	45304	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:58.429742098 CET	4258	45302	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:58.430461884 CET	4258	45304	94.141.123.127	192.168.2.13
Oct 27, 2024 10:21:58.430542946 CET	45304	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:58.430625916 CET	45304	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:21:58.436501026 CET	4258	45304	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:07.653453112 CET	4258	45304	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:07.653697014 CET	4258	45304	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:07.653711081 CET	4258	45304	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:07.653948069 CET	45304	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:07.653949022 CET	45304	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:07.653949022 CET	45304	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:07.655491114 CET	45306	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:07.659590960 CET	4258	45304	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:07.660875082 CET	4258	45306	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:07.661029100 CET	45306	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:07.661145926 CET	45306	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:07.666601896 CET	4258	45306	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:16.147577047 CET	4258	45306	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:16.148108006 CET	45306	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:16.149410009 CET	45308	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:16.153585911 CET	4258	45306	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:16.154871941 CET	4258	45308	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:16.154949903 CET	45308	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:16.155160904 CET	45308	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:16.160701036 CET	4258	45308	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:24.633498907 CET	4258	45308	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:24.633878946 CET	45308	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:24.635962009 CET	45310	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:24.640316010 CET	4258	45308	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:24.641396999 CET	4258	45310	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:24.641535997 CET	45310	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:24.641760111 CET	45310	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:24.647545099 CET	4258	45310	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:33.130549908 CET	4258	45310	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:33.131002903 CET	45310	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:33.133285046 CET	45312	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:33.136631966 CET	4258	45310	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:33.138907909 CET	4258	45312	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:33.139216900 CET	45312	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:33.139337063 CET	45312	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:33.144917965 CET	4258	45312	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:41.616063118 CET	4258	45312	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:41.616723061 CET	45312	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:41.618952990 CET	45314	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:41.622672081 CET	4258	45312	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:41.624604940 CET	4258	45314	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:41.624905109 CET	45314	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:41.624990940 CET	45314	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:41.630494118 CET	4258	45314	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:50.121499062 CET	4258	45314	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:50.121892929 CET	45314	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:50.123045921 CET	45316	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:50.127257109 CET	4258	45314	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:50.128473997 CET	4258	45316	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:50.128554106 CET	45316	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:50.128627062 CET	45316	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:50.133897066 CET	4258	45316	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:58.614027977 CET	4258	45316	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:58.614412069 CET	45316	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:58.616259098 CET	45318	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:58.620168924 CET	4258	45316	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:58.621911049 CET	4258	45318	94.141.123.127	192.168.2.13
Oct 27, 2024 10:22:58.622000933 CET	45318	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:58.622082949 CET	45318	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:22:58.627758980 CET	4258	45318	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:07.116197109 CET	4258	45318	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:07.116682053 CET	45318	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:07.117988110 CET	45320	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:07.122366905 CET	4258	45318	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:07.125660896 CET	4258	45320	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:07.125772953 CET	45320	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:07.125932932 CET	45320	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:07.132592916 CET	4258	45320	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:15.619273901 CET	4258	45320	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:15.619775057 CET	45320	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:15.620554924 CET	45322	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:15.625495911 CET	4258	45320	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:15.626240969 CET	4258	45322	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:15.626432896 CET	45322	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:15.626432896 CET	45322	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:15.632034063 CET	4258	45322	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:24.297997952 CET	4258	45322	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:24.298264980 CET	45322	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:24.298860073 CET	45324	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:24.305577040 CET	4258	45322	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:24.305876017 CET	4258	45324	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:24.306027889 CET	45324	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:24.306027889 CET	45324	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:24.313301086 CET	4258	45324	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:32.785654068 CET	4258	45324	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:32.786065102 CET	45324	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:32.787094116 CET	45326	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:32.792623043 CET	4258	45324	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:32.792665958 CET	4258	45326	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:32.792730093 CET	45326	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:32.792785883 CET	45326	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:32.798208952 CET	4258	45326	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:41.301211119 CET	4258	45326	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:41.301470041 CET	45326	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:41.302892923 CET	45328	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:41.306997061 CET	4258	45326	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:41.308468103 CET	4258	45328	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:41.308527946 CET	45328	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:41.308572054 CET	45328	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:41.313977957 CET	4258	45328	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:49.791630983 CET	4258	45328	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:49.792057037 CET	45328	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:49.793648005 CET	45330	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:49.797658920 CET	4258	45328	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:49.799103975 CET	4258	45330	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:49.799213886 CET	45330	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:49.799264908 CET	45330	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:49.804688931 CET	4258	45330	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:58.286453962 CET	4258	45330	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:58.286851883 CET	45330	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:58.287695885 CET	45332	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:58.294621944 CET	4258	45330	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:58.295056105 CET	4258	45332	94.141.123.127	192.168.2.13
Oct 27, 2024 10:23:58.295135021 CET	45332	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:58.295172930 CET	45332	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:23:58.302823067 CET	4258	45332	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:06.796230078 CET	4258	45332	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:06.796833992 CET	45332	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:06.798666954 CET	45334	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:06.802432060 CET	4258	45332	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:06.804302931 CET	4258	45334	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:06.804419994 CET	45334	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:06.804645061 CET	45334	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:06.810410023 CET	4258	45334	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:15.286689043 CET	4258	45334	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:15.287381887 CET	45334	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:15.288855076 CET	45336	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:15.293153048 CET	4258	45334	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:15.294466972 CET	4258	45336	94.141.123.127	192.168.2.13
Oct 27, 2024 10:24:15.294584036 CET	45336	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:15.294734001 CET	45336	4258	192.168.2.13	94.141.123.127
Oct 27, 2024 10:24:15.300457954 CET	4258	45336	94.141.123.127	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 10:23:24.080698013 CET	40147	53	192.168.2.13	1.1.1.1
Oct 27, 2024 10:23:24.080698967 CET	45885	53	192.168.2.13	1.1.1.1
Oct 27, 2024 10:23:24.300743103 CET	53	45885	1.1.1.1	192.168.2.13
Oct 27, 2024 10:23:24.301537991 CET	53	40147	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 10:23:24.080698013 CET	192.168.2.13	1.1.1.1	0xd506	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 10:23:24.080698967 CET	192.168.2.13	1.1.1.1	0xce1e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 10:23:24.301537991 CET	1.1.1.1	192.168.2.13	0xd506	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 27, 2024 10:23:24.301537991 CET	1.1.1.1	192.168.2.13	0xd506	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: hidakibest.ppc.elf PID: 5435, Parent PID: 5359

General

Start time (UTC):	09:20:40
Start date (UTC):	27/10/2024
Path:	/tmp/hidakibest.ppc.elf
Arguments:	/tmp/hidakibest.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: hidakibest.ppc.elf PID: 5437, Parent PID: 5435

General

Start time (UTC):	09:20:40
Start date (UTC):	27/10/2024
Path:	/tmp/hidakibest.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: hidakibest.ppc.elf PID: 5439, Parent PID: 5437

General

Start time (UTC):	09:20:40
Start date (UTC):	27/10/2024
Path:	/tmp/hidakibest.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report hidakibest.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.jg0Ofa (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: hidakibest.ppc.elf PID: 5435, Parent PID: 5359

General

Chronological Activities

Analysis Process: hidakibest.ppc.elf PID: 5437, Parent PID: 5435

General

Chronological Activities

Analysis Process: hidakibest.ppc.elf PID: 5439, Parent PID: 5437

General

Chronological Activities

Linux Analysis Report
hidakibest.ppc.elf