Edit tour

Linux Analysis Report
bot.x86.elf

Overview

General Information

Sample name:	bot.x86.elf
Analysis ID:	1564788
MD5:	cd2b09f67594d5adcea3d1aeb9deff28
SHA1:	6ca4b36bf387f384229f69ed5e36503ebdfff576
SHA256:	e98a0c4210f503c3d34c06b61fde78323b6c7c22e623e813a1e5b292b5a4c6a3
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564788
Start date and time:	2024-11-28 19:41:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	bot.x86.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@15/0

Runtime Messages

Command:	/tmp/bot.x86.elf
PID:	5442
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

bot.x86.elf (PID: 5442, Parent: 5370, MD5: cd2b09f67594d5adcea3d1aeb9deff28) Arguments: /tmp/bot.x86.elf

bot.x86.elf New Fork (PID: 5443, Parent: 5442)

bot.x86.elf New Fork (PID: 5444, Parent: 5443)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bot.x86.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
bot.x86.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
bot.x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
bot.x86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13fc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1403c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1408c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1412c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
bot.x86.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13ea4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
bot.x86.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xf8cb:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
bot.x86.elf	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x115c9:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
bot.x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5d52:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5442.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5442.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5442.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5442.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13fc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13fec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1403c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1408c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1412c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5442.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13ea4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5442.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xf8cb:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5442.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0x115c9:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
5442.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x5d52:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: bot.x86.elf PID: 5442	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: bot.x86.elf PID: 5442	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: bot.x86.elf PID: 5442	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: bot.x86.elf PID: 5442	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: bot.x86.elf PID: 5442	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x8be:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 8 entries

Suricata Signatures

ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T19:42:43.432615+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38342	89.169.4.44	47925	TCP
2024-11-28T19:42:54.027442+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38344	89.169.4.44	47925	TCP
2024-11-28T19:43:05.607200+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38346	89.169.4.44	47925	TCP
2024-11-28T19:43:12.129050+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38348	89.169.4.44	47925	TCP
2024-11-28T19:43:20.737679+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38350	89.169.4.44	47925	TCP
2024-11-28T19:43:30.343748+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38352	89.169.4.44	47925	TCP
2024-11-28T19:43:36.895374+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38354	89.169.4.44	47925	TCP
2024-11-28T19:43:45.488580+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38356	89.169.4.44	47925	TCP
2024-11-28T19:43:50.019362+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38358	89.169.4.44	47925	TCP
2024-11-28T19:44:02.625937+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38360	89.169.4.44	47925	TCP
2024-11-28T19:44:09.215745+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38362	89.169.4.44	47925	TCP
2024-11-28T19:44:19.823934+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38364	89.169.4.44	47925	TCP
2024-11-28T19:44:29.098272+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38366	89.169.4.44	47925	TCP
2024-11-28T19:44:35.973633+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38368	89.169.4.44	47925	TCP
2024-11-28T19:44:48.544574+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	38370	89.169.4.44	47925	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bot.x86.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: bot.x86.elf

ReversingLabs: Detection: 63%

Machine Learning detection for sample

Source: bot.x86.elf

Joe Sandbox ML: detected

Source: bot.x86.elf

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38368 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38342 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38348 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38360 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38344 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38346 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38370 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38356 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38350 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38364 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38352 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38358 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38366 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38362 -> 89.169.4.44:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:38354 -> 89.169.4.44:47925

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 89.169.4.44 ports 47925,2,4,5,7,9

Source: global traffic

TCP traffic: 192.168.2.13:38342 -> 89.169.4.44:47925

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic

DNS traffic detected: DNS query: seyfhg.work.gd

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: bot.x86.elf	ELF static info symbol of initial sample: execute_cfa_program
Source: bot.x86.elf	ELF static info symbol of initial sample: execute_stack_op

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: bot.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@15/0

Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/5394/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/5289/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/bot.x86.elf (PID: 5444)	File opened: /proc/816/cmdline	Jump to behavior

Source: /tmp/bot.x86.elf (PID: 5442)

Queries kernel information via 'uname':

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: bot.x86.elf, type: SAMPLE
Source: Yara match	File source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: bot.x86.elf, type: SAMPLE
Source: Yara match	File source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Mirai

Source: Yara match	File source: bot.x86.elf, type: SAMPLE
Source: Yara match	File source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: bot.x86.elf, type: SAMPLE
Source: Yara match	File source: 5442.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.x86.elf PID: 5442, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
bot.x86.elf	63%	ReversingLabs	Linux.Backdoor.Gafgyt
bot.x86.elf	100%	Avira	EXP/ELF.Mirai.Z.A
bot.x86.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
seyfhg.work.gd	89.169.4.44	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
89.169.4.44	seyfhg.work.gd	Russian Federation		31514	INF-NET-ASRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	bot.spc.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	harm5.elf	Get hash	malicious	Unknown	Browse
	xblkpfZ8Y3.elf	Get hash	malicious	Unknown	Browse
	opt_observer.elf	Get hash	malicious	Unknown	Browse
89.169.4.44	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
seyfhg.work.gd	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	89.169.4.44
	tB114oiRY5.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	uziTyAHxCX.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	UpgzkaAmBp.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	Buj4LG5Eu4.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INF-NET-ASRU	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	89.169.4.44
	nabarm.elf	Get hash	malicious	Unknown	Browse	89.169.45.153
	http://edveha.com	Get hash	malicious	Unknown	Browse	89.169.52.197
	3a3Mj0371A.exe	Get hash	malicious	Stealc	Browse	83.217.209.11
	Installer_setup32_64x.exe	Get hash	malicious	LummaC, Stealc	Browse	83.217.209.11
	http://edveha.com	Get hash	malicious	Unknown	Browse	89.169.52.197
	QpuXKUX0Lg.exe	Get hash	malicious	Stealc	Browse	83.217.209.11
	kgMK6ynJHr.exe	Get hash	malicious	Stealc	Browse	83.217.209.11
	4VNuviqj4s.exe	Get hash	malicious	Stealc, Vidar	Browse	83.217.209.11
	file.exe	Get hash	malicious	Unknown	Browse	83.217.208.158
CANONICAL-ASGB	bot.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	bot.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	bot.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.236595145572192
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	bot.x86.elf
File size:	196'340 bytes
MD5:	cd2b09f67594d5adcea3d1aeb9deff28
SHA1:	6ca4b36bf387f384229f69ed5e36503ebdfff576
SHA256:	e98a0c4210f503c3d34c06b61fde78323b6c7c22e623e813a1e5b292b5a4c6a3
SHA512:	a5979439e797f372caae3db23d8efd115ea040d9038dc8284b2835165fe7188b520326a3612dea3761a16d3524ae3adf024b79164c56be6a631de9d70c64cba1
SSDEEP:	3072:ivmxdLVT7jFlZGgcbzScS3+P79c1vC9u9XXFHVByqqnnL/u:iuxddjFlZGgcbzmuP79c1vC9u9HFHvqS
TLSH:	E0147B86E762C9BBC44A0779069B97354637E4A2072F5B02E36CBEB06E13391F585F0D
File Content Preview:	.ELF........................4....s......4. ...(......................c...c...............c..............Tl.............. x.. ... ...................Q.td............................U..S............h.....7..[]...$.............U......=.....t..5....d......d..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048184
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	160524
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80480b4	0xb4	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480d0	0xd0	0x13727	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x805b7f7	0x137f7	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x805b820	0x13820	0x2b7c	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x805f39c	0x1639c	0x1484	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x8060820	0x17820	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x8060824	0x17824	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x8060824	0x17824	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x806082c	0x1782c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8060834	0x17834	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x8060838	0x17838	0x4	0x4	0x3	WA	0	0	4
.got.plt	PROGBITS	0x806083c	0x1783c	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8060860	0x17860	0x318	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x8060b80	0x17b78	0x5470	0x0	0x3	WA	0	0	32
.stab	PROGBITS	0x0	0x17b78	0xfc	0xc	0x0		16	0	4
.stabstr	STRTAB	0x0	0x17c74	0xdb	0x0	0x0		0	0	1
.comment	PROGBITS	0x0	0x17d4f	0xe46	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x18b95	0x40	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x18bd5	0x2f3	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x18ec8	0x4eab	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1dd73	0x9c1	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1e734	0x13df	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1fb14	0xc38	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x2074c	0x1ebd	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x22609	0x3f8a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x26593	0xc70	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x27203	0x106	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x277bc	0x49c0	0x10	0x0		29	542	4
.strtab	STRTAB	0x0	0x2c17c	0x3d78	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1639c	0x1639c	6.5922	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x1639c	0x805f39c	0x805f39c	0x17dc	0x6c54	4.7978	0x6	RW	0x1000	.eh_frame .tdata .tbss .ctors .dtors .jcr .got .got.plt .data .bss
TLS	0x17820	0x8060820	0x8060820	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80480b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x805b7f7	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x805b820	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x805f39c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8060820	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8060824	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8060824	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x806082c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8060834	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8060838	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x806083c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x8060860	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x8060b80	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
.L117	.symtab	0x80514c0	0	NOTYPE	<unknown>	DEFAULT	2
.L122	.symtab	0x805149d	0	NOTYPE	<unknown>	DEFAULT	2
.L123	.symtab	0x8051577	0	NOTYPE	<unknown>	DEFAULT	2
.L124	.symtab	0x80515ba	0	NOTYPE	<unknown>	DEFAULT	2
.L125	.symtab	0x80515d9	0	NOTYPE	<unknown>	DEFAULT	2
.L126	.symtab	0x80515fe	0	NOTYPE	<unknown>	DEFAULT	2
.L127	.symtab	0x805161d	0	NOTYPE	<unknown>	DEFAULT	2
.L128	.symtab	0x805162f	0	NOTYPE	<unknown>	DEFAULT	2
.L129	.symtab	0x805164e	0	NOTYPE	<unknown>	DEFAULT	2
.L130	.symtab	0x805166d	0	NOTYPE	<unknown>	DEFAULT	2
.L131	.symtab	0x805169d	0	NOTYPE	<unknown>	DEFAULT	2
.L132	.symtab	0x80516de	0	NOTYPE	<unknown>	DEFAULT	2
.L133	.symtab	0x8051708	0	NOTYPE	<unknown>	DEFAULT	2
.L134	.symtab	0x805173d	0	NOTYPE	<unknown>	DEFAULT	2
.L135	.symtab	0x8051761	0	NOTYPE	<unknown>	DEFAULT	2
.L136	.symtab	0x805177e	0	NOTYPE	<unknown>	DEFAULT	2
.L137	.symtab	0x80517a7	0	NOTYPE	<unknown>	DEFAULT	2
.L138	.symtab	0x80517d6	0	NOTYPE	<unknown>	DEFAULT	2
.L139	.symtab	0x80517f2	0	NOTYPE	<unknown>	DEFAULT	2
.L140	.symtab	0x805183b	0	NOTYPE	<unknown>	DEFAULT	2
.L141	.symtab	0x805186a	0	NOTYPE	<unknown>	DEFAULT	2
.L142	.symtab	0x80518a3	0	NOTYPE	<unknown>	DEFAULT	2
.L143	.symtab	0x80518bc	0	NOTYPE	<unknown>	DEFAULT	2
.L144	.symtab	0x80518d9	0	NOTYPE	<unknown>	DEFAULT	2
.L145	.symtab	0x805190e	0	NOTYPE	<unknown>	DEFAULT	2
.L146	.symtab	0x805153c	0	NOTYPE	<unknown>	DEFAULT	2
.L258	.symtab	0x80522ef	0	NOTYPE	<unknown>	DEFAULT	2
.L259	.symtab	0x80522e2	0	NOTYPE	<unknown>	DEFAULT	2
.L260	.symtab	0x80522d6	0	NOTYPE	<unknown>	DEFAULT	2
.L261	.symtab	0x80522c3	0	NOTYPE	<unknown>	DEFAULT	2
.L262	.symtab	0x80522b5	0	NOTYPE	<unknown>	DEFAULT	2
.L264	.symtab	0x8051ef0	0	NOTYPE	<unknown>	DEFAULT	2
.L266	.symtab	0x8051f43	0	NOTYPE	<unknown>	DEFAULT	2
.L267	.symtab	0x8052243	0	NOTYPE	<unknown>	DEFAULT	2
.L268	.symtab	0x805222c	0	NOTYPE	<unknown>	DEFAULT	2
.L269	.symtab	0x8052209	0	NOTYPE	<unknown>	DEFAULT	2
.L270	.symtab	0x80521e9	0	NOTYPE	<unknown>	DEFAULT	2
.L271	.symtab	0x80521c7	0	NOTYPE	<unknown>	DEFAULT	2
.L272	.symtab	0x805219f	0	NOTYPE	<unknown>	DEFAULT	2
.L273	.symtab	0x8052161	0	NOTYPE	<unknown>	DEFAULT	2
.L274	.symtab	0x80520e8	0	NOTYPE	<unknown>	DEFAULT	2
.L275	.symtab	0x805209d	0	NOTYPE	<unknown>	DEFAULT	2
.L276	.symtab	0x805205d	0	NOTYPE	<unknown>	DEFAULT	2
.L277	.symtab	0x805204e	0	NOTYPE	<unknown>	DEFAULT	2
.L278	.symtab	0x8052043	0	NOTYPE	<unknown>	DEFAULT	2
.L279	.symtab	0x8051ffa	0	NOTYPE	<unknown>	DEFAULT	2
.L280	.symtab	0x8051fa1	0	NOTYPE	<unknown>	DEFAULT	2
.L281	.symtab	0x8051f4d	0	NOTYPE	<unknown>	DEFAULT	2
.L282	.symtab	0x8052254	0	NOTYPE	<unknown>	DEFAULT	2
.L283	.symtab	0x8051f18	0	NOTYPE	<unknown>	DEFAULT	2
.L350	.symtab	0x80523c4	0	NOTYPE	<unknown>	DEFAULT	2
.L351	.symtab	0x80523ce	0	NOTYPE	<unknown>	DEFAULT	2
.L352	.symtab	0x80523dd	0	NOTYPE	<unknown>	DEFAULT	2
.L353	.symtab	0x80523e7	0	NOTYPE	<unknown>	DEFAULT	2
.L354	.symtab	0x80523f6	0	NOTYPE	<unknown>	DEFAULT	2
.L355	.symtab	0x8052401	0	NOTYPE	<unknown>	DEFAULT	2
.L356	.symtab	0x805240b	0	NOTYPE	<unknown>	DEFAULT	2
.L357	.symtab	0x8052416	0	NOTYPE	<unknown>	DEFAULT	2
.L358	.symtab	0x8052422	0	NOTYPE	<unknown>	DEFAULT	2
.L359	.symtab	0x805242e	0	NOTYPE	<unknown>	DEFAULT	2
.L360	.symtab	0x805243a	0	NOTYPE	<unknown>	DEFAULT	2
.L361	.symtab	0x8052444	0	NOTYPE	<unknown>	DEFAULT	2
.L362	.symtab	0x8052456	0	NOTYPE	<unknown>	DEFAULT	2
.L363	.symtab	0x8052468	0	NOTYPE	<unknown>	DEFAULT	2
.L364	.symtab	0x805247a	0	NOTYPE	<unknown>	DEFAULT	2
.L365	.symtab	0x805248c	0	NOTYPE	<unknown>	DEFAULT	2
.L366	.symtab	0x805249e	0	NOTYPE	<unknown>	DEFAULT	2
.L374	.symtab	0x8051ed4	0	NOTYPE	<unknown>	DEFAULT	2
.L412	.symtab	0x8052655	0	NOTYPE	<unknown>	DEFAULT	2
.L413	.symtab	0x8052758	0	NOTYPE	<unknown>	DEFAULT	2
.L414	.symtab	0x80525fc	0	NOTYPE	<unknown>	DEFAULT	2
.L415	.symtab	0x8052713	0	NOTYPE	<unknown>	DEFAULT	2
.L416	.symtab	0x80526d8	0	NOTYPE	<unknown>	DEFAULT	2
.L417	.symtab	0x8052681	0	NOTYPE	<unknown>	DEFAULT	2
.L64	.symtab	0x8051210	0	NOTYPE	<unknown>	DEFAULT	2
.L66	.symtab	0x8051298	0	NOTYPE	<unknown>	DEFAULT	2
.L67	.symtab	0x8051288	0	NOTYPE	<unknown>	DEFAULT	2
.L70	.symtab	0x8051271	0	NOTYPE	<unknown>	DEFAULT	2
.L71	.symtab	0x8051280	0	NOTYPE	<unknown>	DEFAULT	2
.L72	.symtab	0x8051220	0	NOTYPE	<unknown>	DEFAULT	2
.L73	.symtab	0x805126a	0	NOTYPE	<unknown>	DEFAULT	2
.L87	.symtab	0x80534f0	0	NOTYPE	<unknown>	DEFAULT	2
.L89	.symtab	0x8053578	0	NOTYPE	<unknown>	DEFAULT	2
.L90	.symtab	0x8053568	0	NOTYPE	<unknown>	DEFAULT	2
.L93	.symtab	0x8053551	0	NOTYPE	<unknown>	DEFAULT	2
.L94	.symtab	0x8053560	0	NOTYPE	<unknown>	DEFAULT	2
.L95	.symtab	0x8053500	0	NOTYPE	<unknown>	DEFAULT	2
.L96	.symtab	0x805354a	0	NOTYPE	<unknown>	DEFAULT	2
C.11.5136	.symtab	0x805cf34	24	OBJECT	<unknown>	DEFAULT	4
C.9.5732	.symtab	0x805c8e0	64	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x8065a24	1	OBJECT	<unknown>	DEFAULT	14
LOCAL_ADDR	.symtab	0x8065a20	4	OBJECT	<unknown>	DEFAULT	14
POPBX1	.symtab	0x805930f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x805936f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x80593cf	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80592fb	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805935b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80593bb	0	NOTYPE	<unknown>	DEFAULT	2
RESTBX1	.symtab	0x80592b9	0	NOTYPE	<unknown>	DEFAULT	2
SAVEBX1	.symtab	0x80592ac	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x8054e84	66	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x806083c	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_L_lock_103	.symtab	0x8055902	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1055	.symtab	0x804f58a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_12	.symtab	0x8056e6f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1225	.symtab	0x804f59a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1261	.symtab	0x804f5ba	16	FUNC	<unknown>	DEFAULT	2
_L_lock_140	.symtab	0x8056eaf	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1402	.symtab	0x804f5ea	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1430	.symtab	0x804f60a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_160	.symtab	0x8056ecf	16	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x8056b5a	10	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x805af39	10	FUNC	<unknown>	DEFAULT	2
_L_lock_174	.symtab	0x804f4ea	16	FUNC	<unknown>	DEFAULT	2
_L_lock_1750	.symtab	0x804f64a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_18	.symtab	0x80558c8	13	FUNC	<unknown>	DEFAULT	2
_L_lock_191	.symtab	0x8056eef	13	FUNC	<unknown>	DEFAULT	2
_L_lock_198	.symtab	0x8055cf0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_20	.symtab	0x8050898	16	FUNC	<unknown>	DEFAULT	2
_L_lock_205	.symtab	0x80508b8	16	FUNC	<unknown>	DEFAULT	2
_L_lock_209	.symtab	0x8055d00	16	FUNC	<unknown>	DEFAULT	2
_L_lock_27	.symtab	0x80591c4	16	FUNC	<unknown>	DEFAULT	2
_L_lock_29	.symtab	0x8056e7f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_32	.symtab	0x805afe1	10	FUNC	<unknown>	DEFAULT	2
_L_lock_34	.symtab	0x805b5ae	13	FUNC	<unknown>	DEFAULT	2
_L_lock_360	.symtab	0x804f50a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_447	.symtab	0x804fcd8	14	FUNC	<unknown>	DEFAULT	2
_L_lock_470	.symtab	0x804f52a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_473	.symtab	0x804fce6	14	FUNC	<unknown>	DEFAULT	2
_L_lock_512	.symtab	0x804fcf4	14	FUNC	<unknown>	DEFAULT	2
_L_lock_54	.symtab	0x80558d5	16	FUNC	<unknown>	DEFAULT	2
_L_lock_70	.symtab	0x80590a8	16	FUNC	<unknown>	DEFAULT	2
_L_lock_757	.symtab	0x804f54a	16	FUNC	<unknown>	DEFAULT	2
_L_lock_893	.symtab	0x804f56a	16	FUNC	<unknown>	DEFAULT	2
_L_robust_lock_105	.symtab	0x804fcb6	17	FUNC	<unknown>	DEFAULT	2
_L_robust_unlock_179	.symtab	0x80500e8	17	FUNC	<unknown>	DEFAULT	2
_L_unlock_101	.symtab	0x805b5bb	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_102	.symtab	0x8056e9f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_110	.symtab	0x804fcc7	17	FUNC	<unknown>	DEFAULT	2
_L_unlock_113	.symtab	0x8055912	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_1234	.symtab	0x804f5aa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1315	.symtab	0x804f5ca	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1340	.symtab	0x804f5da	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1406	.symtab	0x804f5fa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1434	.symtab	0x804f61a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_152	.symtab	0x8056ebf	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_167	.symtab	0x80590b8	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_1671	.symtab	0x804f62a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_170	.symtab	0x8056edf	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1710	.symtab	0x804f63a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_1820	.symtab	0x804f65a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_225	.symtab	0x8055d10	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_232	.symtab	0x8056efc	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_235	.symtab	0x8055d1d	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_285	.symtab	0x80508c8	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_338	.symtab	0x804f4fa	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_40	.symtab	0x8056b64	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_452	.symtab	0x804f51a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_454	.symtab	0x80500f9	11	FUNC	<unknown>	DEFAULT	2
_L_unlock_518	.symtab	0x804f53a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_57	.symtab	0x805af43	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_61	.symtab	0x805afeb	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_64	.symtab	0x80508a8	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_66	.symtab	0x80558e5	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_787	.symtab	0x804f55a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_83	.symtab	0x80558f5	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_86	.symtab	0x8056e8f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_894	.symtab	0x804f57a	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_90	.symtab	0x80591d4	13	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Backtrace	.symtab	0x8052b40	154	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x8051100	28	FUNC	<unknown>	HIDDEN	2
_Unwind_FindEnclosingFunction	.symtab	0x80513c0	52	FUNC	<unknown>	HIDDEN	2
_Unwind_Find_FDE	.symtab	0x8054ab0	489	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x8053060	184	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind_Phase2	.symtab	0x8052df0	219	FUNC	<unknown>	DEFAULT	2
_Unwind_GetCFA	.symtab	0x8051090	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x80510e0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetGR	.symtab	0x8051180	86	FUNC	<unknown>	HIDDEN	2
_Unwind_GetIP	.symtab	0x80510a0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetIPInfo	.symtab	0x8051400	22	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x80510c0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x80510d0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x80510f0	11	FUNC	<unknown>	HIDDEN	2
_Unwind_IteratePhdrCallback	.symtab	0x8054550	1367	FUNC	<unknown>	DEFAULT	2
_Unwind_RaiseException	.symtab	0x8052c90	342	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException_Phase2	.symtab	0x8052be0	169	FUNC	<unknown>	DEFAULT	2
_Unwind_Resume	.symtab	0x8052fa0	184	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x8052ed0	196	FUNC	<unknown>	HIDDEN	2
_Unwind_SetGR	.symtab	0x8051120	86	FUNC	<unknown>	HIDDEN	2
_Unwind_SetIP	.symtab	0x80510b0	14	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8060828	0	OBJECT	<unknown>	DEFAULT	8
__CTOR_LIST__	.symtab	0x8060824	0	OBJECT	<unknown>	DEFAULT	8
__C_ctype_b	.symtab	0x8060b70	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805dfd0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8060830	0	OBJECT	<unknown>	DEFAULT	9
__DTOR_LIST__	.symtab	0x806082c	0	OBJECT	<unknown>	DEFAULT	9
__EH_FRAME_BEGIN__	.symtab	0x805f39c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x806081c	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8060b70	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x80592a0	80	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x80592aa	27	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x8060b74	4	OBJECT	<unknown>	HIDDEN	13
__GI___dl_iterate_phdr	.symtab	0x8059ad4	84	FUNC	<unknown>	HIDDEN	2
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x8054d60	83	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x80571bc	26	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x80592a0	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80592f0	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x80593b0	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x8059350	91	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x8059e78	27	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x8050abc	1	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x8050abd	1	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x80592f0	91	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x80592fa	33	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x8060c2c	8192	OBJECT	<unknown>	HIDDEN	14
__GI___pthread_register_cancel	.symtab	0x8050980	27	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unregister_cancel	.symtab	0x805099b	10	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind	.symtab	0x8050104	67	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x8050147	8	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x80593b0	91	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x80593ba	33	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x8059101	195	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x8060c0c	8	OBJECT	<unknown>	HIDDEN	14
__GI___uClibc_fini	.symtab	0x8059bab	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8059c0f	39	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x8059350	91	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x805935a	33	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80571d8	191	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8054e84	66	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80585f8	191	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x805734c	84	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8058a28	17	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x80573a0	40	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x805b35c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80592a0	80	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x80554ac	130	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x805a3fa	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x805a426	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x805a190	618	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x80573c8	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8058b6c	93	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x805574c	380	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8056cb0	447	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x805af50	145	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8056ae4	118	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8056f0c	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8055920	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x8058e9c	524	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x805a530	28	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8056f6c	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x805b4a0	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x805b4b8	246	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8059ec0	70	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8056f9c	111	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x8059f8c	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8059fac	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8059fb4	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8059fbc	8	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8054ec8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80591e4	49	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8054ee4	43	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x805741c	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8059fc4	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x805732c	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x805b2c8	148	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x80588eb	155	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x8059fcc	139	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x80572b0	27	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x8054f10	43	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x805747c	32	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x805b76c	90	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x805700c	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x805b0c4	37	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x80570d4	30	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x805b144	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8057038	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8054d44	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x805a058	59	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8054fd4	43	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8055029	61	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80592f0	91	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x80555b8	132	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8059218	100	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80586c0	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80587ec	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x805b758	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x80593b0	91	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x80556a8	127	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x805a10c	129	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x80550a4	47	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x805749c	92	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x80574f8	108	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x8055938	52	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x805a094	39	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x805a0bc	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80551e1	108	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8057564	92	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80575c0	108	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8055250	31	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x805762c	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8058986	161	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8054cab	80	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8055270	97	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x805596c	32	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8057664	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x805598c	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x805884b	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x80552d4	70	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x805b0ec	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x805b10c	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x805706c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x805706c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x805708c	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x805b1f8	45	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x80570a8	19	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x80570bc	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x805b2a4	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x805b128	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x805b228	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x80570f4	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8057298	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x805b254	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8058a3c	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8058c90	523	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x80572cc	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x805531c	16	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x805a0fc	16	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x805532c	39	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x8055354	39	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x805aea0	153	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80559ac	172	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x805a454	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x805a4b0	128	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x805a494	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8059350	91	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8060834	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x8060834	0	OBJECT	<unknown>	DEFAULT	10
__app_fini	.symtab	0x8065a00	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x8060b48	24	OBJECT	<unknown>	DEFAULT	13
__bss_start	.symtab	0x8060b78	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8059be3	44	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x80504d4	104	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x80592a0	80	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x80592aa	27	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x8060b74	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x8065a0c	4	OBJECT	<unknown>	HIDDEN	14
__deallocate_stack	.symtab	0x804e71b	127	FUNC	<unknown>	HIDDEN	2
__default_stacksize	.symtab	0x806096c	4	OBJECT	<unknown>	HIDDEN	13
__deregister_frame	.symtab	0x8054380	53	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x8054370	9	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x8054250	284	FUNC	<unknown>	HIDDEN	2
__dl_iterate_phdr	.symtab	0x8059ad4	84	FUNC	<unknown>	DEFAULT	2
__do_global_ctors_aux	.symtab	0x805b7d0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8060860	0	OBJECT	<unknown>	HIDDEN	13
__environ	.symtab	0x80659f8	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x804e178	13	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x8050537	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x8064f6c	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0x8054d60	83	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0x804e519	106	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__fini_array_start	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__fork	.symtab	0x804e088	5	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x8065be4	4	OBJECT	<unknown>	DEFAULT	14
__fork_generation_pointer	.symtab	0x8065fc0	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x8065fc4	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x8064f70	4	OBJECT	<unknown>	HIDDEN	14
__frame_state_for	.symtab	0x8051da0	206	FUNC	<unknown>	HIDDEN	2
__free_stacks	.symtab	0x804e6b0	107	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0x804e79a	68	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480d0	0	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x8059f08	131	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x805b388	280	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8054ec8	19	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x80591e4	49	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x80571bc	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__init_array_start	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__init_sched_fifo_prio	.symtab	0x80506bf	27	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x8065be0	4	OBJECT	<unknown>	HIDDEN	14
__libc_accept	.symtab	0x805734c	84	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x80592a0	80	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x80573c8	84	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x805940c	86	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x8059462	79	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	7
__libc_fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x8058e9c	524	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	7
__libc_longjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8055029	61	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80592f0	91	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x80590c8	28	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x80593b0	91	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x805749c	92	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x80574f8	108	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_select	.symtab	0x80551e1	108	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8057564	92	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80575c0	108	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x805950e	513	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8054cab	80	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80659f4	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x8059350	91	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x80590e4	29	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x8050280	41	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x8050250	40	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x80503c0	74	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x8050410	194	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x80502b0	65	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x8050350	112	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake	.symtab	0x8050320	33	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private	.symtab	0x8050300	32	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x8059e78	27	FUNC	<unknown>	DEFAULT	2
__make_stacks_executable	.symtab	0x804e5ba	6	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x80582d1	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x80576bc	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x8060a6c	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x8065c48	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x8058254	125	FUNC	<unknown>	DEFAULT	2
__nptl_create_event	.symtab	0x8050abc	1	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x804e5c0	240	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x8050abd	1	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x8062c30	1	OBJECT	<unknown>	DEFAULT	14
__nptl_last_event	.symtab	0x8060c20	4	OBJECT	<unknown>	DEFAULT	14
__nptl_nthreads	.symtab	0x8060958	4	OBJECT	<unknown>	DEFAULT	13
__nptl_setxid	.symtab	0x804e2a2	372	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x8060c18	8	OBJECT	<unknown>	DEFAULT	14
__open	.symtab	0x80592f0	91	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x80592fa	33	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x80659fc	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__preinit_array_start	.symtab	0x8060824	0	NOTYPE	<unknown>	HIDDEN	7
__progname	.symtab	0x8060b68	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x8060b6c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_cleanup_pop	.symtab	0x80509ca	32	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x8050a3c	126	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x80509a8	34	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x80509ec	80	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0x804eb53	1826	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x805061c	163	FUNC	<unknown>	HIDDEN	2
__pthread_disable_asynccancel	.symtab	0x80508d8	86	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x805092e	79	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0x804f275	196	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x8050beb	858	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x8050beb	858	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x8060c2c	8192	OBJECT	<unknown>	DEFAULT	14
__pthread_mutex_lock	.symtab	0x804fb83	307	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x804f784	1023	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x804fb83	307	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x80500da	14	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x804fd04	862	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x80500da	14	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x8050062	120	FUNC	<unknown>	HIDDEN	2
__pthread_once	.symtab	0x8050540	201	FUNC	<unknown>	PROTECTED	2
__pthread_once_internal	.symtab	0x8050540	201	FUNC	<unknown>	DEFAULT	2
__pthread_register_cancel	.symtab	0x8050980	27	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8059b7c	3	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x80506da	446	FUNC	<unknown>	HIDDEN	2
__pthread_unregister_cancel	.symtab	0x805099b	10	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x8050104	67	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x8050147	8	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x80593b0	91	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x80593ba	33	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x804f339	433	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x8059101	195	FUNC	<unknown>	DEFAULT	2
__register_frame	.symtab	0x8053af0	55	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x8053270	28	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x80531d0	153	FUNC	<unknown>	HIDDEN	2
__register_frame_info_table	.symtab	0x8054460	28	FUNC	<unknown>	HIDDEN	2
__register_frame_info_table_bases	.symtab	0x80543c0	147	FUNC	<unknown>	HIDDEN	2
__register_frame_table	.symtab	0x8054480	46	FUNC	<unknown>	HIDDEN	2
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
__restore	.symtab	0x8054ca3	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8054c9c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x8065a04	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_max_prio	.symtab	0x8060974	4	OBJECT	<unknown>	HIDDEN	13
__sched_fifo_min_prio	.symtab	0x8060970	4	OBJECT	<unknown>	HIDDEN	13
__set_robust_list_avail	.symtab	0x8065bf0	4	OBJECT	<unknown>	HIDDEN	14
__sigaction	.symtab	0x804e154	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x805768c	46	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x8054cfc	33	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8059e94	43	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stack_user	.symtab	0x8060c0c	8	OBJECT	<unknown>	DEFAULT	14
__static_tls_align_m1	.symtab	0x8065be8	4	OBJECT	<unknown>	HIDDEN	14
__static_tls_size	.symtab	0x8065bec	4	OBJECT	<unknown>	HIDDEN	14
__stdin	.symtab	0x806098c	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x805b5c8	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x805a54c	139	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x805b608	154	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x805a5d8	232	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x805b6a4	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x805b728	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x805b6cc	92	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x805a6c0	154	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8055e38	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8060990	4	OBJECT	<unknown>	DEFAULT	13
__syscall_error	.symtab	0x805060c	15	FUNC	<unknown>	HIDDEN	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x8055000	41	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x8054e4c	53	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x80551a8	57	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x8059bab	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8059c0f	39	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8059c36	577	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8060b64	4	OBJECT	<unknown>	HIDDEN	13
__wait_lookup_done	.symtab	0x804e416	259	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x8059350	91	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x805935a	33	FUNC	<unknown>	DEFAULT	2
__xidcmd	.symtab	0x8065bf4	4	OBJECT	<unknown>	HIDDEN	14
__xpg_strerror_r	.symtab	0x80571d8	191	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x805541f	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x805537c	163	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x8064d84	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x8055e60	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x8065bf8	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x8065c20	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x8060a68	4	OBJECT	<unknown>	HIDDEN	13
_dl_add_to_slotinfo	.symtab	0x805973d	141	FUNC	<unknown>	DEFAULT	2
_dl_allocate_static_tls	.symtab	0x80597ca	128	FUNC	<unknown>	HIDDEN	2
_dl_allocate_tls	.symtab	0x8059a02	21	FUNC	<unknown>	DEFAULT	2
_dl_allocate_tls_init	.symtab	0x80598d7	220	FUNC	<unknown>	DEFAULT	2
_dl_allocate_tls_storage	.symtab	0x80599b3	79	FUNC	<unknown>	HIDDEN	2
_dl_aux_init	.symtab	0x8059a7c	18	FUNC	<unknown>	DEFAULT	2
_dl_deallocate_tls	.symtab	0x805984a	94	FUNC	<unknown>	DEFAULT	2
_dl_get_tls_static_info	.symtab	0x8059720	16	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x8060b60	4	OBJECT	<unknown>	DEFAULT	13
_dl_loaded_modules	.symtab	0x8065a08	4	OBJECT	<unknown>	DEFAULT	14
_dl_memalign	.symtab	0x8059730	13	FUNC	<unknown>	DEFAULT	2
_dl_next_tls_modid	.symtab	0x8059a17	101	FUNC	<unknown>	HIDDEN	2
_dl_nothread_init_static_tls	.symtab	0x8059a8e	68	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x8065fe8	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x8065fec	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x8065fdc	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x8065fd8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x8065fe0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x8065fd0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x80594de	48	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x8065fcc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x8065fe4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x8065fd4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x8065fc8	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x8060b78	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8065ff0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x8054e84	66	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x805b7f7	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8062d84	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x8055e95	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x805a8d8	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80480b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x805a75c	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_longjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
_longjmp_unwind	.symtab	0x805927c	23	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x80564f0	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x80566d5	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8056558	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8056594	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x80566ac	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop	.symtab	0x80509ca	32	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8050a3c	126	FUNC	<unknown>	PROTECTED	2
_pthread_cleanup_push	.symtab	0x80509a8	34	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80509ec	80	FUNC	<unknown>	PROTECTED	2
_res	.symtab	0x8064d94	468	OBJECT	<unknown>	HIDDEN	14
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x8054d20	34	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x8048184	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8055a58	664	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8055d2c	59	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8060994	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x8062d64	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x8056b70	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x8062d80	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x8062d70	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x8062d7c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x806099c	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x8055d67	208	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8060998	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x8058a54	278	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x805a7b4	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805d004	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_thread_db___nptl_last_event	.symtab	0x805ca58	12	OBJECT	<unknown>	DEFAULT	4
_thread_db___nptl_nthreads	.symtab	0x805ca4c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db___pthread_keys	.symtab	0x805ca64	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_dtv_dtv	.symtab	0x805cab8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_dtv_t_pointer_val	.symtab	0x805cac4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_link_map_l_tls_modid	.symtab	0x805caac	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_list_t_next	.symtab	0x805ca10	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_list_t_prev	.symtab	0x805ca1c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_cancelhandling	.symtab	0x805c9b0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_dtvp	.symtab	0x805cad0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf	.symtab	0x805c9e0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf_eventmask	.symtab	0x805c9ec	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_eventbuf_eventmask_event_bits	.symtab	0x805c9f8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_data	.symtab	0x805ca94	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_level2_data	.symtab	0x805caa0	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_data_seq	.symtab	0x805ca88	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_struct_destr	.symtab	0x805ca7c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_key_struct_seq	.symtab	0x805ca70	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_list	.symtab	0x805c980	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_nextevent	.symtab	0x805ca04	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_report_events	.symtab	0x805c98c	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_schedparam_sched_priority	.symtab	0x805c9c8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_schedpolicy	.symtab	0x805c9bc	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_specific	.symtab	0x805c9d4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_start_routine	.symtab	0x805c9a4	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_pthread_tid	.symtab	0x805c998	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_register32_thread_area	.symtab	0x805cadc	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_register64_thread_area	.symtab	0x805cae8	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_eventbuf_t_eventdata	.symtab	0x805ca40	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_eventbuf_t_eventnum	.symtab	0x805ca34	12	OBJECT	<unknown>	DEFAULT	4
_thread_db_td_thr_events_t_event_bits	.symtab	0x805ca28	12	OBJECT	<unknown>	DEFAULT	4
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x805a7f4	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8055ef3	1530	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80585f8	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x805734c	84	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_fdes	.symtab	0x8053880	282	FUNC	<unknown>	DEFAULT	2
adds.6870	.symtab	0x8060978	8	OBJECT	<unknown>	DEFAULT	13
allocate_dtv	.symtab	0x80598a8	47	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8058a28	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8058a28	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x8048700	109	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x8048690	101	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0x80481b0	92	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0x80495f0	1243	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x8048770	1076	FUNC	<unknown>	DEFAULT	2
attack_kill_all	.symtab	0x80482d0	326	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0x804bb20	1350	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x8060bc0	32	OBJECT	<unknown>	DEFAULT	14
attack_parse	.symtab	0x8048420	613	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x8048210	192	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0x8049050	1433	FUNC	<unknown>	DEFAULT	2
attack_tcp_bypass	.symtab	0x804a5a0	1350	FUNC	<unknown>	DEFAULT	2
attack_tcp_legit	.symtab	0x8048bb0	1183	FUNC	<unknown>	DEFAULT	2
attack_tcp_sack2	.symtab	0x804a040	1366	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0x8049ad0	1391	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_custom	.symtab	0x804b720	1011	FUNC	<unknown>	DEFAULT	2
attack_udp_plain	.symtab	0x804ab00	683	FUNC	<unknown>	DEFAULT	2
attack_udp_stdhex	.symtab	0x804b440	731	FUNC	<unknown>	DEFAULT	2
attack_udp_thread	.symtab	0x804b1d0	615	FUNC	<unknown>	DEFAULT	2
attack_udp_vse	.symtab	0x804adb0	896	FUNC	<unknown>	DEFAULT	2
base_from_cb_data	.symtab	0x8053400	90	FUNC	<unknown>	DEFAULT	2
base_from_object	.symtab	0x8053460	90	FUNC	<unknown>	DEFAULT	2
base_of_encoded_value	.symtab	0x80512c0	107	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x8064f68	1	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x80573a0	40	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x805b35c	44	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
calloc	.symtab	0x8057e6c	236	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
change_stack_perm	.symtab	0x804e583	55	FUNC	<unknown>	DEFAULT	2
check_list.6872	.symtab	0x804e1c9	29	FUNC	<unknown>	DEFAULT	2
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x804c070	70	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x804c0c0	169	FUNC	<unknown>	DEFAULT	2
classify_object_over_fdes	.symtab	0x80539a0	329	FUNC	<unknown>	DEFAULT	2
cleanup	.symtab	0x804f66c	26	FUNC	<unknown>	DEFAULT	2
cleanup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cleanup_compat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cleanup_defer_compat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock	.symtab	0x8055728	34	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clone	.symtab	0x80504d4	104	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x80592a0	80	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x80554ac	130	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4963	.symtab	0x8060b80	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x80573c8	84	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
default_attr	.symtab	0x805caf4	32	OBJECT	<unknown>	DEFAULT	4
dl-core.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-iterate-phdr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl_iterate_phdr	.symtab	0x8059b28	84	FUNC	<unknown>	DEFAULT	2
do_clone	.symtab	0x804ea1e	309	FUNC	<unknown>	DEFAULT	2
dwarf_reg_size_table	.symtab	0x8062c38	18	OBJECT	<unknown>	DEFAULT	14
entries	.symtab	0x8065a60	4	OBJECT	<unknown>	DEFAULT	14
environ	.symtab	0x80659f8	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	7
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
events.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execute_cfa_program	.symtab	0x8051420	1307	FUNC	<unknown>	DEFAULT	2
execute_stack_op	.symtab	0x8051e70	1607	FUNC	<unknown>	DEFAULT	2
exit	.symtab	0x8058b6c	93	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x805e2f0	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x805574c	380	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x8054db3	153	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x8060948	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x806094c	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x8055530	136	FUNC	<unknown>	DEFAULT	2
fde_mixed_encoding_compare	.symtab	0x80544b0	146	FUNC	<unknown>	DEFAULT	2
fde_single_encoding_compare	.symtab	0x80535a0	122	FUNC	<unknown>	DEFAULT	2
fde_unencoded_compare	.symtab	0x8053290	28	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x805563c	108	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8056cb0	447	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x805af50	145	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8056ae4	118	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8056f0c	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
first_connect	.symtab	0x8060be4	4	OBJECT	<unknown>	DEFAULT	14
fmt	.symtab	0x805e2d0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8055920	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804e088	5	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x8064f74	1348	OBJECT	<unknown>	DEFAULT	14
fprintf	.symtab	0x805a530	28	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8056f6c	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_downheap	.symtab	0x80532b0	177	FUNC	<unknown>	DEFAULT	2
frame_dummy	.symtab	0x8048130	0	FUNC	<unknown>	DEFAULT	2
frame_hdr_cache	.symtab	0x8062ca0	192	OBJECT	<unknown>	DEFAULT	14
frame_hdr_cache_head	.symtab	0x8062d60	4	OBJECT	<unknown>	DEFAULT	14
frame_heapsort	.symtab	0x8053370	139	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x805844c	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x805b4a0	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x805b4a0	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x805b4b8	246	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8059ec0	70	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x8056f9c	111	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_cie_encoding	.symtab	0x8053620	186	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x805af50	145	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x805aff8	204	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x8059f8c	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8059fac	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8059fb4	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8059fbc	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8054ec8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80591e4	49	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x8054edc	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8054ee4	43	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x805741c	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8057444	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8059fc4	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x8	4	TLS	<unknown>	DEFAULT	7
httpd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
httpd_pid	.symtab	0x8060868	4	OBJECT	<unknown>	DEFAULT	13
httpd_port	.symtab	0x8060bec	4	OBJECT	<unknown>	DEFAULT	14
httpd_serve	.symtab	0x804c1d0	552	FUNC	<unknown>	DEFAULT	2
httpd_start	.symtab	0x804c400	456	FUNC	<unknown>	DEFAULT	2
httpd_started	.symtab	0x8060bf0	4	OBJECT	<unknown>	DEFAULT	14
id_buf	.symtab	0x8065a40	32	OBJECT	<unknown>	DEFAULT	14
in_flight_stack	.symtab	0x8060c28	4	OBJECT	<unknown>	DEFAULT	14
index	.symtab	0x805b0ec	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x805732c	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x805b2c8	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_dwarf_reg_size_table	.symtab	0x8051330	129	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x80594b4	42	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initialized.6260	.symtab	0x8062c2c	4	OBJECT	<unknown>	DEFAULT	14
initstate	.symtab	0x8058759	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x80588eb	155	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x8059fcc	139	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x80572b0	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
jmp-unwind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x8054f10	43	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill_malware	.symtab	0x804c750	312	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x804c890	43	FUNC	<unknown>	DEFAULT	2
killer_kill	.symtab	0x804c5d0	29	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x8060be0	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc_pthread_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
linear_search_fdes	.symtab	0x8053740	306	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x805747c	32	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lock_commands	.symtab	0x804c5f0	337	FUNC	<unknown>	DEFAULT	2
lockdown	.symtab	0x8065a28	4	OBJECT	<unknown>	DEFAULT	14
longjmp	.symtab	0x8054f3c	54	FUNC	<unknown>	DEFAULT	2
longjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x805b76c	90	FUNC	<unknown>	DEFAULT	2
madvise	.symtab	0x8054f74	47	FUNC	<unknown>	DEFAULT	2
madvise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
main	.symtab	0x804c950	2958	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
main_pid	.symtab	0x8065a64	4	OBJECT	<unknown>	DEFAULT	14
malloc	.symtab	0x80576e2	1928	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x80585db	29	FUNC	<unknown>	DEFAULT	2
marker.6373	.symtab	0x8062c78	4	OBJECT	<unknown>	DEFAULT	14
memcpy	.symtab	0x805700c	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x805b0c4	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x80570d4	30	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x805b144	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8057038	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
methods	.symtab	0x8060ba0	4	OBJECT	<unknown>	DEFAULT	14
methods_len	.symtab	0x8060b9c	1	OBJECT	<unknown>	DEFAULT	14
mmap	.symtab	0x8054d44	27	FUNC	<unknown>	DEFAULT	2
mprotect	.symtab	0x8054fa4	47	FUNC	<unknown>	DEFAULT	2
mprotect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x805a058	59	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x8054fd4	43	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8060a84	24	OBJECT	<unknown>	DEFAULT	13
mylock	.symtab	0x8060a9c	24	OBJECT	<unknown>	DEFAULT	13
nanosleep	.symtab	0x8055029	61	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x8064d90	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x8058bcc	196	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
object.4975	.symtab	0x8060b84	24	OBJECT	<unknown>	DEFAULT	14
object_mutex	.symtab	0x8062c60	24	OBJECT	<unknown>	DEFAULT	14
once_regsizes.7294	.symtab	0x8062c34	4	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x80592f0	91	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x80555b8	132	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.4961	.symtab	0x8060864	0	OBJECT	<unknown>	DEFAULT	13
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
parse_request	.symtab	0x804c170	95	FUNC	<unknown>	DEFAULT	2
pending_connection	.symtab	0x8060bf4	1	OBJECT	<unknown>	DEFAULT	14
pgid	.symtab	0x8060bf8	4	OBJECT	<unknown>	DEFAULT	14
prctl	.symtab	0x8055068	59	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6454	.symtab	0x805cf5c	12	OBJECT	<unknown>	DEFAULT	4
program_invocation_name	.symtab	0x8060b6c	4	OBJECT	<unknown>	DEFAULT	13
program_invocation_short_name	.symtab	0x8060b68	4	OBJECT	<unknown>	DEFAULT	13
pseudo_cancel	.symtab	0x80592c5	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805931b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805937b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x80593db	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80592ef	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805934a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80593aa	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805940a	0	NOTYPE	<unknown>	DEFAULT	2
pt-__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pt-sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_cancel	.symtab	0x8050f48	152	FUNC	<unknown>	DEFAULT	2
pthread_cancel.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_create	.symtab	0x804eb53	1826	FUNC	<unknown>	DEFAULT	2
pthread_create.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_getspecific.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_join	.symtab	0x804f686	252	FUNC	<unknown>	DEFAULT	2
pthread_join.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_key_create.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_key_delete.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_lock	.symtab	0x804fb83	307	FUNC	<unknown>	DEFAULT	2
pthread_mutex_lock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_trylock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_mutex_unlock	.symtab	0x80500da	14	FUNC	<unknown>	DEFAULT	2
pthread_mutex_unlock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pthread_once	.symtab	0x8050540	201	FUNC	<unknown>	DEFAULT	2
pthread_setspecific.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.6463	.symtab	0x805cf70	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8059218	100	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80586b8	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_init	.symtab	0x804d520	63	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x804d4e0	64	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x804d560	218	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80586c0	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x805db60	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80587ec	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8060ac8	128	OBJECT	<unknown>	DEFAULT	13
rawmemchr	.symtab	0x805b758	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x80593b0	91	FUNC	<unknown>	DEFAULT	2
read_encoded_value_with_base	.symtab	0x80511e0	213	FUNC	<unknown>	DEFAULT	2
read_encoded_value_with_base	.symtab	0x80534c0	213	FUNC	<unknown>	DEFAULT	2
read_sleb128	.symtab	0x8051020	109	FUNC	<unknown>	DEFAULT	2
read_sleb128	.symtab	0x8053160	109	FUNC	<unknown>	DEFAULT	2
read_uleb128	.symtab	0x8050fe0	59	FUNC	<unknown>	DEFAULT	2
read_uleb128	.symtab	0x8053120	59	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x80556a8	127	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x805a10c	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x80550a4	47	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8057f58	763	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x805749c	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x80574f8	108	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
remove	.symtab	0x8055938	52	FUNC	<unknown>	DEFAULT	2
remove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
res_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_entries_free	.symtab	0x804d640	52	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x804d680	1192	FUNC	<unknown>	DEFAULT	2
resolve_cnc_addr	.symtab	0x804c8c0	135	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x8060950	4	OBJECT	<unknown>	DEFAULT	13
rindex	.symtab	0x805b128	26	FUNC	<unknown>	DEFAULT	2
rmdir	.symtab	0x805a094	39	FUNC	<unknown>	DEFAULT	2
rmdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sbrk	.symtab	0x805a0bc	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_get_priority_max	.symtab	0x80550d4	39	FUNC	<unknown>	DEFAULT	2
sched_get_priority_max.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_get_priority_min	.symtab	0x80550fc	39	FUNC	<unknown>	DEFAULT	2
sched_get_priority_min.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_getparam	.symtab	0x8055124	43	FUNC	<unknown>	DEFAULT	2
sched_getparam.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sched_getscheduler	.symtab	0x8055150	39	FUNC	<unknown>	DEFAULT	2
sched_getscheduler.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T19:42:43.432615+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38342	89.169.4.44	47925	TCP
2024-11-28T19:42:54.027442+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38344	89.169.4.44	47925	TCP
2024-11-28T19:43:05.607200+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38346	89.169.4.44	47925	TCP
2024-11-28T19:43:12.129050+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38348	89.169.4.44	47925	TCP
2024-11-28T19:43:20.737679+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38350	89.169.4.44	47925	TCP
2024-11-28T19:43:30.343748+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38352	89.169.4.44	47925	TCP
2024-11-28T19:43:36.895374+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38354	89.169.4.44	47925	TCP
2024-11-28T19:43:45.488580+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38356	89.169.4.44	47925	TCP
2024-11-28T19:43:50.019362+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38358	89.169.4.44	47925	TCP
2024-11-28T19:44:02.625937+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38360	89.169.4.44	47925	TCP
2024-11-28T19:44:09.215745+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38362	89.169.4.44	47925	TCP
2024-11-28T19:44:19.823934+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38364	89.169.4.44	47925	TCP
2024-11-28T19:44:29.098272+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38366	89.169.4.44	47925	TCP
2024-11-28T19:44:35.973633+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38368	89.169.4.44	47925	TCP
2024-11-28T19:44:48.544574+0100	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.13	38370	89.169.4.44	47925	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 19:42:43.312474966 CET	38342	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:43.432507992 CET	47925	38342	89.169.4.44	192.168.2.13
Nov 28, 2024 19:42:43.432566881 CET	38342	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:43.432615042 CET	38342	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:43.552615881 CET	47925	38342	89.169.4.44	192.168.2.13
Nov 28, 2024 19:42:45.767627001 CET	47925	38342	89.169.4.44	192.168.2.13
Nov 28, 2024 19:42:45.767730951 CET	38342	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:45.894182920 CET	47925	38342	89.169.4.44	192.168.2.13
Nov 28, 2024 19:42:53.492885113 CET	48202	443	192.168.2.13	185.125.190.26
Nov 28, 2024 19:42:53.904244900 CET	38344	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:54.027345896 CET	47925	38344	89.169.4.44	192.168.2.13
Nov 28, 2024 19:42:54.027420044 CET	38344	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:54.027441978 CET	38344	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:54.150866985 CET	47925	38344	89.169.4.44	192.168.2.13
Nov 28, 2024 19:42:56.344952106 CET	47925	38344	89.169.4.44	192.168.2.13
Nov 28, 2024 19:42:56.345071077 CET	38344	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:42:56.465496063 CET	47925	38344	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:05.483091116 CET	38346	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:05.607070923 CET	47925	38346	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:05.607155085 CET	38346	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:05.607199907 CET	38346	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:05.729149103 CET	47925	38346	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:07.881258965 CET	47925	38346	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:07.881402016 CET	38346	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:08.001413107 CET	47925	38346	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:12.005805016 CET	38348	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:12.128947973 CET	47925	38348	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:12.129017115 CET	38348	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:12.129050016 CET	38348	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:12.252203941 CET	47925	38348	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:14.482598066 CET	47925	38348	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:14.482923985 CET	38348	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:14.603744984 CET	47925	38348	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:20.613934994 CET	38350	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:20.737606049 CET	47925	38350	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:20.737679005 CET	38350	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:20.737679005 CET	38350	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:20.858818054 CET	47925	38350	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:23.076390028 CET	47925	38350	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:23.076514959 CET	38350	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:23.196645021 CET	47925	38350	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:24.980865955 CET	48202	443	192.168.2.13	185.125.190.26
Nov 28, 2024 19:43:30.219033957 CET	38352	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:30.343609095 CET	47925	38352	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:30.343724012 CET	38352	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:30.343748093 CET	38352	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:30.465138912 CET	47925	38352	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:32.631263971 CET	47925	38352	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:32.631406069 CET	38352	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:32.756222963 CET	47925	38352	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:36.771083117 CET	38354	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:36.895236969 CET	47925	38354	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:36.895338058 CET	38354	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:36.895374060 CET	38354	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:37.015384912 CET	47925	38354	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:39.220242977 CET	47925	38354	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:39.220489025 CET	38354	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:39.342995882 CET	47925	38354	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:45.362241983 CET	38356	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:45.488466978 CET	47925	38356	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:45.488579035 CET	38356	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:45.488579988 CET	38356	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:45.615305901 CET	47925	38356	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:47.757966995 CET	47925	38356	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:47.758115053 CET	38356	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:47.885051966 CET	47925	38356	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:49.899081945 CET	38358	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:50.019246101 CET	47925	38358	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:50.019361019 CET	38358	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:50.019361973 CET	38358	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:50.139854908 CET	47925	38358	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:52.357856035 CET	47925	38358	89.169.4.44	192.168.2.13
Nov 28, 2024 19:43:52.357968092 CET	38358	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:43:52.484142065 CET	47925	38358	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:02.498961926 CET	38360	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:02.625768900 CET	47925	38360	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:02.625874043 CET	38360	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:02.625936985 CET	38360	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:02.746980906 CET	47925	38360	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:04.959043980 CET	47925	38360	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:04.959319115 CET	38360	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:05.079397917 CET	47925	38360	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:09.095377922 CET	38362	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:09.215476036 CET	47925	38362	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:09.215715885 CET	38362	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:09.215744972 CET	38362	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:09.339442015 CET	47925	38362	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:11.564702988 CET	47925	38362	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:11.564923048 CET	38362	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:11.684950113 CET	47925	38362	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:19.703133106 CET	38364	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:19.823713064 CET	47925	38364	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:19.823934078 CET	38364	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:19.823934078 CET	38364	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:19.945791006 CET	47925	38364	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:22.835155964 CET	47925	38364	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:22.835298061 CET	38364	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:22.957117081 CET	47925	38364	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:28.972846031 CET	38366	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:29.097996950 CET	47925	38366	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:29.098234892 CET	38366	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:29.098272085 CET	38366	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:29.225068092 CET	47925	38366	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:31.712335110 CET	47925	38366	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:31.712498903 CET	38366	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:32.115204096 CET	47925	38366	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:32.115331888 CET	38366	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:32.116741896 CET	38366	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:32.187397957 CET	47925	38366	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:32.236681938 CET	47925	38366	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:32.236823082 CET	38366	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:35.849862099 CET	38368	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:35.973495960 CET	47925	38368	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:35.973598003 CET	38368	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:35.973633051 CET	38368	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:36.095019102 CET	47925	38368	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:38.282434940 CET	47925	38368	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:38.282579899 CET	38368	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:38.402565002 CET	47925	38368	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:48.424393892 CET	38370	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:48.544409037 CET	47925	38370	89.169.4.44	192.168.2.13
Nov 28, 2024 19:44:48.544574022 CET	38370	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:48.544574022 CET	38370	47925	192.168.2.13	89.169.4.44
Nov 28, 2024 19:44:48.667160034 CET	47925	38370	89.169.4.44	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 19:42:43.177282095 CET	35441	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:42:43.312374115 CET	53	35441	8.8.8.8	192.168.2.13
Nov 28, 2024 19:42:53.769201994 CET	51089	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:42:53.904128075 CET	53	51089	8.8.8.8	192.168.2.13
Nov 28, 2024 19:43:05.346507072 CET	33319	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:43:05.482939005 CET	53	33319	8.8.8.8	192.168.2.13
Nov 28, 2024 19:43:11.882509947 CET	57233	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:43:12.005675077 CET	53	57233	8.8.8.8	192.168.2.13
Nov 28, 2024 19:43:20.484137058 CET	53905	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:43:20.613832951 CET	53	53905	8.8.8.8	192.168.2.13
Nov 28, 2024 19:43:30.077708960 CET	59236	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:43:30.218799114 CET	53	59236	8.8.8.8	192.168.2.13
Nov 28, 2024 19:43:36.632695913 CET	46067	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:43:36.770948887 CET	53	46067	8.8.8.8	192.168.2.13
Nov 28, 2024 19:43:45.221982956 CET	58258	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:43:45.362112999 CET	53	58258	8.8.8.8	192.168.2.13
Nov 28, 2024 19:43:49.759459972 CET	50088	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:43:49.898947954 CET	53	50088	8.8.8.8	192.168.2.13
Nov 28, 2024 19:44:02.359055042 CET	54034	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:44:02.498756886 CET	53	54034	8.8.8.8	192.168.2.13
Nov 28, 2024 19:44:08.960844040 CET	42823	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:44:09.095186949 CET	53	42823	8.8.8.8	192.168.2.13
Nov 28, 2024 19:44:19.566612005 CET	39486	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:44:19.702944994 CET	53	39486	8.8.8.8	192.168.2.13
Nov 28, 2024 19:44:28.837119102 CET	50894	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:44:28.972662926 CET	53	50894	8.8.8.8	192.168.2.13
Nov 28, 2024 19:44:35.713655949 CET	51113	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:44:35.849715948 CET	53	51113	8.8.8.8	192.168.2.13
Nov 28, 2024 19:44:48.283777952 CET	35038	53	192.168.2.13	8.8.8.8
Nov 28, 2024 19:44:48.424242020 CET	53	35038	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 19:42:43.177282095 CET	192.168.2.13	8.8.8.8	0x5a50	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:42:53.769201994 CET	192.168.2.13	8.8.8.8	0x8e4c	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:05.346507072 CET	192.168.2.13	8.8.8.8	0x470c	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:11.882509947 CET	192.168.2.13	8.8.8.8	0x73a2	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:20.484137058 CET	192.168.2.13	8.8.8.8	0x3ba8	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:30.077708960 CET	192.168.2.13	8.8.8.8	0xf110	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:36.632695913 CET	192.168.2.13	8.8.8.8	0x64cd	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:45.221982956 CET	192.168.2.13	8.8.8.8	0xe99e	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:49.759459972 CET	192.168.2.13	8.8.8.8	0xf053	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:02.359055042 CET	192.168.2.13	8.8.8.8	0x52fe	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:08.960844040 CET	192.168.2.13	8.8.8.8	0x11da	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:19.566612005 CET	192.168.2.13	8.8.8.8	0xe640	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:28.837119102 CET	192.168.2.13	8.8.8.8	0xc97d	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:35.713655949 CET	192.168.2.13	8.8.8.8	0x3b60	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:48.283777952 CET	192.168.2.13	8.8.8.8	0x78be	Standard query (0)	seyfhg.work.gd	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 19:42:43.312374115 CET	8.8.8.8	192.168.2.13	0x5a50	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:42:53.904128075 CET	8.8.8.8	192.168.2.13	0x8e4c	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:05.482939005 CET	8.8.8.8	192.168.2.13	0x470c	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:12.005675077 CET	8.8.8.8	192.168.2.13	0x73a2	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:20.613832951 CET	8.8.8.8	192.168.2.13	0x3ba8	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:30.218799114 CET	8.8.8.8	192.168.2.13	0xf110	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:36.770948887 CET	8.8.8.8	192.168.2.13	0x64cd	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:45.362112999 CET	8.8.8.8	192.168.2.13	0xe99e	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:43:49.898947954 CET	8.8.8.8	192.168.2.13	0xf053	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:02.498756886 CET	8.8.8.8	192.168.2.13	0x52fe	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:09.095186949 CET	8.8.8.8	192.168.2.13	0x11da	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:19.702944994 CET	8.8.8.8	192.168.2.13	0xe640	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:28.972662926 CET	8.8.8.8	192.168.2.13	0xc97d	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:35.849715948 CET	8.8.8.8	192.168.2.13	0x3b60	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false
Nov 28, 2024 19:44:48.424242020 CET	8.8.8.8	192.168.2.13	0x78be	No error (0)	seyfhg.work.gd	89.169.4.44	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: bot.x86.elf PID: 5442, Parent PID: 5370

General

Start time (UTC):	18:42:42
Start date (UTC):	28/11/2024
Path:	/tmp/bot.x86.elf
Arguments:	/tmp/bot.x86.elf
File size:	196340 bytes
MD5 hash:	cd2b09f67594d5adcea3d1aeb9deff28

Start time (UTC):	18:42:42
Start date (UTC):	28/11/2024
Path:	/tmp/bot.x86.elf
Arguments:	-
File size:	196340 bytes
MD5 hash:	cd2b09f67594d5adcea3d1aeb9deff28

Start time (UTC):	18:42:42
Start date (UTC):	28/11/2024
Path:	/tmp/bot.x86.elf
Arguments:	-
File size:	196340 bytes
MD5 hash:	cd2b09f67594d5adcea3d1aeb9deff28

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bot.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: bot.x86.elf PID: 5442, Parent PID: 5370

General

Chronological Activities

Analysis Process: bot.x86.elf PID: 5443, Parent PID: 5442

General

Chronological Activities

Analysis Process: bot.x86.elf PID: 5444, Parent PID: 5443

General

Chronological Activities

Linux Analysis Report
bot.x86.elf