Edit tour

Linux Analysis Report
arm6l.elf

Overview

General Information

Sample name:	arm6l.elf
Analysis ID:	1581986
MD5:	d1c4c00fba7ba4e0606b10fea3c4132d
SHA1:	f83bedecd5953577853d73059036eee16c03f4e7
SHA256:	95de15b8fc652d35e7be3169c2bae76bb347d4f35fd547b31e5f3e4697a65a90
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581986
Start date and time:	2024-12-29 14:36:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm6l.elf
Detection:	MAL
Classification:	mal96.troj.linELF@0/1@0/0

Runtime Messages

Command:	/tmp/arm6l.elf
PID:	6267
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	[[96mBOT JOINED[97m] Arch: [96mARM4T [97m\|\| Type: LITTLE_ENDIAN]
Standard Error:

Process Tree

system is lnxubuntu20

arm6l.elf (PID: 6267, Parent: 6192, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6l.elf

arm6l.elf New Fork (PID: 6269, Parent: 6267)

arm6l.elf New Fork (PID: 6271, Parent: 6269)

arm6l.elf New Fork (PID: 6273, Parent: 6271)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm6l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
arm6l.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
arm6l.elf	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x142e:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
arm6l.elf	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x133e:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
arm6l.elf	Linux_Trojan_Gafgyt_6ae4b580	unknown	unknown	0x2e3d:$a: 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C
arm6l.elf	Linux_Trojan_Gafgyt_d608cf3b	unknown	unknown	0x10efd:$a: FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x142e:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x133e:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6ae4b580	unknown	unknown	0x2e3d:$a: 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C
6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d608cf3b	unknown	unknown	0x10efd:$a: FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C
6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x142e:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x133e:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6ae4b580	unknown	unknown	0x2e3d:$a: 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C
6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d608cf3b	unknown	unknown	0x10efd:$a: FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C
6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x142e:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x133e:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6ae4b580	unknown	unknown	0x2e3d:$a: 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C
6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d608cf3b	unknown	unknown	0x10efd:$a: FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C
6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x142e:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x133e:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_6ae4b580	unknown	unknown	0x2e3d:$a: 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C
6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp	Linux_Trojan_Gafgyt_d608cf3b	unknown	unknown	0x10efd:$a: FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C
Click to see the 15 entries

Suricata Signatures

ETPRO MALWARE ELF/Yakuza Botnet CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:37:03.751908+0100	2837124	1	Malware Command and Control Activity Detected	192.168.2.23	41932	98.159.236.221	23	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm6l.elf

Avira: detected

Found malware configuration

Source: arm6l.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "98.159.236.221:23"}

Multi AV Scanner detection for submitted file

Source: arm6l.elf	Virustotal: Detection: 66%			Perma Link
Source: arm6l.elf	ReversingLabs: Detection: 68%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2837124 - Severity 1 - ETPRO MALWARE ELF/Yakuza Botnet CnC Checkin : 192.168.2.23:41932 -> 98.159.236.221:23

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 98.159.236.221
Source: unknown	TCP traffic detected without corresponding DNS query: 98.159.236.221
Source: unknown	TCP traffic detected without corresponding DNS query: 98.159.236.221
Source: unknown	TCP traffic detected without corresponding DNS query: 98.159.236.221
Source: unknown	TCP traffic detected without corresponding DNS query: 98.159.236.221
Source: unknown	TCP traffic detected without corresponding DNS query: 98.159.236.221
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: arm6l.elf	String found in binary or memory: http://98.159.236.221/bins.sh;
Source: arm6l.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: arm6l.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: arm6l.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: arm6l.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: arm6l.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 Author: unknown
Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d608cf3b Author: unknown
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 Author: unknown
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b Author: unknown
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 Author: unknown
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b Author: unknown
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 Author: unknown
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b Author: unknown
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 Author: unknown
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b Author: unknown

Source: arm6l.elf

ELF static info symbol of initial sample: TelnetScanner

Source: Initial sample

String containing 'busybox' found: busybox

Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c, id = 6ae4b580-f7cf-4318-b584-7ea15f10f5ea, last_modified = 2021-09-16
Source: arm6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d608cf3b severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76, id = d608cf3b-c255-4a8d-9bf1-66f92eacd751, last_modified = 2021-09-16
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c, id = 6ae4b580-f7cf-4318-b584-7ea15f10f5ea, last_modified = 2021-09-16
Source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76, id = d608cf3b-c255-4a8d-9bf1-66f92eacd751, last_modified = 2021-09-16
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c, id = 6ae4b580-f7cf-4318-b584-7ea15f10f5ea, last_modified = 2021-09-16
Source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76, id = d608cf3b-c255-4a8d-9bf1-66f92eacd751, last_modified = 2021-09-16
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c, id = 6ae4b580-f7cf-4318-b584-7ea15f10f5ea, last_modified = 2021-09-16
Source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76, id = d608cf3b-c255-4a8d-9bf1-66f92eacd751, last_modified = 2021-09-16
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6ae4b580 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c, id = 6ae4b580-f7cf-4318-b584-7ea15f10f5ea, last_modified = 2021-09-16
Source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d608cf3b severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76, id = d608cf3b-c255-4a8d-9bf1-66f92eacd751, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.troj.linELF@0/1@0/0

Source: arm6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: arm6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: arm6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: arm6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: arm6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: arm6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: arm6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm

Source: /tmp/arm6l.elf (PID: 6267)

Queries kernel information via 'uname':

Jump to behavior

Source: arm6l.elf, 6267.1.00005581d98cb000.00005581d99f9000.rw-.sdmp, arm6l.elf, 6269.1.00005581d98cb000.00005581d99f9000.rw-.sdmp, arm6l.elf, 6271.1.00005581d98cb000.00005581d99f9000.rw-.sdmp, arm6l.elf, 6273.1.00005581d98cb000.00005581d99f9000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm6l.elf, 6267.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp, arm6l.elf, 6269.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp, arm6l.elf, 6271.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp, arm6l.elf, 6273.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp	Binary or memory string: 2/xSx86_64/usr/bin/qemu-arm/tmp/arm6l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6l.elf
Source: arm6l.elf, 6267.1.00005581d98cb000.00005581d99f9000.rw-.sdmp, arm6l.elf, 6269.1.00005581d98cb000.00005581d99f9000.rw-.sdmp, arm6l.elf, 6271.1.00005581d98cb000.00005581d99f9000.rw-.sdmp, arm6l.elf, 6273.1.00005581d98cb000.00005581d99f9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm6l.elf, 6267.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp, arm6l.elf, 6269.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp, arm6l.elf, 6271.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp, arm6l.elf, 6273.1.00007ffe5a27f000.00007ffe5a2a0000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: arm6l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: arm6l.elf, type: SAMPLE
Source: Yara match	File source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: arm6l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: arm6l.elf, type: SAMPLE
Source: Yara match	File source: 6267.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6271.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.00007fddd0017000.00007fddd002d000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "98.159.236.221:23"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm6l.elf	66%	Virustotal		Browse
arm6l.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
arm6l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
98.159.236.221:23	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	arm6l.elf	false	high
http://www.billybobbot.com/crawler/)	arm6l.elf	false	high
http://fast.no/support/crawler.asp)	arm6l.elf	false	high
http://feedback.redkolibri.com/	arm6l.elf	false	high
http://www.baidu.com/search/spider.htm)	arm6l.elf	false	high
http://98.159.236.221/bins.sh;	arm6l.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
98.159.236.221	unknown	United States	12025	IMDC-AS12025US	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
98.159.236.221	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	mips.elf	Get hash	malicious	Mirai	Browse
	mipsel.elf	Get hash	malicious	Mirai	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i586.elf	Get hash	malicious	Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	armv4l.elf	Get hash	malicious	Mirai	Browse
	co.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	mips.elf	Get hash	malicious	Mirai	Browse
	mipsel.elf	Get hash	malicious	Mirai	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i586.elf	Get hash	malicious	Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	armv4l.elf	Get hash	malicious	Mirai	Browse
	co.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	armv7l.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	i586.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	armv7l.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	i586.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
IMDC-AS12025US	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.159.236.221
	m68k.elf	Get hash	malicious	Mirai	Browse	74.206.119.144
INIT7CH	mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	mipsel.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	i586.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	powerpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	armv4l.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	co.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	main_m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf

Download File

Process:	/tmp/arm6l.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.3918926446809334
Encrypted:	false
SSDEEP:	3:KkZRAkd:KaAu
MD5:	C7EA09D26E26605227076E0514A33038
SHA1:	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E
SHA-256:	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
SHA-512:	17D0088725EB9991E9EB82E8A3DE0878E45E6F394BBC2AD260AA59C786FF0AD565E145E21256425D1C0ABE15F3ECB402EBB0A6A5E1C2D5BA7A4D95EC93A2861F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	nameserver 8.8.8.8.nameserver 8.8.4.4.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.009081397700118
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm6l.elf
File size:	130'434 bytes
MD5:	d1c4c00fba7ba4e0606b10fea3c4132d
SHA1:	f83bedecd5953577853d73059036eee16c03f4e7
SHA256:	95de15b8fc652d35e7be3169c2bae76bb347d4f35fd547b31e5f3e4697a65a90
SHA512:	b07382d2352df0e48b628ae88381c9e6b794462e8dbbaf2ddcda3a03a4af89184da155c05c2cbbf7c9c4d778a357618950b88f7c709ae8bc703ce46a342304c4
SSDEEP:	3072:hmfdWmd6pUeQKbcISIadimWA2PKj2Gx45hA6qcW8umy/QsYJ0Yj/:Y3IadimiGK5hA6qZmy/QsYJ0Yj/
TLSH:	4ED32905D9508B23C6D22B7AF7AF528E73236BA897CB331156286EF42FC179D1E39150
File Content Preview:	.ELF..............(.........4...........4. ...(........pl[..l...l...................................\|[..\|[...............`...`...`..$....k..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	98244
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x12a14	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1aae4	0x12ae4	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1aaf8	0x12af8	0x305c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1db54	0x15b54	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1db6c	0x15b6c	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x26000	0x16000	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x26004	0x16004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x26008	0x16008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2600c	0x1600c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x26010	0x16010	0x78	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x26088	0x16088	0x49c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x26528	0x16524	0x6690	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x16524	0xce2	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x17208	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x172e8	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x17798	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x17824	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x17e7c	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x17ed4	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x17ee4	0xdd	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x18384	0x4f60	0x10	0x0		23	683	4
.strtab	STRTAB	0x0	0x1d2e4	0x2a9e	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x15b6c	0x1db6c	0x1db6c	0x10	0x10	2.2335	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x15b7c	0x15b7c	6.1612	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x16000	0x26000	0x26000	0x524	0x6bb8	4.2709	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1aae4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1aaf8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1db54	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1db6c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x26000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x26004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x26008	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2600c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x26010	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x26088	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x26528	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1aae4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1aaf0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x842c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9fdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaaa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb09c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xede4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf03c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf06c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf26c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf40c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf4e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf59c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1058c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1131c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1141c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1165c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1169c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1296c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1413c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1424c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1433c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1446c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1453c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1476c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1613c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16dac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1865c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26008	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26004	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x2608c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26090	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x853c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8574	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x95e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x98b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9cd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9fd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc4dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd4e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe154	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x262c8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x262d0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0xf4ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf9f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfaf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2630c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x262d8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1caac	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x102d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10588	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x105d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26414	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x10f50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1128c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x114bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26418	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x12674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x127e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26430	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x12898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12950	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26448	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x264e0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x12bac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12df8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6d8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12ff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x264f4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1315c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13928	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x139dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2650c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x13ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26518	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x14458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da54	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14758	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c794	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x14780	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14de8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x151ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15dfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da88	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15ee4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16324	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1646c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ce4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1738c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1773c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19bfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19dfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ea0	0	NOTYPE	<unknown>	DEFAULT	2
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x1da54	24	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0x10d08	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10d24	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x26568	16384	OBJECT	<unknown>	DEFAULT	13
SendHTTP	.symtab	0xd2a4	416	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xc518	320	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0xcab4	1732	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0xc658	1116	FUNC	<unknown>	DEFAULT	2
SendWGET	.symtab	0xd444	172	FUNC	<unknown>	DEFAULT	2
TelnetIPRanges	.symtab	0xa4e8	1364	FUNC	<unknown>	DEFAULT	2
TelnetScanner	.symtab	0xae18	5888	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0xe324	140	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0xf3ac	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x26010	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x262c8	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1c49c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x26518	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1d752	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x262d0	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1c79c	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x26000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x26000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x262c8	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x26518	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x262d0	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_b	.symtab	0x262cc	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x2651c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x262d4	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0xf498	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xf30c	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x16348	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x11150	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x1476c	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xf2a0	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x11810	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x11834	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x117ec	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x13974	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x13a44	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x11198	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xf3ac	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x126d0	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x12e00	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17790	76	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xf1a4	52	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x1413c	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xf40c	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x14374	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x14ab0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x14ae4	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x14788	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x11570	56	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x14064	52	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2c794	4	OBJECT	<unknown>	HIDDEN	13
__GI_execl	.symtab	0x13884	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x14098	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x12ffc	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x14c54	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xf2a0	108	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x14e08	60	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1613c	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x15e1c	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x16348	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x15ef8	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x16474	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x14e44	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xf0ac	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10b50	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17c14	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17c38	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x17808	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10b88	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x16348	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0xf20c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x141a4	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x141b8	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x14238	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x114ec	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x11508	104	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x16fd0	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x19528	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x19854	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x14100	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xeff4	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14170	52	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0xf26c	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x14128	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2c798	4	OBJECT	<unknown>	HIDDEN	13
__GI_htonl	.symtab	0x113cc	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x113bc	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x114c4	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x16ed8	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x114a8	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1141c	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x183d8	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x18078	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x12d1c	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x142b4	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1131c	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0xf440	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xf238	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x19924	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x169b0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10d70	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x19990	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x16d88	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16c0c	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10c40	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x13ee0	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x17a90	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1424c	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14280	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x113fc	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x113ec	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xef94	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x1453c	172	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x140cc	52	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x19820	52	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x11718	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x12810	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x12bb4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x16b5c	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xf1d8	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x14680	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x115ec	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x141cc	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xf164	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x11624	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1165c	64	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0xef20	116	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0xf3d8	52	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0xf0fc	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1169c	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x12ad0	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x13f48	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x11734	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1433c	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x130b4	172	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x116e0	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xf4b4	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x12c44	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x198cc	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x19e3c	108	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x11298	132	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x10f58	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x11060	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x16dac	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10d50	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10d50	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10f80	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x16b18	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x199a0	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10ce0	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x10fa4	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x10e8c	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x16e98	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x16d38	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x16cec	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x10d90	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x11168	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16aa0	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x12e20	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x132ac	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x11340	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xf03c	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xf468	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x19e08	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x13ff0	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xf4e8	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x14030	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xf0e0	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x14b2c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x14ba4	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x14b80	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xf378	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2600c	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x2600c	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x1a0a4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1aa00	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1aa00	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1a9e4	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1aa90	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1a0a4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1aa18	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1aa60	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1aa78	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1aa48	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1aa30	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1a744	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1a4b4	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1a098	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1a0a0	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1a400	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1a3d8	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x19f54	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1a080	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1a454	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1a3b4	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xede4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xeee0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1a440	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x177fc	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x17800	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x17804	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2c78c	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x264f4	24	OBJECT	<unknown>	DEFAULT	12
__bss_end__	.symtab	0x2cbb8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x26524	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x26524	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x139f0	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x19444	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x1a960	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x262cc	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x2651c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x262d4	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x2c79c	4	OBJECT	<unknown>	HIDDEN	13
__data_start	.symtab	0x26088	0	NOTYPE	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x1865c	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x19ac0	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x13fe0	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13fd4	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xeef8	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1a744	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x19f54	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x18754	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x26008	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x26088	0	OBJECT	<unknown>	HIDDEN	12
__encode_dotted	.symtab	0x19ea8	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x199d4	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x19b74	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2cbb8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2c784	4	OBJECT	<unknown>	DEFAULT	13
__eqdf2	.symtab	0x1a960	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xf498	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x1402c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x1db7c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1db6c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2c77c	4	OBJECT	<unknown>	HIDDEN	13
__extendsfdf2	.symtab	0x1a400	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xf30c	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x16348	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2600c	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x26008	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x1aa90	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1a454	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1a3d8	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1a440	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1a3b4	36	FUNC	<unknown>	HIDDEN	2
__frame_dummy_init_array_entry	.symtab	0x26004	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x1a950	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x194dc	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x17ad0	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x14100	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x11150	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x1a950	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x1476c	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x26008	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x26004	0	NOTYPE	<unknown>	HIDDEN	8
__ledf2	.symtab	0x1a958	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xf40c	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x11570	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xf2a0	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xf0ac	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x19924	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x14280	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xef94	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xf1d8	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x115ec	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xf164	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x11624	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1165c	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x13f48	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2c780	4	OBJECT	<unknown>	DEFAULT	13
__libc_system	.symtab	0x13d84	348	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0xf0e0	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xf378	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x1db34	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1a958	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x122a0	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x11858	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x26418	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x2c824	888	OBJECT	<unknown>	DEFAULT	13
__malloc_trim	.symtab	0x121f0	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1a4b4	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x2cbac	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x2cbb0	4	OBJECT	<unknown>	HIDDEN	13
__nedf2	.symtab	0x1a960	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x19bd4	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x18fe8	1116	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2c788	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x26004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x26004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x26510	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x26514	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x13938	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x13930	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x13930	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x13930	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x13930	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x19c04	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x2cba4	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x26523	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x2c7a4	24	OBJECT	<unknown>	DEFAULT	13
__resolv_timeout	.symtab	0x26522	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x2c790	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x2cba8	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x2cbb4	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x11810	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x11834	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x117ec	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x26318	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x17d88	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x14e64	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17de0	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x15220	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0xfa00	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x1caac	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x17ea4	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17f6c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x17ed4	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15360	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xfb08	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2631c	4	OBJECT	<unknown>	DEFAULT	12
__subdf3	.symtab	0x1a0a0	788	FUNC	<unknown>	HIDDEN	2
__syscall_error	.symtab	0x177dc	32	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x14308	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x13974	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x13a44	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x13ab0	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2650c	4	OBJECT	<unknown>	HIDDEN	12
__udivsi3	.symtab	0xede4	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x13ff0	64	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x11198	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1792c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x17860	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x179d8	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2c58c	10	OBJECT	<unknown>	DEFAULT	13
_bss_end__	.symtab	0x2cbb8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0xfb38	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2c7cc	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_handler	.symtab	0x2c7f4	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_spec	.symtab	0x26414	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x17758	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2cb9c	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x2cba0	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x26524	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2cbb8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2c794	4	OBJECT	<unknown>	DEFAULT	13
_exit	.symtab	0xf3ac	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1aae4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2a58c	8192	OBJECT	<unknown>	DEFAULT	13
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xfb8c	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x15628	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2c798	4	OBJECT	<unknown>	DEFAULT	13
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15430	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16520	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x102f8	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x105e0	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x10398	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x103dc	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1058c	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x13948	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x13940	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2c81c	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x14f18	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xf998	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x26320	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x262d8	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x15fb4	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2a588	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x262f0	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x2a584	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x26324	240	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0xfa34	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x26308	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x12e3c	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x154a0	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1cb7c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x154cc	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xfc10	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x126d0	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xf130	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x87f4	116	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x260f0	64	OBJECT	<unknown>	DEFAULT	12
advances2	.symtab	0x261a4	44	OBJECT	<unknown>	DEFAULT	12
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x12e00	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x12e00	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x10d40	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2c778	4	OBJECT	<unknown>	DEFAULT	13
brk	.symtab	0x17790	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x11734	184	FUNC	<unknown>	DEFAULT	2
buf.2975	.symtab	0x2c59c	16	OBJECT	<unknown>	DEFAULT	13
buf.5444	.symtab	0x2c5ac	440	OBJECT	<unknown>	DEFAULT	13
bzero	.symtab	0x10d80	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x262c0	4	OBJECT	<unknown>	DEFAULT	12
calloc	.symtab	0x17270	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0xf1a4	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x1413c	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xf40c	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x14374	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x26090	4	OBJECT	<unknown>	DEFAULT	12
completed.4959	.symtab	0x26528	1	OBJECT	<unknown>	DEFAULT	13
connect	.symtab	0x11570	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x98bc	628	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x8540	56	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x8578	100	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x842c	220	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x8508	56	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xaaa0	340	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x261d0	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x2608c	0	NOTYPE	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x14064	52	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2c784	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x2c794	4	OBJECT	<unknown>	DEFAULT	13
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x13884	172	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x14098	52	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x12ffc	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1da88	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x26130	44	OBJECT	<unknown>	DEFAULT	12
fclose	.symtab	0x14c54	436	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xf2a0	108	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x1446c	208	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x14e08	60	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fdopendir	.symtab	0x145e8	152	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1613c	524	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x15e1c	220	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x16348	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x15ef8	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x16474	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1da70	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x14e44	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0xf0ac	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x10b50	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x12454	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x17c14	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x17c14	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17c38	336	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x17808	88	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10b88	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x81ec	36	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0xe3b0	280	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x94c4	104	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0xaa3c	100	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x9fdc	1292	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x87b8	60	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x15e1c	220	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x16348	300	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0xf20c	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x141a4	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x141b8	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x14238	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x114ec	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x11508	104	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x16fd0	672	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x19528	760	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x19854	120	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x14100	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xeff4	20	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0xef0c	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x14170	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x115a8	68	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0xf26c	52	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x14128	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x2c798	4	OBJECT	<unknown>	DEFAULT	13
hoste.5443	.symtab	0x2c764	20	OBJECT	<unknown>	DEFAULT	13
htonl	.symtab	0x113cc	32	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x113bc	16	FUNC	<unknown>	DEFAULT	2
i.4776	.symtab	0x262c4	4	OBJECT	<unknown>	DEFAULT	12
index	.symtab	0x11060	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x114c4	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x16ed8	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x114a8	28	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1141c	140	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x183d8	644	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x18294	324	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x18078	540	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x17fa8	208	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xe198	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8210	216	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x1296c	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x12d1c	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x142b4	84	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5547	.symtab	0x2655e	4	OBJECT	<unknown>	DEFAULT	13
ipState.5649	.symtab	0x26562	4	OBJECT	<unknown>	DEFAULT	13
isatty	.symtab	0x1131c	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xf440	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xf238	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5501	.symtab	0x26520	2	OBJECT	<unknown>	DEFAULT	12

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T14:37:03.751908+0100	2837124	ETPRO MALWARE ELF/Yakuza Botnet CnC Checkin	1	192.168.2.23	41932	98.159.236.221	23	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 14:37:03.412288904 CET	41932	23	192.168.2.23	98.159.236.221
Dec 29, 2024 14:37:03.533587933 CET	23	41932	98.159.236.221	192.168.2.23
Dec 29, 2024 14:37:03.533668041 CET	41932	23	192.168.2.23	98.159.236.221
Dec 29, 2024 14:37:03.751908064 CET	41932	23	192.168.2.23	98.159.236.221
Dec 29, 2024 14:37:03.872922897 CET	23	41932	98.159.236.221	192.168.2.23
Dec 29, 2024 14:37:04.728840113 CET	23	41932	98.159.236.221	192.168.2.23
Dec 29, 2024 14:37:04.728861094 CET	23	41932	98.159.236.221	192.168.2.23
Dec 29, 2024 14:37:04.730741978 CET	41932	23	192.168.2.23	98.159.236.221
Dec 29, 2024 14:37:04.770066977 CET	41932	23	192.168.2.23	98.159.236.221
Dec 29, 2024 14:37:04.871669054 CET	41932	23	192.168.2.23	98.159.236.221
Dec 29, 2024 14:37:04.992537022 CET	23	41932	98.159.236.221	192.168.2.23
Dec 29, 2024 14:37:05.374041080 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 14:37:05.886030912 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 14:37:11.005285978 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 14:37:25.595258951 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 14:37:35.833739996 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 14:37:37.881443024 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 14:38:06.549453974 CET	43928	443	192.168.2.23	91.189.91.42

System Behavior

Analysis Process: arm6l.elf PID: 6267, Parent PID: 6192

General

Start time (UTC):	13:37:02
Start date (UTC):	29/12/2024
Path:	/tmp/arm6l.elf
Arguments:	/tmp/arm6l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm6l.elf PID: 6269, Parent PID: 6267

General

Start time (UTC):	13:37:02
Start date (UTC):	29/12/2024
Path:	/tmp/arm6l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm6l.elf PID: 6271, Parent PID: 6269

General

Start time (UTC):	13:37:02
Start date (UTC):	29/12/2024
Path:	/tmp/arm6l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm6l.elf PID: 6273, Parent PID: 6271

General

Start time (UTC):	13:37:02
Start date (UTC):	29/12/2024
Path:	/tmp/arm6l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm6l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: arm6l.elf PID: 6267, Parent PID: 6192

General

Chronological Activities

Analysis Process: arm6l.elf PID: 6269, Parent PID: 6267

General

Chronological Activities

Analysis Process: arm6l.elf PID: 6271, Parent PID: 6269

General

Chronological Activities

Analysis Process: arm6l.elf PID: 6273, Parent PID: 6271

General

Chronological Activities

Linux Analysis Report
arm6l.elf