Edit tour

Linux Analysis Report
Demon.m68k.elf

Overview

General Information

Sample name:	Demon.m68k.elf
Analysis ID:	1551349
MD5:	e25b5dcd05d71b290df80c88d8a6abed
SHA1:	95aeb3989b6970662ebfa2fc496dd0163b3bb084
SHA256:	27c02589200c27a0b1310bba6e56ff4e4737704b6a2136bfdbc120fd961a2805
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551349
Start date and time:	2024-11-07 17:12:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Demon.m68k.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/1@2/0

Warnings

VT rate limit hit for: Demon.m68k.elf

Runtime Messages

Command:	/tmp/Demon.m68k.elf
PID:	5420
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

Demon.m68k.elf (PID: 5420, Parent: 5344, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/Demon.m68k.elf

Demon.m68k.elf New Fork (PID: 5422, Parent: 5420)

Demon.m68k.elf New Fork (PID: 5424, Parent: 5422)

dash New Fork (PID: 5469, Parent: 3585)

rm (PID: 5469, Parent: 3585, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.4dfcNTFbB3 /tmp/tmp.erTs7qes6H /tmp/tmp.xxikXpPsmS

dash New Fork (PID: 5470, Parent: 3585)

rm (PID: 5470, Parent: 3585, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.4dfcNTFbB3 /tmp/tmp.erTs7qes6H /tmp/tmp.xxikXpPsmS

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Demon.m68k.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
Demon.m68k.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xde21:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5422.1.00007f9ecc001000.00007f9ecc011000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xde21:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5420.1.00007f9ecc001000.00007f9ecc011000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xde21:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: Demon.m68k.elf PID: 5420	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x77ff:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x7953:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: Demon.m68k.elf PID: 5422	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x66b2:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x6806:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Suricata Signatures

ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:13:35.452758+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59554	163.172.49.146	666	TCP
2024-11-07T17:13:43.966901+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59556	163.172.49.146	666	TCP
2024-11-07T17:13:52.456692+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59558	163.172.49.146	666	TCP
2024-11-07T17:14:00.941259+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59560	163.172.49.146	666	TCP
2024-11-07T17:14:09.438138+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59562	163.172.49.146	666	TCP
2024-11-07T17:14:17.926673+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59564	163.172.49.146	666	TCP
2024-11-07T17:14:26.434237+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59566	163.172.49.146	666	TCP
2024-11-07T17:14:34.923624+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59568	163.172.49.146	666	TCP
2024-11-07T17:14:43.431024+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59570	163.172.49.146	666	TCP
2024-11-07T17:14:51.931827+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59572	163.172.49.146	666	TCP
2024-11-07T17:15:00.424010+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59574	163.172.49.146	666	TCP
2024-11-07T17:15:08.907583+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59576	163.172.49.146	666	TCP
2024-11-07T17:15:17.389621+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59578	163.172.49.146	666	TCP
2024-11-07T17:15:25.877298+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59580	163.172.49.146	666	TCP
2024-11-07T17:15:34.373163+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59582	163.172.49.146	666	TCP
2024-11-07T17:15:42.870086+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59584	163.172.49.146	666	TCP
2024-11-07T17:15:51.356391+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59586	163.172.49.146	666	TCP
2024-11-07T17:15:59.843569+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59588	163.172.49.146	666	TCP
2024-11-07T17:16:08.320752+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59590	163.172.49.146	666	TCP
2024-11-07T17:16:16.807477+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59592	163.172.49.146	666	TCP
2024-11-07T17:16:25.298004+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59594	163.172.49.146	666	TCP
2024-11-07T17:16:33.787125+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59596	163.172.49.146	666	TCP
2024-11-07T17:16:42.300985+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59598	163.172.49.146	666	TCP
2024-11-07T17:16:50.789100+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59600	163.172.49.146	666	TCP
2024-11-07T17:16:59.567393+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59602	163.172.49.146	666	TCP
2024-11-07T17:17:08.054785+0100	2837021	1	Malware Command and Control Activity Detected	192.168.2.13	59604	163.172.49.146	666	TCP

ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59584	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59594	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59570	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59580	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59560	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59590	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59568	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59562	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59592	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59586	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59572	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59554	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59596	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59576	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59566	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59582	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59604	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59598	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59574	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59558	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59556	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59564	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59578	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59602	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59588	163.172.49.146	666	TCP
2024-11-07T17:13:35.452758+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59554	163.172.49.146	666	TCP
2024-11-07T17:13:43.966901+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59556	163.172.49.146	666	TCP
2024-11-07T17:13:52.456692+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59558	163.172.49.146	666	TCP
2024-11-07T17:14:00.941259+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59560	163.172.49.146	666	TCP
2024-11-07T17:14:09.438138+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59562	163.172.49.146	666	TCP
2024-11-07T17:14:17.926673+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59564	163.172.49.146	666	TCP
2024-11-07T17:14:26.434237+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59566	163.172.49.146	666	TCP
2024-11-07T17:14:34.923624+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59568	163.172.49.146	666	TCP
2024-11-07T17:14:43.431024+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59570	163.172.49.146	666	TCP
2024-11-07T17:14:51.931827+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59572	163.172.49.146	666	TCP
2024-11-07T17:15:00.424010+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59574	163.172.49.146	666	TCP
2024-11-07T17:15:08.907583+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59576	163.172.49.146	666	TCP
2024-11-07T17:15:17.389621+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59578	163.172.49.146	666	TCP
2024-11-07T17:15:25.877298+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59580	163.172.49.146	666	TCP
2024-11-07T17:15:34.373163+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59582	163.172.49.146	666	TCP
2024-11-07T17:15:42.870086+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59584	163.172.49.146	666	TCP
2024-11-07T17:15:51.356391+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59586	163.172.49.146	666	TCP
2024-11-07T17:15:59.843569+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59588	163.172.49.146	666	TCP
2024-11-07T17:16:08.320752+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59590	163.172.49.146	666	TCP
2024-11-07T17:16:16.807477+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59592	163.172.49.146	666	TCP
2024-11-07T17:16:25.298004+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59594	163.172.49.146	666	TCP
2024-11-07T17:16:33.787125+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59596	163.172.49.146	666	TCP
2024-11-07T17:16:42.300985+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59598	163.172.49.146	666	TCP
2024-11-07T17:16:50.789100+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59600	163.172.49.146	666	TCP
2024-11-07T17:16:59.564030+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59600	163.172.49.146	666	TCP
2024-11-07T17:16:59.567393+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59602	163.172.49.146	666	TCP
2024-11-07T17:17:08.054785+0100	2841512	1	Malware Command and Control Activity Detected	192.168.2.13	59604	163.172.49.146	666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Demon.m68k.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "163.172.49.146:666"}

Multi AV Scanner detection for submitted file

Source: Demon.m68k.elf

ReversingLabs: Detection: 63%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/Demon.m68k.elf (PID: 5420)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59588 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59592 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59592 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59566 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59584 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59584 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59558 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59564 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59562 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59554 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59562 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59598 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59580 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59598 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59588 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59566 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59590 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59604 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59604 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59590 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59582 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59582 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59576 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59576 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59574 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59574 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59556 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59568 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59568 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59594 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59560 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59560 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59602 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59602 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59558 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59564 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59600 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59586 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59586 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59556 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59572 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59596 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59572 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59596 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59570 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59580 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59600 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59554 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59594 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59570 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2837021 - Severity 1 - ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2 : 192.168.2.13:59578 -> 163.172.49.146:666
Source: Network traffic	Suricata IDS: 2841512 - Severity 1 - ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin : 192.168.2.13:59578 -> 163.172.49.146:666

Source: global traffic

TCP traffic: 192.168.2.13:59554 -> 163.172.49.146:666

Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknown	TCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.49.146

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57214
Source: unknown	Network traffic detected: HTTP traffic on port 57214 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Demon.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5422.1.00007f9ecc001000.00007f9ecc011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5420.1.00007f9ecc001000.00007f9ecc011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: Demon.m68k.elf PID: 5420, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: Demon.m68k.elf PID: 5422, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Demon.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5422.1.00007f9ecc001000.00007f9ecc011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5420.1.00007f9ecc001000.00007f9ecc011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: Demon.m68k.elf PID: 5420, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: Demon.m68k.elf PID: 5422, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/1@2/0

Source: Demon.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crt1.S
Source: Demon.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crti.S
Source: Demon.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crtn.S

Source: /usr/bin/dash (PID: 5469)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.4dfcNTFbB3 /tmp/tmp.erTs7qes6H /tmp/tmp.xxikXpPsmS			Jump to behavior
Source: /usr/bin/dash (PID: 5470)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.4dfcNTFbB3 /tmp/tmp.erTs7qes6H /tmp/tmp.xxikXpPsmS			Jump to behavior

Source: /tmp/Demon.m68k.elf (PID: 5420)

Queries kernel information via 'uname':

Jump to behavior

Source: Demon.m68k.elf, 5420.1.00007ffca5a02000.00007ffca5a23000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.hhCLy0
Source: Demon.m68k.elf, 5420.1.0000565006e97000.0000565006efb000.rw-.sdmp, Demon.m68k.elf, 5422.1.0000565006e97000.0000565006efb000.rw-.sdmp	Binary or memory string: PV!/etc/qemu-binfmt/m68k
Source: Demon.m68k.elf, 5420.1.00007ffca5a02000.00007ffca5a23000.rw-.sdmp	Binary or memory string: PV/tmp/qemu-open.hhCLy0\
Source: Demon.m68k.elf, 5420.1.00007ffca5a02000.00007ffca5a23000.rw-.sdmp, Demon.m68k.elf, 5422.1.00007ffca5a02000.00007ffca5a23000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: Demon.m68k.elf, 5420.1.00007ffca5a02000.00007ffca5a23000.rw-.sdmp, Demon.m68k.elf, 5422.1.00007ffca5a02000.00007ffca5a23000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/Demon.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Demon.m68k.elf
Source: Demon.m68k.elf, 5420.1.0000565006e97000.0000565006efb000.rw-.sdmp, Demon.m68k.elf, 5422.1.0000565006e97000.0000565006efb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: Demon.m68k.elf, type: SAMPLE

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin

Yara detected Gafgyt

Source: Yara match

File source: Demon.m68k.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "163.172.49.146:666"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Demon.m68k.elf	63%	ReversingLabs	Linux.Network.LightAidra

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
163.172.49.146:666	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
163.172.49.146:666	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.247.62.1	unknown	United States		16509	AMAZON-02US	false
163.172.49.146	unknown	United Kingdom		12876	OnlineSASFR	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.247.62.1	nuklear.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse
	686i.elf	Get hash	malicious	Mirai	Browse
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	main_mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
	bot.spc.elf	Get hash	malicious	Mirai, Okiru	Browse
163.172.49.146	Demon.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse
163.172.49.146	Demon.arm6.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Demon.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	Demon.arm6.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	assailant.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	assailant.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	assailant.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	assailant.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	assailant.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	assailant.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	assailant.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
	http://ebook-hunter.org	Get hash	malicious	Unknown	Browse	143.204.215.117
	Vakhdevi Resume 2024.js	Get hash	malicious	GookitLoader	Browse	13.248.207.119
	Vakhdevi Resume 2024.js	Get hash	malicious	GookitLoader	Browse	13.248.207.119
	https://airtable.com/appghQwrDrrrgLn7v/shrt3wUeRvHDcMT9u	Get hash	malicious	Unknown	Browse	108.138.7.118
	assailant.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.217.10.153
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
	https://gofile.me/7wODs/99hfK37gz	Get hash	malicious	Annabelle	Browse	13.32.121.28
	Z4KBs1USsJ.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	YiqjcLlhew.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
OnlineSASFR	Demon.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	163.172.49.146
	Demon.arm6.elf	Get hash	malicious	Mirai, Gafgyt	Browse	163.172.49.146
	RO2Y11yOJ7.exe	Get hash	malicious	FormBook	Browse	195.154.200.15
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	151.115.223.74
	yakuza.sparc.elf	Get hash	malicious	Unknown	Browse	51.158.207.75
	yakuza.ppc.elf	Get hash	malicious	Unknown	Browse	51.158.35.170
	debit#U00a0note#U00a0607-36099895#U00a0#U00a0.exe	Get hash	malicious	FormBook	Browse	195.154.200.15
	DHL EXPRESS.exe	Get hash	malicious	XWorm	Browse	195.154.49.246
	file.exe	Get hash	malicious	Xmrig	Browse	51.15.61.114
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	51.15.96.2

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.hhCLy0 (deleted)

Download File

Process:	/tmp/Demon.m68k.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.000550947930178
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Demon.m68k.elf
File size:	86'519 bytes
MD5:	e25b5dcd05d71b290df80c88d8a6abed
SHA1:	95aeb3989b6970662ebfa2fc496dd0163b3bb084
SHA256:	27c02589200c27a0b1310bba6e56ff4e4737704b6a2136bfdbc120fd961a2805
SHA512:	d95ecc9131444b26e4544535518ed2eb3baa2427cdbc7bfd1129e41d5aa524520a4b0e72ed9eea11b75443ef3975f08f2d10e68417c4be0d48ad338bda83ccc2
SSDEEP:	1536:uoEA0hVJxW/93584AWzab0y79N1xK19OTetUvZXJifUImzS02q2/cOfBgj:/H64/Nnzab0y79NPI9+XJemu02q2EOfe
TLSH:	FC830897B901EAB3F40ED77604D74B247230FB624E931A32731779A6AE362D43826F41
File Content Preview:	.ELF.......................D...4...$.....4. ...(.................................. .......................f....... .dt.Q............................NV..a....da.....N^NuNV..J9...0f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X........0N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66852
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0xdd14	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x8000ddbc	0xddbc	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x8000ddca	0xddca	0x18d0	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x8000f69c	0xf69c	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x800116a0	0xf6a0	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x800116a8	0xf6a8	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x800116b0	0xf6b0	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x800116b4	0xf6b4	0x37c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x80011a30	0xfa30	0x635c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0xfa30	0xa8c	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x104bc	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1077c	0x2a20	0x10	0x0		14	265	4
.strtab	STRTAB	0x0	0x1319c	0x205b	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0xf6a0	0xf6a0	5.9952	0x5	R E	0x2000	.init .text .fini .rodata .eh_frame
LOAD	0xf6a0	0x800116a0	0x800116a0	0x390	0x66ec	2.7875	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8000ddbc	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8000ddca	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8000f69c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x800116a0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x800116a8	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x800116b0	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x800116b4	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x80011a30	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
Demonicsock	.symtab	0x80011a4c	4	OBJECT	<unknown>	DEFAULT	10
Demonserv	.symtab	0x800116c0	4	OBJECT	<unknown>	DEFAULT	9
Q	.symtab	0x80011a62	16384	OBJECT	<unknown>	DEFAULT	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x800116a4	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x800116a0	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x800116d0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8000dff6	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80011a28	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8000e6cc	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x800116d8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8000e2f6	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x800116ac	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x800116a8	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8000f69c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8000f69c	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x800116d0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x8000dff6	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x80011a28	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x8000e6cc	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x800116d8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x8000e2f6	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x800116d4	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x80011a2c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x800116dc	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x800033e4	16	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8000bbd4	500	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8000c048	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x80005f34	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x80002d50	188	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x80002e64	54	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80003166	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x80005874	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80005990	74	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8000c06c	264	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x80002ed4	16	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80007cac	390	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x80005354	28	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x80005354	28	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80007e60	64	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x80002f6a	16	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80002f7c	60	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x800040b0	48	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x80015c8c	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x800055c8	124	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x80007f58	416	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x80002d50	188	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x80002e64	54	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x80008892	510	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8000bbd4	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x800086d4	134	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80008a90	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x800080f8	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x80002fb8	56	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8000bdc8	80	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8000d96c	40	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8000d994	346	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8000be18	162	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8000bbd4	500	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x80005c70	60	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80005cac	60	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x80005ce8	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x80003be8	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80003c24	1164	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80002ff0	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x800040e0	50	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80005d24	60	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x80015c90	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x80003bb8	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80006e2c	362	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x80003b98	30	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x80003af8	160	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x800097ea	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x800092f8	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8000520a	330	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80003028	130	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x80008e78	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x800030f4	20	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8000dd1a	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8000d6a8	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x80006526	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x80006ad8	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8000bebc	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8000d804	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x800033f4	310	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80005d60	78	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80003166	80	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80007f00	88	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8000a37c	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80004c24	94	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80004f5a	266	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80008b74	274	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x800031d4	84	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x80004158	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80005db0	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80003228	100	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x80004190	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x800041c8	70	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8000328c	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80004210	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x80004dc4	406	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80007bc4	232	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x80004284	238	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80005e1c	160	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x80005644	558	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x80004250	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8000a3d8	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x80005064	422	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8000c174	120	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8000352c	390	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x800036b4	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x800036b4	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x80003724	92	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x80008e28	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x80003780	268	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x80008c88	310	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x80006bf8	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8000bee8	350	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x80006dd4	86	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80008dc0	104	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8000388c	484	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x80003a90	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x80006d38	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x80005370	34	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x80008eac	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x800032c4	62	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8000a398	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x800033a4	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8000a40c	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x80005f16	30	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x80003304	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8000c4c0	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8000c54c	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8000c524	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x80003328	84	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x800116b0	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x800116b0	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x80015c80	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x8001189c	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x80004284	238	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80011a30	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8000594c	68	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x800058f0	92	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x800116d4	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x80011a2c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x800116dc	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x80015cb4	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x800116bc	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x80009d2c	460	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8000c2f8	340	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x80009a4c	480	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80006f98	2224	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8000dd88	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x800116b4	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x8000c1ec	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8000985c	494	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80009c2c	198	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x80015c78	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x800033e4	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x80015c70	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x8000bbd4	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x800116a0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x800116a0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__free_to_heap	.symtab	0x80004724	342	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x80007b90	50	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x8000c048	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x80005f34	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_add_free_area	.symtab	0x80004a3e	66	FUNC	<unknown>	DEFAULT	2
__heap_alloc	.symtab	0x80004936	150	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x800046cc	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000489c	88	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x80004a80	404	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x800048f4	66	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x800049cc	70	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x80004a12	44	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x800116a0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x800116a0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x8000c44c	114	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x80009cf4	56	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x80002f7c	60	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x800040b0	48	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x800031b6	30	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x80002d50	188	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x80002e64	54	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x80002fb8	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x80002ff0	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8000dd1a	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80005d60	78	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80003166	80	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x80007f00	88	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x800031d4	84	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x80004158	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x80003228	100	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x80004190	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x800041c8	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80007bc4	232	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80015c74	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x80003304	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x80003328	84	FUNC	<unknown>	DEFAULT	2
__malloc_from_heap	.symtab	0x80004450	466	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x800116e0	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x80015c58	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x80017d48	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x80017d70	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x80017d7c	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x80009ef8	72	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x80007848	840	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x80015c7c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x800116a0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x800116a0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x800058de	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x800058de	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x800058de	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x800058de	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x800058de	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x800058e8	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8000a37c	28	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x80009f40	1084	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x800118bc	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x80015c84	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x80017d60	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x80017d80	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x800043c4	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x80004408	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x80004374	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80005c24	74	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x800118f8	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x8000c61c	138	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8000a4d4	314	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8000daf0	352	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8000c6a8	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x80008548	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3828	.symtab	0x8000e670	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x8000c8b0	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8000dc50	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8000c90c	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8000c9f0	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x80008660	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x800118fc	4	OBJECT	<unknown>	DEFAULT	9
__syscall_chdir	.symtab	0x80002f2c	62	FUNC	<unknown>	DEFAULT	2
__syscall_exit	.symtab	0x80002e9c	56	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64	.symtab	0x80002e0c	88	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_kill	.symtab	0x800030ac	72	FUNC	<unknown>	DEFAULT	2
__syscall_llseek	.symtab	0x8000dcb8	98	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x80003108	94	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x80007ea0	94	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_wait4	.symtab	0x80005ebc	90	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x80005874	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80005990	74	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x800059da	584	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x800118b4	4	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x8000c06c	264	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8000a610	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x80007e34	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x80017d84	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x80017d88	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000a702	2118	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x80011a30	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x80017d8c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x80015c8c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x80002ed4	16	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8000ddbc	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x80015cc0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8000a65a	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8000cce0	2502	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x80015c90	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x8000b53c	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x8000cb90	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x8000b0dc	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8000b5a2	1584	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8000b1ac	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8000b218	718	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8000b4e8	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x800058e8	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x800058e8	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x80017cc8	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x80008120	960	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x800084e0	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80011900	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x80011904	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x8000875c	310	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x80015cbc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x8001191c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x80015cb8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x80011938	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x80008568	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80011934	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x80005394	562	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8000cc80	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8000ea78	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80005f44	438	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8000af48	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x80006618	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x80006896	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x800060fc	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x80006332	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x80007cac	390	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x80002ee4	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x80001db6	276	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x80001916	1184	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x80005354	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x80005354	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x800014d0	1094	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x80003a70	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x80015cb0	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2790	.symtab	0x80015c88	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x80007e60	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x80004284	238	FUNC	<unknown>	DEFAULT	2
buf.2603	.symtab	0x80015a68	16	OBJECT	<unknown>	DEFAULT	10
buf.4831	.symtab	0x80015a78	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x800116c8	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x8000ddb2	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x80002f6a	16	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_tcp_udp	.symtab	0x8000132c	288	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x80002f7c	60	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cncinput	.symtab	0x80001fe6	1776	FUNC	<unknown>	DEFAULT	2
completed.2170	.symtab	0x80011a30	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x800040b0	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x80000ea8	462	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x800031b6	30	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x80001182	228	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x800116c4	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x800116bc	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
defarchs	.symtab	0x80001eca	16	FUNC	<unknown>	DEFAULT	2
defopsys	.symtab	0x80001eda	16	FUNC	<unknown>	DEFAULT	2
defpkgs	.symtab	0x80001eea	252	FUNC	<unknown>	DEFAULT	2
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x80015c78	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x80015c8c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x800055c8	124	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8000f62e	108	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x80007f58	416	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x80002d50	188	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x80002e64	54	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8000034c	118	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x80008892	510	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8000bbd4	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x800086d4	134	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80008a90	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x8000f61a	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x800080f8	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x80002fb8	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8000bdc8	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8000487a	32	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8000d96c	40	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8000d96c	40	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8000d994	346	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x8000be18	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getHost	.symtab	0x80000c24	56	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x800003c2	516	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x80000314	56	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x8000bbd4	500	FUNC	<unknown>	DEFAULT	2
getegid	.symtab	0x80005c70	60	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80005cac	60	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x80005ce8	60	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x80003be8	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80003c24	1164	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80002ff0	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x800040e0	50	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80004114	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80005d24	60	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x80011a50	4	OBJECT	<unknown>	DEFAULT	10
h.4830	.symtab	0x80015c44	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x80015c90	4	OBJECT	<unknown>	DEFAULT	10
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x80003ad6	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x80003ae2	22	FUNC	<unknown>	DEFAULT	2
i.4117	.symtab	0x800116cc	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x8000352c	390	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x80003bb8	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80006e2c	362	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x80003b98	30	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x80003af8	160	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x800097ea	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x80009358	464	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x80009528	706	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x800092f8	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x80008f64	282	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x8000907e	634	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x800026d6	328	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8000016c	144	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x800116e4	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x80004cf6	118	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8000520a	330	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80003028	130	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x80008e78	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x8000337c	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x800030f4	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x80001076	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8000dd1a	108	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x80011a5c	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x8000281e	1328	FUNC	<unknown>	DEFAULT	2
makeIPPacket	.symtab	0x8000144c	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x80000c5c	118	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x80004622	168	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x8000d6a8	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x80006526	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x80006ad8	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8000bebc	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8000d804	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x800033f4	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x800117e8	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x80015c94	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x800118d4	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x80005d60	78	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1067	.symtab	0x80015a64	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x80003ab4	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x80003ac0	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x80011a54	8	OBJECT	<unknown>	DEFAULT	10
object.2251	.symtab	0x80011a32	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x80003166	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x80017cc0	4	OBJECT	<unknown>	DEFAULT	10
p.2168	.symtab	0x800116b8	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x80017cc4	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x80007f00	88	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4042	.symtab	0x8000e9d9	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x800008c6	688	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x80000674	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8000078e	312	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x800006b8	214	FUNC	<unknown>	DEFAULT	2
qual_chars.4045	.symtab	0x8000e9ec	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8000a37c	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80004c14	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x800001fc	280	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80004c24	94	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8000e5f6	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80004f5a	266	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8001181c	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x80008b74	274	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x800031d4	84	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x80004158	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x80000cd2	470	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x80005db0	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x80003228	100	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x80004190	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x800041c8	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x8000328c	56	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80004210	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80004c82	116	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x80004dc4	406	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80007bc4	232	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x80004284	238	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80005e1c	160	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x80005644	558	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x80004250	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sockprintf	.symtab	0x80000b76	174	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4044	.symtab	0x8000ea00	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4041	.symtab	0x8000e9e5	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4041	.symtab	0x8000ea29	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4040	.symtab	0x8000ea3e	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4043	.symtab	0x8000ea10	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4042	.symtab	0x8000ea20	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x8000a3d8	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x80004d6c	88	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80004d6c	88	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x80005064	422	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x800118b8	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x80015cac	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x800118f4	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x800118ec	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x800118f0	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x8000c174	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8000352c	390	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x800036b4	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x800036b4	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x80003724	92	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x80008e28	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8000c06c	264	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x80003780	268	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x80008c88	310	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x80006bf8	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8000bee8	350	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x80006dd4	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80008dc0	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8000388c	484	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x80003a90	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x80006d38	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x80005370	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x80008eac	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x80001266	198	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x800032c4	62	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8000a398	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x800033a4	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x800005c6	174	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8000ea46	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x8000ea5e	12	OBJECT	<unknown>	DEFAULT	4
unknown.1089	.symtab	0x8000ea6a	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80011800	28	OBJECT	<unknown>	DEFAULT	9
vsnprintf	.symtab	0x8000a40c	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x80005f16	30	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x80003304	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x8000c4c0	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8000c54c	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8000c524	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x80003328	84	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3095	.symtab	0x8000e69c	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59584	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59594	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59570	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59580	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59560	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59590	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59568	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59562	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59592	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59586	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59572	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59554	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59596	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59576	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59566	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59582	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59604	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59598	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59574	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59558	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59556	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59564	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59578	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59602	163.172.49.146	666	TCP
2024-11-07T17:13:35.445736+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59588	163.172.49.146	666	TCP
2024-11-07T17:13:35.452758+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59554	163.172.49.146	666	TCP
2024-11-07T17:13:35.452758+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59554	163.172.49.146	666	TCP
2024-11-07T17:13:43.966901+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59556	163.172.49.146	666	TCP
2024-11-07T17:13:43.966901+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59556	163.172.49.146	666	TCP
2024-11-07T17:13:52.456692+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59558	163.172.49.146	666	TCP
2024-11-07T17:13:52.456692+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59558	163.172.49.146	666	TCP
2024-11-07T17:14:00.941259+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59560	163.172.49.146	666	TCP
2024-11-07T17:14:00.941259+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59560	163.172.49.146	666	TCP
2024-11-07T17:14:09.438138+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59562	163.172.49.146	666	TCP
2024-11-07T17:14:09.438138+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59562	163.172.49.146	666	TCP
2024-11-07T17:14:17.926673+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59564	163.172.49.146	666	TCP
2024-11-07T17:14:17.926673+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59564	163.172.49.146	666	TCP
2024-11-07T17:14:26.434237+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59566	163.172.49.146	666	TCP
2024-11-07T17:14:26.434237+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59566	163.172.49.146	666	TCP
2024-11-07T17:14:34.923624+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59568	163.172.49.146	666	TCP
2024-11-07T17:14:34.923624+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59568	163.172.49.146	666	TCP
2024-11-07T17:14:43.431024+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59570	163.172.49.146	666	TCP
2024-11-07T17:14:43.431024+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59570	163.172.49.146	666	TCP
2024-11-07T17:14:51.931827+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59572	163.172.49.146	666	TCP
2024-11-07T17:14:51.931827+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59572	163.172.49.146	666	TCP
2024-11-07T17:15:00.424010+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59574	163.172.49.146	666	TCP
2024-11-07T17:15:00.424010+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59574	163.172.49.146	666	TCP
2024-11-07T17:15:08.907583+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59576	163.172.49.146	666	TCP
2024-11-07T17:15:08.907583+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59576	163.172.49.146	666	TCP
2024-11-07T17:15:17.389621+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59578	163.172.49.146	666	TCP
2024-11-07T17:15:17.389621+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59578	163.172.49.146	666	TCP
2024-11-07T17:15:25.877298+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59580	163.172.49.146	666	TCP
2024-11-07T17:15:25.877298+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59580	163.172.49.146	666	TCP
2024-11-07T17:15:34.373163+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59582	163.172.49.146	666	TCP
2024-11-07T17:15:34.373163+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59582	163.172.49.146	666	TCP
2024-11-07T17:15:42.870086+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59584	163.172.49.146	666	TCP
2024-11-07T17:15:42.870086+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59584	163.172.49.146	666	TCP
2024-11-07T17:15:51.356391+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59586	163.172.49.146	666	TCP
2024-11-07T17:15:51.356391+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59586	163.172.49.146	666	TCP
2024-11-07T17:15:59.843569+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59588	163.172.49.146	666	TCP
2024-11-07T17:15:59.843569+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59588	163.172.49.146	666	TCP
2024-11-07T17:16:08.320752+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59590	163.172.49.146	666	TCP
2024-11-07T17:16:08.320752+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59590	163.172.49.146	666	TCP
2024-11-07T17:16:16.807477+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59592	163.172.49.146	666	TCP
2024-11-07T17:16:16.807477+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59592	163.172.49.146	666	TCP
2024-11-07T17:16:25.298004+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59594	163.172.49.146	666	TCP
2024-11-07T17:16:25.298004+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59594	163.172.49.146	666	TCP
2024-11-07T17:16:33.787125+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59596	163.172.49.146	666	TCP
2024-11-07T17:16:33.787125+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59596	163.172.49.146	666	TCP
2024-11-07T17:16:42.300985+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59598	163.172.49.146	666	TCP
2024-11-07T17:16:42.300985+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59598	163.172.49.146	666	TCP
2024-11-07T17:16:50.789100+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59600	163.172.49.146	666	TCP
2024-11-07T17:16:50.789100+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59600	163.172.49.146	666	TCP
2024-11-07T17:16:59.564030+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59600	163.172.49.146	666	TCP
2024-11-07T17:16:59.567393+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59602	163.172.49.146	666	TCP
2024-11-07T17:16:59.567393+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59602	163.172.49.146	666	TCP
2024-11-07T17:17:08.054785+0100	2837021	ETPRO MALWARE ELF/Various IoT Botnet CnC Checkin M2	1	192.168.2.13	59604	163.172.49.146	666	TCP
2024-11-07T17:17:08.054785+0100	2841512	ETPRO MALWARE ELF/Various Mirai/BASHLITE Infected Device Checkin	1	192.168.2.13	59604	163.172.49.146	666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 17:13:35.445735931 CET	59554	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:35.451133013 CET	666	59554	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:35.451293945 CET	59554	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:35.452758074 CET	59554	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:35.457571983 CET	666	59554	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:43.960767031 CET	666	59554	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:43.961164951 CET	59554	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:43.961909056 CET	59556	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:43.966089010 CET	666	59554	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:43.966713905 CET	666	59556	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:43.966900110 CET	59556	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:43.966901064 CET	59556	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:43.971848965 CET	666	59556	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:52.451044083 CET	666	59556	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:52.451179028 CET	59556	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:52.451203108 CET	59556	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:52.451711893 CET	59558	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:52.456214905 CET	666	59556	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:52.456549883 CET	666	59558	163.172.49.146	192.168.2.13
Nov 7, 2024 17:13:52.456646919 CET	59558	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:52.456691980 CET	59558	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:13:52.461544991 CET	666	59558	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:00.934267998 CET	666	59558	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:00.934540987 CET	59558	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:00.935060978 CET	59560	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:00.940983057 CET	666	59558	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:00.941114902 CET	666	59560	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:00.941162109 CET	59560	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:00.941258907 CET	59560	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:00.946901083 CET	666	59560	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:07.161442995 CET	57214	443	192.168.2.13	54.247.62.1
Nov 7, 2024 17:14:07.167192936 CET	443	57214	54.247.62.1	192.168.2.13
Nov 7, 2024 17:14:07.167262077 CET	57214	443	192.168.2.13	54.247.62.1
Nov 7, 2024 17:14:09.431476116 CET	666	59560	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:09.431687117 CET	59560	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:09.432300091 CET	59562	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:09.437952042 CET	666	59560	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:09.437967062 CET	666	59562	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:09.438087940 CET	59562	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:09.438138008 CET	59562	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:09.443766117 CET	666	59562	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:17.920702934 CET	666	59562	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:17.920922995 CET	59562	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:17.921447992 CET	59564	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:17.925780058 CET	666	59562	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:17.926517963 CET	666	59564	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:17.926631927 CET	59564	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:17.926672935 CET	59564	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:17.931505919 CET	666	59564	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:26.428366899 CET	666	59564	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:26.428574085 CET	59564	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:26.429030895 CET	59566	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:26.433567047 CET	666	59564	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:26.434124947 CET	666	59566	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:26.434180021 CET	59566	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:26.434237003 CET	59566	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:26.440896034 CET	666	59566	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:34.917820930 CET	666	59566	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:34.918073893 CET	59566	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:34.918721914 CET	59568	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:34.922882080 CET	666	59566	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:34.923527956 CET	666	59568	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:34.923573971 CET	59568	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:34.923624039 CET	59568	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:34.928358078 CET	666	59568	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:43.424196959 CET	666	59568	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:43.424360991 CET	59568	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:43.424779892 CET	59570	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:43.429857016 CET	666	59568	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:43.430888891 CET	666	59570	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:43.430957079 CET	59570	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:43.431024075 CET	59570	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:43.436085939 CET	666	59570	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:51.925729990 CET	666	59570	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:51.925991058 CET	59570	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:51.926762104 CET	59572	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:51.930872917 CET	666	59570	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:51.931648970 CET	666	59572	163.172.49.146	192.168.2.13
Nov 7, 2024 17:14:51.931724072 CET	59572	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:51.931827068 CET	59572	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:14:51.936670065 CET	666	59572	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:00.418256998 CET	666	59572	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:00.418441057 CET	59572	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:00.418857098 CET	59574	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:00.423597097 CET	666	59572	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:00.423851013 CET	666	59574	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:00.423963070 CET	59574	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:00.424010038 CET	59574	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:00.429335117 CET	666	59574	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:08.901463032 CET	666	59574	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:08.901906967 CET	59574	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:08.902611971 CET	59576	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:08.907283068 CET	666	59574	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:08.907406092 CET	666	59576	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:08.907471895 CET	59576	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:08.907582998 CET	59576	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:08.912714958 CET	666	59576	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:17.383640051 CET	666	59576	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:17.383935928 CET	59576	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:17.384627104 CET	59578	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:17.388895035 CET	666	59576	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:17.389439106 CET	666	59578	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:17.389519930 CET	59578	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:17.389621019 CET	59578	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:17.394500017 CET	666	59578	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:25.870420933 CET	666	59578	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:25.870651007 CET	59578	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:25.871208906 CET	59580	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:25.876843929 CET	666	59578	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:25.877145052 CET	666	59580	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:25.877243042 CET	59580	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:25.877298117 CET	59580	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:25.882498980 CET	666	59580	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:34.366138935 CET	666	59580	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:34.366458893 CET	59580	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:34.367274046 CET	59582	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:34.371252060 CET	666	59580	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:34.372937918 CET	666	59582	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:34.373034000 CET	59582	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:34.373162985 CET	59582	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:34.378251076 CET	666	59582	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:42.864379883 CET	666	59582	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:42.864554882 CET	59582	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:42.864950895 CET	59584	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:42.869849920 CET	666	59582	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:42.869867086 CET	666	59584	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:42.869971037 CET	59584	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:42.870085955 CET	59584	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:42.874929905 CET	666	59584	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:51.350254059 CET	666	59584	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:51.350538969 CET	59584	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:51.351295948 CET	59586	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:51.355391026 CET	666	59584	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:51.356151104 CET	666	59586	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:51.356282949 CET	59586	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:51.356390953 CET	59586	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:51.361201048 CET	666	59586	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:59.837992907 CET	666	59586	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:59.838170052 CET	59586	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:59.838644981 CET	59588	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:59.843048096 CET	666	59586	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:59.843453884 CET	666	59588	163.172.49.146	192.168.2.13
Nov 7, 2024 17:15:59.843513966 CET	59588	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:59.843569040 CET	59588	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:15:59.848896980 CET	666	59588	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:08.314557076 CET	666	59588	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:08.314810038 CET	59588	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:08.315357924 CET	59590	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:08.319657087 CET	666	59588	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:08.320599079 CET	666	59590	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:08.320669889 CET	59590	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:08.320751905 CET	59590	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:08.325926065 CET	666	59590	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:16.801846027 CET	666	59590	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:16.802021980 CET	59590	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:16.802524090 CET	59592	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:16.806864023 CET	666	59590	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:16.807323933 CET	666	59592	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:16.807379961 CET	59592	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:16.807476997 CET	59592	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:16.812310934 CET	666	59592	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:25.291925907 CET	666	59592	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:25.292244911 CET	59592	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:25.292840958 CET	59594	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:25.297802925 CET	666	59592	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:25.297821999 CET	666	59594	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:25.297923088 CET	59594	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:25.298003912 CET	59594	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:25.302875042 CET	666	59594	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:33.781136990 CET	666	59594	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:33.781316042 CET	59594	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:33.781853914 CET	59596	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:33.786371946 CET	666	59594	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:33.786986113 CET	666	59596	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:33.787101984 CET	59596	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:33.787125111 CET	59596	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:33.792510033 CET	666	59596	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:42.294991970 CET	666	59596	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:42.295252085 CET	59596	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:42.296015024 CET	59598	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:42.300051928 CET	666	59596	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:42.300869942 CET	666	59598	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:42.300920963 CET	59598	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:42.300985098 CET	59598	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:42.305785894 CET	666	59598	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:50.783013105 CET	666	59598	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:50.783304930 CET	59598	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:50.783960104 CET	59600	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:50.788288116 CET	666	59598	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:50.788903952 CET	666	59600	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:50.788965940 CET	59600	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:50.789099932 CET	59600	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:50.794408083 CET	666	59600	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:59.560545921 CET	666	59600	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:59.560821056 CET	59600	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:59.561630964 CET	59602	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:59.563972950 CET	666	59600	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:59.564029932 CET	59600	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:59.565768957 CET	666	59600	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:59.567198992 CET	666	59602	163.172.49.146	192.168.2.13
Nov 7, 2024 17:16:59.567287922 CET	59602	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:59.567393064 CET	59602	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:16:59.572422981 CET	666	59602	163.172.49.146	192.168.2.13
Nov 7, 2024 17:17:08.048576117 CET	666	59602	163.172.49.146	192.168.2.13
Nov 7, 2024 17:17:08.048917055 CET	59602	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:17:08.049730062 CET	59604	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:17:08.054210901 CET	666	59602	163.172.49.146	192.168.2.13
Nov 7, 2024 17:17:08.054656029 CET	666	59604	163.172.49.146	192.168.2.13
Nov 7, 2024 17:17:08.054716110 CET	59604	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:17:08.054785013 CET	59604	666	192.168.2.13	163.172.49.146
Nov 7, 2024 17:17:08.059705973 CET	666	59604	163.172.49.146	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 17:16:20.652057886 CET	32942	53	192.168.2.13	1.1.1.1
Nov 7, 2024 17:16:20.652110100 CET	33794	53	192.168.2.13	1.1.1.1
Nov 7, 2024 17:16:20.659917116 CET	53	33794	1.1.1.1	192.168.2.13
Nov 7, 2024 17:16:20.672805071 CET	53	32942	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 17:16:20.652057886 CET	192.168.2.13	1.1.1.1	0x11ed	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:16:20.652110100 CET	192.168.2.13	1.1.1.1	0x797	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 17:16:20.672805071 CET	1.1.1.1	192.168.2.13	0x11ed	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Nov 7, 2024 17:16:20.672805071 CET	1.1.1.1	192.168.2.13	0x11ed	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Demon.m68k.elf PID: 5420, Parent PID: 5344

General

Start time (UTC):	16:13:34
Start date (UTC):	07/11/2024
Path:	/tmp/Demon.m68k.elf
Arguments:	/tmp/Demon.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Demon.m68k.elf PID: 5422, Parent PID: 5420

General

Start time (UTC):	16:13:34
Start date (UTC):	07/11/2024
Path:	/tmp/Demon.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Demon.m68k.elf PID: 5424, Parent PID: 5422

General

Start time (UTC):	16:13:34
Start date (UTC):	07/11/2024
Path:	/tmp/Demon.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: dash PID: 5469, Parent PID: 3585

General

Start time (UTC):	16:14:06
Start date (UTC):	07/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5469, Parent PID: 3585

General

Start time (UTC):	16:14:06
Start date (UTC):	07/11/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.4dfcNTFbB3 /tmp/tmp.erTs7qes6H /tmp/tmp.xxikXpPsmS
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5470, Parent PID: 3585

General

Start time (UTC):	16:14:06
Start date (UTC):	07/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5470, Parent PID: 3585

General

Start time (UTC):	16:14:06
Start date (UTC):	07/11/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.4dfcNTFbB3 /tmp/tmp.erTs7qes6H /tmp/tmp.xxikXpPsmS
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Demon.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.hhCLy0 (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Demon.m68k.elf PID: 5420, Parent PID: 5344

General

Chronological Activities

Analysis Process: Demon.m68k.elf PID: 5422, Parent PID: 5420

General

Chronological Activities

Analysis Process: Demon.m68k.elf PID: 5424, Parent PID: 5422

General

Chronological Activities

Analysis Process: dash PID: 5469, Parent PID: 3585

General

Chronological Activities

Linux Analysis Report
Demon.m68k.elf