Edit tour

Linux Analysis Report
jackmyarmv6.elf

Overview

General Information

Sample name:	jackmyarmv6.elf
Analysis ID:	1580015
MD5:	f8267e8d44d86203d2560d280b66bd36
SHA1:	5a1c5e5caeacdf01af8c44bcbe1625b7ad0eb0fb
SHA256:	a3360319b5713fa0352e837562c56a8fa34ff656a506763ca7e809d120e57980
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580015
Start date and time:	2024-12-23 18:15:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	jackmyarmv6.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: jackmyarmv6.elf

Runtime Messages

Command:	/tmp/jackmyarmv6.elf
PID:	5466
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

jackmyarmv6.elf (PID: 5466, Parent: 5385, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/jackmyarmv6.elf

jackmyarmv6.elf New Fork (PID: 5468, Parent: 5466)

jackmyarmv6.elf New Fork (PID: 5470, Parent: 5468)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
jackmyarmv6.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
jackmyarmv6.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
jackmyarmv6.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1940c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1945c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
jackmyarmv6.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1b8e8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1d924:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1940c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1945c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1b8e8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1d924:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1940c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1945c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1b8e8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1d924:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: jackmyarmv6.elf PID: 5466	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: jackmyarmv6.elf PID: 5466	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5373:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5387:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x539b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5413:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5427:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x543b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x544f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5463:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5477:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x548b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x549f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5503:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: jackmyarmv6.elf PID: 5466	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x8816:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x8a83:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xb6ae:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: jackmyarmv6.elf PID: 5468	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: jackmyarmv6.elf PID: 5468	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5ff6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x600a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x601e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6032:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6046:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x605a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x606e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6082:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6096:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x610e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6122:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6136:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x614a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x615e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6172:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6186:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: jackmyarmv6.elf PID: 5468	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x9499:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x9706:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xc331:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T18:16:20.714166+0100	2846526	1	A Network Trojan was detected	192.168.2.13	41652	154.213.186.115	4444	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jackmyarmv6.elf

Avira: detected

Found malware configuration

Source: jackmyarmv6.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "154.213.186.115:4444"}

Multi AV Scanner detection for submitted file

Source: jackmyarmv6.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/jackmyarmv6.elf (PID: 5466)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:41652 -> 154.213.186.115:4444

Source: global traffic

TCP traffic: 192.168.2.13:41652 -> 154.213.186.115:4444

Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.186.115
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: jackmyarmv6.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: jackmyarmv6.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: jackmyarmv6.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: jackmyarmv6.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: jackmyarmv6.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: jackmyarmv6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: jackmyarmv6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: jackmyarmv6.elf PID: 5466, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: jackmyarmv6.elf PID: 5466, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: jackmyarmv6.elf PID: 5468, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: jackmyarmv6.elf PID: 5468, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: jackmyarmv6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: jackmyarmv6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: jackmyarmv6.elf PID: 5466, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: jackmyarmv6.elf PID: 5466, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: jackmyarmv6.elf PID: 5468, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: jackmyarmv6.elf PID: 5468, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: jackmyarmv6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: jackmyarmv6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: jackmyarmv6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: jackmyarmv6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: jackmyarmv6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: jackmyarmv6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: jackmyarmv6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm

Source: /tmp/jackmyarmv6.elf (PID: 5466)

Queries kernel information via 'uname':

Jump to behavior

Source: jackmyarmv6.elf, 5466.1.0000564735e7b000.0000564735fa9000.rw-.sdmp, jackmyarmv6.elf, 5468.1.0000564735e7b000.0000564735fa9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: jackmyarmv6.elf, 5466.1.00007ffdb6094000.00007ffdb60b5000.rw-.sdmp, jackmyarmv6.elf, 5468.1.00007ffdb6094000.00007ffdb60b5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: jackmyarmv6.elf, 5466.1.00007ffdb6094000.00007ffdb60b5000.rw-.sdmp, jackmyarmv6.elf, 5468.1.00007ffdb6094000.00007ffdb60b5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/jackmyarmv6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jackmyarmv6.elf
Source: jackmyarmv6.elf, 5466.1.0000564735e7b000.0000564735fa9000.rw-.sdmp, jackmyarmv6.elf, 5468.1.0000564735e7b000.0000564735fa9000.rw-.sdmp	Binary or memory string: 5GV!/etc/qemu-binfmt/arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: jackmyarmv6.elf, type: SAMPLE
Source: Yara match	File source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: jackmyarmv6.elf, type: SAMPLE
Source: Yara match	File source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jackmyarmv6.elf PID: 5466, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jackmyarmv6.elf PID: 5468, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: jackmyarmv6.elf, type: SAMPLE
Source: Yara match	File source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: jackmyarmv6.elf, type: SAMPLE
Source: Yara match	File source: 5466.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5468.1.00007f93ec017000.00007f93ec037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jackmyarmv6.elf PID: 5466, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jackmyarmv6.elf PID: 5468, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "154.213.186.115:4444"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
jackmyarmv6.elf	66%	ReversingLabs	Linux.Trojan.LnxGafgyt
jackmyarmv6.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
154.213.186.115:4444	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	jackmyarmv6.elf	false	high
http://www.billybobbot.com/crawler/)	jackmyarmv6.elf	false	high
http://fast.no/support/crawler.asp)	jackmyarmv6.elf	false	high
http://feedback.redkolibri.com/	jackmyarmv6.elf	false	high
http://www.baidu.com/search/spider.htm)	jackmyarmv6.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.213.186.115	unknown	Seychelles		22769	DDOSING-BGP-NETWORKUS	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.213.186.115	jackmymips64.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	jackmymipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	jackmyi586.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	jackmymips64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	jackmymipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	jackmyi586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	arm5.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	arm.nn-20241223-1416.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	arm5.nn-20241223-1416.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	arm6.nn-20241223-1416.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	armv7l.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	ub8ehJSePAfc9FYqZIT6.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	1.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DDOSING-BGP-NETWORKUS	jackmymips64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.213.186.115
	jackmymipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.213.186.115
	jackmyi586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.213.186.115
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	196.52.103.46
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	154.213.187.106
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.213.187.106
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.213.187.106
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.213.187.106
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.213.187.106
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.213.187.106

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.197029301396832
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	jackmyarmv6.elf
File size:	170'949 bytes
MD5:	f8267e8d44d86203d2560d280b66bd36
SHA1:	5a1c5e5caeacdf01af8c44bcbe1625b7ad0eb0fb
SHA256:	a3360319b5713fa0352e837562c56a8fa34ff656a506763ca7e809d120e57980
SHA512:	7b7398311260831b8428e76c46f31297dbfcae42c5c41c87c0644892854b0477406641bd0d5e7af03c7190a8fac38ac0c3cded5341f4f07dbfb974b8275b934e
SSDEEP:	3072:pqdR8ML89raonajuog68FiFL85hDnRF6iH3RxmfQOYbr5Wn:0tArayajJFL85htF66xmfQOYbr5Wn
TLSH:	98F33B24E4404767C2D313BAB69E866E3F321BF653CB33115A349EB41FC2B992D69874
File Content Preview:	.ELF..............(.........4...........4. ...(........p.....z...z......................................................................Pj..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	138748
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x17c50	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1fd20	0x17d20	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1fd30	0x17d30	0x7dac	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x27adc	0x1fadc	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x27af4	0x1faf4	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x28000	0x20000	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x28004	0x20004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x28008	0x20008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2800c	0x2000c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x28010	0x20010	0x78	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x28088	0x20088	0x360	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x283e8	0x203e8	0x6668	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x203e8	0xc52	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x21040	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x21120	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x215d0	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x2165c	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x21cb4	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21d0c	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x21d1c	0xdd	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x221bc	0x5020	0x10	0x0		23	706	4
.strtab	STRTAB	0x0	0x271dc	0x29e9	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1faf4	0x27af4	0x27af4	0x10	0x10	2.4056	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1fb04	0x1fb04	6.3601	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x20000	0x28000	0x28000	0x3e8	0x6a50	4.0853	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1fd20	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1fd30	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x27adc	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x27af4	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x28000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x28004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x28008	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2800c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x28010	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x28088	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x283e8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1fd20	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1fd2c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x853c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x969c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa8fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xacb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb32c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb46c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe95c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1492c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1497c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1587c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1632c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1641c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1650c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1695c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1808c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1836c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1861c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1925c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1939c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1942c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1955c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1968c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1975c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1998c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a684	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a80c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1becc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ced4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d22c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e30c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28008	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28004	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x2808c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28090	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x82a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x838c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x88b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa8e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22684	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xaa64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xacb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb71c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xced8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd068	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd708	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe68c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe7f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1037c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10930	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13dd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2818c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x28194	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x14d18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ecc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x281d0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x2819c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x26a28	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x282d8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x163f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1654c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16648	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1689c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16990	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x282dc	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x179e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x282f4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x17c08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2830c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x283a4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x17f1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27654	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18364	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18404	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x283b8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x184cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18bd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18cf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18db4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x283d0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x191e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19394	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19678	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19804	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x276e0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e630	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x199a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a008	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a3d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27710	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b0c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b184	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bde4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c070	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c56c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c91c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c9dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d604	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d9cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e27c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e35c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ef7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f17c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f220	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x283e0	0	NOTYPE	<unknown>	DEFAULT	12
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x276e0	24	OBJECT	<unknown>	DEFAULT	4
C.108.5513	.symtab	0x22684	48	OBJECT	<unknown>	DEFAULT	4
C.141.5820	.symtab	0x22af8	24	OBJECT	<unknown>	DEFAULT	4
C.196.6420	.symtab	0x23154	12	OBJECT	<unknown>	DEFAULT	4
C.197.6421	.symtab	0x230e4	92	OBJECT	<unknown>	DEFAULT	4
C.199.6526	.symtab	0x23b1c	1144	OBJECT	<unknown>	DEFAULT	4
C.202.6563	.symtab	0x256e0	24	OBJECT	<unknown>	DEFAULT	4
C.205.6594	.symtab	0x25900	24	OBJECT	<unknown>	DEFAULT	4
C.216.6732	.symtab	0x25b58	1128	OBJECT	<unknown>	DEFAULT	4
C.257.7028	.symtab	0x260c4	96	OBJECT	<unknown>	DEFAULT	4
C.261.7076	.symtab	0x26258	36	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x100ec	664	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0xe4c0	468	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x161a8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x161c4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x28420	16384	OBJECT	<unknown>	DEFAULT	13
Randhex	.symtab	0xf0dc	472	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0xcd54	400	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0xf404	1636	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0xe694	356	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0xe7f8	356	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0xcee4	400	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0xc9bc	460	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0xd73c	3460	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xb32c	320	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xa8fc	364	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0xb5bc	356	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x9de0	1116	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0xee3c	336	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x14c4c	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x28010	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2818c	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x26428	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x283e0	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x277dc	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x28194	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x26728	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x28000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x28000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2818c	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x283e0	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x28194	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_b	.symtab	0x28190	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x283e4	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x28198	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x14d04	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x14b24	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1b52c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1650c	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x1998c	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x14ab8	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x16b80	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x16ba4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x16b5c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x18c88	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x18d58	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x16554	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14c4c	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x17a40	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x18170	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1ca1c	76	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x149bc	52	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x193b0	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x14c78	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x19594	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x19cd0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x19d04	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x199a8	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x168a8	56	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2e630	4	OBJECT	<unknown>	HIDDEN	13
__GI_execl	.symtab	0x1c938	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1ca94	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1836c	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x19e74	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x14ab8	108	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1b320	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1b000	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1b52c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1b0dc	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1b658	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1a028	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x148f8	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x15ff0	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1ced4	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1cef8	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1cac8	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x16028	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1b52c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x14a24	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x19418	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1942c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x194ac	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x16824	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x16840	104	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1c1b0	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1e8a4	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1ebd0	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x19374	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x148b4	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x193e4	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x168e0	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x14a84	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1939c	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2e634	4	OBJECT	<unknown>	HIDDEN	13
__GI_htonl	.symtab	0x16704	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x166f4	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x167fc	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1c0b8	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x167e0	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x16754	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1d754	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1d3f4	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1808c	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x14bf8	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x16654	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x14cac	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x14a50	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1eca0	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1bb90	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x16210	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1ed10	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1bf68	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1bdec	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x160e0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x191f4	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1cd50	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x194c0	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x194f4	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x16734	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x16724	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x14854	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x1975c	172	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1eb9c	52	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x16a88	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x17b80	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x17f24	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1bd3c	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x149f0	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x198a0	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1695c	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x19440	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1497c	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x16994	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x169cc	64	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x14bc4	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x16a0c	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x17e40	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1925c	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x16aa4	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1955c	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x18424	172	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x14d20	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x16a50	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x14d50	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x17fb4	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1ec48	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1f1bc	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1641c	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1bf8c	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x161f0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x161f0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x163f8	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1bcf8	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1ed20	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x16180	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1d268	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1632c	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1c078	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1bf18	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1becc	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x16230	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x16524	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1bc80	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x18190	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1861c	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x16678	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x148c8	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x14cd4	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1f188	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x19300	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x14d84	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x19340	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1492c	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x19d4c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x19dc4	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x19da0	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x14b90	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2800c	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x2800c	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x1f2e0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1fc3c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1fc3c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1fc20	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1fccc	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1f2e0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1fc54	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1fc9c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1fcb4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1fc84	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1fc6c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1f980	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1f6f0	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1f2d4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1f2dc	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1f63c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1f614	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x146fc	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x14828	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1f690	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1f5f0	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x145e8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x146e4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1f67c	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1ca88	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x1ca8c	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x1ca90	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2e628	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x283b8	24	OBJECT	<unknown>	DEFAULT	12
__bss_end__	.symtab	0x2ea50	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x283e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x283e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x18d04	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1e7c0	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x1fb9c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x28190	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x283e4	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x28198	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x2e638	4	OBJECT	<unknown>	HIDDEN	13
__data_start	.symtab	0x28088	0	NOTYPE	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x1d9d8	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1ee40	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x192f4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x192e8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x14840	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1f980	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x146fc	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1dad0	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x28008	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x28088	0	OBJECT	<unknown>	HIDDEN	12
__encode_dotted	.symtab	0x1f228	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1ed54	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1eef4	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2ea50	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2e620	4	OBJECT	<unknown>	DEFAULT	13
__eqdf2	.symtab	0x1fb9c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x14d04	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x1933c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x27b04	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x27af4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2e618	4	OBJECT	<unknown>	HIDDEN	13
__extendsfdf2	.symtab	0x1f63c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x14b24	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1b52c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2800c	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x28008	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x1fccc	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1f690	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1f614	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1f67c	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1f5f0	36	FUNC	<unknown>	HIDDEN	2
__frame_dummy_init_array_entry	.symtab	0x28004	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x1fb8c	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1e858	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1cd90	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x19374	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1650c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x1fb8c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x1998c	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x28008	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	8
__ledf2	.symtab	0x1fb94	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x14c78	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x168a8	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x14ab8	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x148f8	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1eca0	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x194f4	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x14854	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x149f0	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1695c	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1497c	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x16994	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x169cc	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1925c	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2e61c	4	OBJECT	<unknown>	DEFAULT	13
__libc_system	.symtab	0x19098	348	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1492c	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x14b90	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x277bc	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1fb94	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x17610	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x16bc8	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x282dc	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x2e6bc	888	OBJECT	<unknown>	DEFAULT	13
__malloc_trim	.symtab	0x17560	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1f6f0	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x2ea44	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x2ea48	4	OBJECT	<unknown>	HIDDEN	13
__nedf2	.symtab	0x1fb9c	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x1ef54	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1e364	1116	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2e624	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x283d4	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x283d8	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x18c4c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x18c44	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x18c44	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x18c44	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x18c44	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1ef84	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x2ea3c	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x283df	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x2e640	24	OBJECT	<unknown>	DEFAULT	13
__resolv_timeout	.symtab	0x283de	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x2e62c	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x2ea40	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x2ea4c	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x16b80	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x16ba4	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x16b5c	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x281dc	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1d048	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1a048	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1d0a0	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1a404	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x14ea0	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x26a28	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x1d164	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1d22c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1d194	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1a544	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x14fa8	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x281e0	4	OBJECT	<unknown>	DEFAULT	12
__subdf3	.symtab	0x1f2dc	788	FUNC	<unknown>	HIDDEN	2
__syscall_error	.symtab	0x1ca68	32	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x19528	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x18c88	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x18d58	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x18dc4	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x283d0	4	OBJECT	<unknown>	HIDDEN	12
__udivsi3	.symtab	0x145e8	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x19300	64	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x16554	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1cbec	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1cb20	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x1cc98	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2e428	10	OBJECT	<unknown>	DEFAULT	13
_bss_end__	.symtab	0x2ea50	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x14fd8	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2e664	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_handler	.symtab	0x2e68c	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_spec	.symtab	0x282d8	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x1c9e4	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2ea34	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x2ea38	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x283e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2ea50	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2e630	4	OBJECT	<unknown>	DEFAULT	13
_exit	.symtab	0x14c4c	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1fd20	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2c428	8192	OBJECT	<unknown>	DEFAULT	13
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1502c	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1a80c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2e634	4	OBJECT	<unknown>	DEFAULT	13
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1a614	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1b700	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x15798	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x15a80	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x15838	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1587c	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x15a2c	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x18c5c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x18c54	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2e6b4	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1a0fc	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x14e38	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x281e4	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x2819c	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x1b198	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2c424	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x281b4	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x2c420	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x281e8	240	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0x14ed4	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x281cc	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x181ac	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1a684	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x26af8	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1a6b0	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x150b0	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x17a40	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x14948	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0xc86c	336	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0xc1ac	1728	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x18170	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x18170	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0xbc18	1428	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x161e0	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2e614	4	OBJECT	<unknown>	DEFAULT	13
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1ca1c	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x16aa4	184	FUNC	<unknown>	DEFAULT	2
buf.2975	.symtab	0x2e438	16	OBJECT	<unknown>	DEFAULT	13
buf.5444	.symtab	0x2e448	440	OBJECT	<unknown>	DEFAULT	13
bzero	.symtab	0x16220	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x28184	4	OBJECT	<unknown>	DEFAULT	12
calloc	.symtab	0x1c450	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x149bc	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x193b0	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x14c78	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x19594	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x28090	4	OBJECT	<unknown>	DEFAULT	12
completed.4959	.symtab	0x283e8	1	OBJECT	<unknown>	DEFAULT	13
connect	.symtab	0x168a8	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x969c	628	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9ab8	340	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x28180	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x2808c	0	NOTYPE	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2e620	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x2e630	4	OBJECT	<unknown>	DEFAULT	13
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x1c938	172	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x1ca94	52	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1836c	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x27710	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x19e74	436	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x14ab8	108	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x1968c	208	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x853c	212	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x19808	152	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1b320	524	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1b000	220	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1b52c	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1b0dc	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1b658	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x276f8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1a028	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x148f8	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x15ff0	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x177c4	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1ced4	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1ced4	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1cef8	336	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1cac8	88	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0xa23c	1728	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x16028	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x10910	36	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x92a4	104	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8610	700	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x10934	212	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x84d8	100	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1b000	220	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1b52c	300	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x14a24	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x19418	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1942c	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x194ac	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x16824	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x16840	104	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1c1b0	672	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1e8a4	760	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x1ebd0	120	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x19374	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x148b4	20	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x193e4	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x168e0	56	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x16918	68	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x14a84	52	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1939c	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x2840c	4	OBJECT	<unknown>	DEFAULT	13
h_errno	.symtab	0x2e634	4	OBJECT	<unknown>	DEFAULT	13
hoste.5443	.symtab	0x2e600	20	OBJECT	<unknown>	DEFAULT	13
htonl	.symtab	0x16704	32	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T18:16:20.714166+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	41652	154.213.186.115	4444	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 18:16:20.592855930 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:16:20.712852955 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:16:20.712918043 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:16:20.714165926 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:16:20.834556103 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:16:55.257572889 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:16:55.257745028 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:16:55.490854979 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:16:55.491091967 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:17:55.257432938 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:17:55.257725954 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:17:55.449282885 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:17:55.449523926 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:18:55.261773109 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:18:55.261899948 CET	41652	4444	192.168.2.13	154.213.186.115
Dec 23, 2024 18:18:55.452703953 CET	4444	41652	154.213.186.115	192.168.2.13
Dec 23, 2024 18:18:55.452790022 CET	41652	4444	192.168.2.13	154.213.186.115

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 18:19:07.181818008 CET	45915	53	192.168.2.13	1.1.1.1
Dec 23, 2024 18:19:07.181879044 CET	56127	53	192.168.2.13	1.1.1.1
Dec 23, 2024 18:19:07.319613934 CET	53	56127	1.1.1.1	192.168.2.13
Dec 23, 2024 18:19:07.320404053 CET	53	45915	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 18:19:07.181818008 CET	192.168.2.13	1.1.1.1	0x5035	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 18:19:07.181879044 CET	192.168.2.13	1.1.1.1	0x2002	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 18:19:07.320404053 CET	1.1.1.1	192.168.2.13	0x5035	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 23, 2024 18:19:07.320404053 CET	1.1.1.1	192.168.2.13	0x5035	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: jackmyarmv6.elf PID: 5466, Parent PID: 5385

General

Start time (UTC):	17:16:19
Start date (UTC):	23/12/2024
Path:	/tmp/jackmyarmv6.elf
Arguments:	/tmp/jackmyarmv6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: jackmyarmv6.elf PID: 5468, Parent PID: 5466

General

Start time (UTC):	17:16:19
Start date (UTC):	23/12/2024
Path:	/tmp/jackmyarmv6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: jackmyarmv6.elf PID: 5470, Parent PID: 5468

General

Start time (UTC):	17:16:19
Start date (UTC):	23/12/2024
Path:	/tmp/jackmyarmv6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report jackmyarmv6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: jackmyarmv6.elf PID: 5466, Parent PID: 5385

General

Chronological Activities

Analysis Process: jackmyarmv6.elf PID: 5468, Parent PID: 5466

General

Chronological Activities

Analysis Process: jackmyarmv6.elf PID: 5470, Parent PID: 5468

General

Chronological Activities

Linux Analysis Report
jackmyarmv6.elf