Edit tour

Linux Analysis Report
u.elf

Overview

General Information

Sample name:	u.elf
Analysis ID:	1584350
MD5:	616ec606badd89e9ad5f37d1cc550bcd
SHA1:	3b24f4c1d4998aaeacaf11dc902c61094e842e38
SHA256:	429d59e9d2fc07b7ad088c63999d268899655e648e2dcc8fea6846829a3a6438
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584350
Start date and time:	2025-01-05 08:57:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	u.elf
Detection:	MAL
Classification:	mal88.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/u.elf
PID:	5544
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

u.elf (PID: 5544, Parent: 5463, MD5: 616ec606badd89e9ad5f37d1cc550bcd) Arguments: /tmp/u.elf

u.elf New Fork (PID: 5546, Parent: 5544)

u.elf New Fork (PID: 5547, Parent: 5544)

u.elf New Fork (PID: 5548, Parent: 5547)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
u.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
u.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
u.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
u.elf	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
u.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89

Memory Dumps

Source	Rule	Description	Author	Strings
5544.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5544.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5544.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5544.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5547.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5547.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5547.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5547.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5546.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5546.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5546.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5546.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
Click to see the 7 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T08:58:11.469602+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56686	195.133.52.175	65489	TCP
2025-01-05T08:58:27.179169+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56688	195.133.52.175	65489	TCP
2025-01-05T08:58:42.888291+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56690	195.133.52.175	65489	TCP
2025-01-05T08:58:58.608002+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56692	195.133.52.175	65489	TCP
2025-01-05T08:59:14.338606+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56694	195.133.52.175	65489	TCP
2025-01-05T08:59:30.052314+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56696	195.133.52.175	65489	TCP
2025-01-05T08:59:45.774173+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56698	195.133.52.175	65489	TCP
2025-01-05T09:00:01.490506+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56700	195.133.52.175	65489	TCP
2025-01-05T09:00:17.205592+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56702	195.133.52.175	65489	TCP
2025-01-05T09:00:32.923634+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56704	195.133.52.175	65489	TCP
2025-01-05T09:00:48.653559+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56706	195.133.52.175	65489	TCP
2025-01-05T09:01:04.414608+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56708	195.133.52.175	65489	TCP
2025-01-05T09:01:20.132523+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56710	195.133.52.175	65489	TCP
2025-01-05T09:01:35.840981+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.15	56712	195.133.52.175	65489	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: u.elf	Virustotal: Detection: 57%			Perma Link
Source: u.elf	ReversingLabs: Detection: 63%

Machine Learning detection for sample

Source: u.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/u.elf (PID: 5544)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56700 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56690 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56688 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56692 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56706 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56694 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56686 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56696 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56702 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56698 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56712 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56710 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56704 -> 195.133.52.175:65489
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.15:56708 -> 195.133.52.175:65489

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 195.133.52.175 ports 65489,4,5,6,8,9

Source: global traffic

TCP traffic: 192.168.2.15:56686 -> 195.133.52.175:65489

Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: u.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5544.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5547.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5546.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.spre.troj.linELF@0/0@2/0

Source: u.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: u.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: u.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: u.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: u.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: u.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: u.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
u.elf	58%	Virustotal		Browse
u.elf	63%	ReversingLabs	Linux.Backdoor.Gafgyt
u.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.133.52.175	unknown	Russian Federation		21453	FLEX-ASRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
195.133.52.175	t.elf	Get hash	malicious	Gafgyt	Browse
	l.elf	Get hash	malicious	Gafgyt	Browse
	y.elf	Get hash	malicious	Gafgyt	Browse
	c.elf	Get hash	malicious	Gafgyt	Browse
	e.elf	Get hash	malicious	Gafgyt	Browse
	x.elf	Get hash	malicious	Gafgyt	Browse
	a.elf	Get hash	malicious	Gafgyt	Browse
	i.elf	Get hash	malicious	Gafgyt	Browse
	176.119.150.11-i-2025-01-04T15_20_35.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	t.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	l.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	y.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	e.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	x.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	a.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	176.119.150.11-i-2025-01-04T15_20_35.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FLEX-ASRU	t.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	l.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	y.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	c.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	e.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	x.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	a.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	195.133.78.18
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	195.133.78.18
	i.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.397504863738397
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	u.elf
File size:	97'798 bytes
MD5:	616ec606badd89e9ad5f37d1cc550bcd
SHA1:	3b24f4c1d4998aaeacaf11dc902c61094e842e38
SHA256:	429d59e9d2fc07b7ad088c63999d268899655e648e2dcc8fea6846829a3a6438
SHA512:	32b234e5c49ba2143f64e8096e3596c5b45761e3a9e58fff35ae72e4f8b5dcc99a2f074d51cb7aefe1ef1ca930a3fe29078ccd38846244b16c6c2f33fb1a599f
SSDEEP:	1536:Lvj2YK9xURspSo9MCFP81biDjnFS4UEreqSiTMzHWgyZN3ErCqmFOUk9tvEg51:Lvj21vURsGCFPCCjFS4UEii+WzZNUCqV
TLSH:	DEA32951A290D1B3C143177202E7DF260533FEB7275E9E1AD3683EF49B3A08471A5B6A
File Content Preview:	.ELF....................t...4.... ......4. ...(.........................................................Tj..........Q.td............................U..S.......{....x........[]...$.............U......=.....t..D...................(......(.......u........t..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048174
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	73728
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0xdf34	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8055fe4	0xdfe4	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8056000	0xe000	0x2ca4	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8059000	0x11000	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x8059004	0x11004	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x805900c	0x1100c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8059014	0x11014	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8059018	0x11018	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8059024	0x11024	0x2b0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x80592e0	0x112d4	0x6774	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x112d4	0xcba	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x11f8e	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x12280	0x3440	0x10	0x0		15	296	4
.strtab	STRTAB	0x0	0x156c0	0x2746	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x10ca4	0x10ca4	6.5488	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11000	0x8059000	0x8059000	0x2d4	0x6a54	3.7446	0x6	RW	0x1000	.eh_frame .ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8055fe4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8056000	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8059000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8059004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805900c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8059014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8059018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8059024	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x80592e0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.11.3599	.symtab	0x805884c	24	OBJECT	<unknown>	DEFAULT	4
C.152.6307	.symtab	0x80569e0	36	OBJECT	<unknown>	DEFAULT	4
C.156.6349	.symtab	0x8056d80	24	OBJECT	<unknown>	DEFAULT	4
C.186.6634	.symtab	0x8056fa4	20	OBJECT	<unknown>	DEFAULT	4
Hexed	.symtab	0x804a66e	303	FUNC	<unknown>	DEFAULT	2
KHcommSOCK	.symtab	0x8059300	4	OBJECT	<unknown>	DEFAULT	11
KHserverHACKER	.symtab	0x8059060	4	OBJECT	<unknown>	DEFAULT	10
LOCAL_ADDR	.symtab	0x805f560	4	OBJECT	<unknown>	DEFAULT	11
Percocet_bp	.symtab	0x8059040	4	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x8059320	16384	OBJECT	<unknown>	DEFAULT	11
RSF	.symtab	0x804a79d	482	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0x804b1e1	501	FUNC	<unknown>	DEFAULT	2
UDPBYPASS	.symtab	0x8049da5	252	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x8059054	12	OBJECT	<unknown>	DEFAULT	10
_Exit	.symtab	0x804efd4	36	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8059018	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8059008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8059004	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8059074	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8057204	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80592cc	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x80589a4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x805907c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8057504	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8059010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x805900c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8059000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8059000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8059074	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower	.symtab	0x80592cc	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper	.symtab	0x805907c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_b	.symtab	0x8059078	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x80592d0	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x8059080	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804f078	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x804ef14	84	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x805015c	26	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8052704	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x8050630	32	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x8050650	32	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x805060c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8051f4b	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8051faf	48	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80501a8	190	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804efd4	36	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80515a8	191	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x80519ec	17	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x805403c	43	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x80522fc	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804f030	40	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x805247c	128	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x8052973	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x805299f	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x805270c	615	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8050384	40	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x804eca8	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x805f534	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x8051e84	101	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8052284	48	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8051b2c	90	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8052aa8	244	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x80538b9	282	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x805370c	119	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8053784	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8053aa0	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8052b9c	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804eda4	32	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804fee4	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8054370	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8054388	219	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8054068	67	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804ff14	110	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804ee74	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8052354	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x804ed9c	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x805239c	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8050340	14	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x8050350	50	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8053d78	668	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8055750	666	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x8055a1c	88	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80522e0	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804ed48	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8052328	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x80503ac	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80522f4	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x805f538	4	OBJECT	<unknown>	HIDDEN	11
__GI_htonl	.symtab	0x8050304	7	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x80502f8	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x8050320	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8053ce4	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8054939	430	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x805467f	467	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8051944	165	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804ef98	59	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x805027c	27	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804ee94	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8055ab8	89	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804ffd0	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8053b00	37	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8053be0	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8050040	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8052234	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x80523fc	58	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x80523a4	44	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80523d0	44	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x8050317	7	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x805030b	12	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804ecdc	66	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x8052584	145	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x804ed20	40	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80559ec	48	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8054014	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8051670	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8051845	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80545f4	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804ee44	48	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x8052680	129	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x805040c	48	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x805043c	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x805235c	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804ee08	58	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x805047c	48	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80504ac	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80504ec	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x805179c	169	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80521e3	80	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x805054c	33	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x8050570	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8050584	135	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804eff8	53	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8051b88	146	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8050524	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804f0a4	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x80518a4	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x8055a74	67	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8055eec	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8050074	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x8053b44	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x804ff98	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x804ff98	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804fffc	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x8053bb0	45	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8055b14	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804ff84	19	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8050018	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804ffb8	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8053cc0	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x8053b28	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8053c94	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8050094	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8050190	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8053b60	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8051a00	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8051ce0	420	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8050298	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804ed50	16	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x8052438	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804f058	29	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x8055ec4	40	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x804ec90	21	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804f0c4	161	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8052250	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804edc4	23	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x80529cc	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8052a28	127	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8052a0c	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804ef68	48	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8059014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8059014	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x805f52c	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x80592a0	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x80592d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8051f83	44	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x80556c4	96	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x8059078	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x80592d0	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x8059080	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805f53c	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x805902c	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x8054ae8	259	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8055bfc	166	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8054bec	1815	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8055fb0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8059024	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8055f24	130	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8055b44	182	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8055ca4	82	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805f524	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804f078	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805f51c	4	OBJECT	<unknown>	HIDDEN	11
__fcntl_nocancel	.symtab	0x804ef14	84	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x8055724	41	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x8054268	264	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80522e0	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x805015c	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8052704	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x804f030	40	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8050384	40	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804eda4	32	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8055ab8	89	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80523d0	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804ecdc	66	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804ee44	48	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x805040c	48	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x805043c	64	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804ee08	58	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x805047c	48	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80504ac	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80521e3	80	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805f520	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804edc4	23	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804ef68	48	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x8058984	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x8051281	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8050670	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80591c4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x805f6c0	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x8051204	125	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805fa48	4	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x805fa4c	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8055cf8	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8055357	876	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x805f528	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x80592bc	4	OBJECT	<unknown>	DEFAULT	10
__progname_full	.symtab	0x80592c0	4	OBJECT	<unknown>	DEFAULT	10
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8051f1f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x8055d04	446	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x805fa40	4	OBJECT	<unknown>	HIDDEN	11
__resolv_attempts	.symtab	0x80592c9	1	OBJECT	<unknown>	HIDDEN	10
__resolv_lock	.symtab	0x805f544	24	OBJECT	<unknown>	DEFAULT	11
__resolv_timeout	.symtab	0x80592c8	1	OBJECT	<unknown>	HIDDEN	10
__restore	.symtab	0x80521db	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x80521d4	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805f530	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x805fa44	4	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x805fa50	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x8050630	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8050650	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x805060c	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80522b4	44	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8059090	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8054464	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8052bb4	117	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80544a4	153	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8052e44	232	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804f168	20	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4711	.symtab	0x8057804	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x8054540	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80545c4	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8054568	91	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8052f2c	153	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804f22c	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8059094	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x80521c0	17	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x8052448	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8051f4b	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8051faf	48	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8051fdf	480	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80592b8	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x804ec90	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x80501a8	190	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x80541dc	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x80540ac	163	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x805414f	141	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x805f33c	10	OBJECT	<unknown>	DEFAULT	11
_charpad	.symtab	0x804f254	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x805f668	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_handler	.symtab	0x805f690	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_spec	.symtab	0x80591c0	4	OBJECT	<unknown>	HIDDEN	10
_dl_aux_init	.symtab	0x8054028	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x805fa38	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x805fa3c	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80592d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805fa54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_endswith	.symtab	0x804ea15	125	FUNC	<unknown>	DEFAULT	2
_errno	.symtab	0x805f534	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804efd4	36	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8055fe4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x805d33c	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804f289	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8053144	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x805f538	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8052fc8	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x804e811	47	FUNC	<unknown>	DEFAULT	2
_memmove	.symtab	0x804e840	101	FUNC	<unknown>	DEFAULT	2
_memset	.symtab	0x804e8a5	42	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x804f8f0	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804fad5	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804f958	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804f994	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804faac	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8051f34	23	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8051f22	18	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x805f6b8	8	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048174	34	FUNC	<unknown>	DEFAULT	2
_startswith	.symtab	0x804e9d6	63	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8052c2c	534	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804f17c	58	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8059098	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x805909c	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x80537e8	209	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x805d338	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x80590b4	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x805d334	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x80590d0	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804f1b6	117	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80590cc	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x8051a18	276	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8053020	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strcat	.symtab	0x804e901	55	FUNC	<unknown>	DEFAULT	2
_strcmp	.symtab	0x804e7a7	106	FUNC	<unknown>	DEFAULT	2
_strcpy	.symtab	0x804e8cf	50	FUNC	<unknown>	DEFAULT	2
_strdup	.symtab	0x804e938	54	FUNC	<unknown>	DEFAULT	2
_string_syserrmsgs	.symtab	0x80578d4	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strlen	.symtab	0x804e786	33	FUNC	<unknown>	DEFAULT	2
_strstr	.symtab	0x804e96e	104	FUNC	<unknown>	DEFAULT	2
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8053060	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804f2e7	1545	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80515a8	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x804eddc	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x804b05e	162	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x804e0ae	89	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x80519ec	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x80519ec	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x8050178	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805f518	1	OBJECT	<unknown>	DEFAULT	11
brk	.symtab	0x805403c	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8050584	135	FUNC	<unknown>	DEFAULT	2
buf.5561	.symtab	0x805f34c	440	OBJECT	<unknown>	DEFAULT	11
bzero	.symtab	0x8050268	19	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x8059068	4	OBJECT	<unknown>	DEFAULT	10
calloc	.symtab	0x8050e1c	235	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x8048198	97	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x80481f9	223	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x80482d8	223	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x804f080	34	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x80522fc	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804f030	40	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x805247c	128	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4817	.symtab	0x80592e0	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x8050384	40	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x804941a	459	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049727	168	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x805902c	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x804eca8	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805f524	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x805f534	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x8051e84	101	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8052284	48	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8051b2c	90	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8058880	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8052aa8	244	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x80524fc	136	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8048fcf	104	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x805d320	4	OBJECT	<unknown>	DEFAULT	11
fdopendir	.symtab	0x8052615	106	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0x8048ea7	296	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x8048cb2	501	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x80538b9	282	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x805370c	119	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8053784	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8053aa0	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x80496f7	48	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x8058864	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8052b9c	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804eda4	32	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804fee4	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048120	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x80513fc	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8054370	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8054370	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8054388	219	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8054068	67	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x804ff14	110	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x804cf98	5	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x80491b1	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804cd9d	507	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x805370c	119	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x804ee74	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8052354	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x804ed9c	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x805239c	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8050340	14	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x8050350	50	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8053d78	668	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8055750	666	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x8055a1c	88	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x80522e0	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804ed48	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x804ecd4	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8052328	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x80503ac	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80503d4	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80522f4	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x805f538	4	OBJECT	<unknown>	DEFAULT	11
hacks	.symtab	0x8059030	4	OBJECT	<unknown>	DEFAULT	10
hacks2	.symtab	0x8059034	4	OBJECT	<unknown>	DEFAULT	10
hacks3	.symtab	0x8059038	4	OBJECT	<unknown>	DEFAULT	10
hacks4	.symtab	0x805903c	4	OBJECT	<unknown>	DEFAULT	10
hextable	.symtab	0x80562e0	1024	OBJECT	<unknown>	DEFAULT	4
hoste.5560	.symtab	0x805f504	20	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x8050304	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x80502f8	12	FUNC	<unknown>	DEFAULT	2
i.5030	.symtab	0x805906c	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x8050074	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8050320	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8053ce4	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x8054939	430	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8054852	231	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x805467f	467	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8054608	119	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804cc35	360	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x80484cd	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8051709	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8051944	165	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804ef98	59	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x805027c	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804ee94	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x8059310	4	OBJECT	<unknown>	DEFAULT	11
last_id.5618	.symtab	0x80592c4	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.5617	.symtab	0x805f540	4	OBJECT	<unknown>	DEFAULT	11
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x80495e5	274	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8055ab8	89	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8059314	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804cf9d	1663	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x804987a	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x804921f	106	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x804aaed	141	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8050696	1926	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x805158b	29	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x804ffd0	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8053b00	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8053be0	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8050040	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8052234	27	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x80523fc	58	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x80523a4	44	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80591dc	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80591f4	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x80523d0	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x805f348	4	OBJECT	<unknown>	DEFAULT	11
ngPid	.symtab	0x805f568	4	OBJECT	<unknown>	DEFAULT	11
nprocessors_onln	.symtab	0x8051c1c	196	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8050317	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x805030b	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8059308	8	OBJECT	<unknown>	DEFAULT	11
object.4829	.symtab	0x80592e4	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804ecdc	66	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x8052584	145	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805f564	4	OBJECT	<unknown>	DEFAULT	11
p.4815	.symtab	0x8059028	0	OBJECT	<unknown>	DEFAULT	10
parseHex	.symtab	0x8049037	68	FUNC	<unknown>	DEFAULT	2
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x805f570	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x804ed20	40	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x80559ec	48	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x804ed60	58	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4931	.symtab	0x805782c	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8048989	581	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8048756	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048867	290	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048790	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804b3d6	6239	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x80592c0	4	OBJECT	<unknown>	DEFAULT	10
program_invocation_short_name	.symtab	0x80592bc	4	OBJECT	<unknown>	DEFAULT	10
qual_chars.4940	.symtab	0x8057840	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8054014	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8051668	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x804d6d1	102	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x804d737	95	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x80486b1	165	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x80485f3	190	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x804d61c	77	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x804d669	104	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8051670	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8058430	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8051845	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstrings	.symtab	0x8059044	16	OBJECT	<unknown>	DEFAULT	10
randtbl	.symtab	0x8059220	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x80545f4	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804ee44	48	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x8052680	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8050f08	762	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x805040c	48	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8049289	401	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x805043c	64	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5603	.symtab	0x805f55c	4	OBJECT	<unknown>	DEFAULT	11
resolv_domain_to_hostname	.symtab	0x804d798	125	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x804de03	56	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x804d8a0	1379	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x804d815	139	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x8053b28	26	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x804a313	859	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x805235c	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x805f56c	4	OBJECT	<unknown>	DEFAULT	11
select	.symtab	0x804ee08	58	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x805047c	48	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x804a97f	366	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x80504ac	64	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80504ec	56	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80516b2	87	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x805179c	169	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80521e3	80	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x805054c	33	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x8050570	20	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x8050584	135	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804eff8	53	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x805532c	43	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x8055304	40	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x8051b88	146	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x8050524	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x804b100	225	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048c14	158	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4939	.symtab	0x8057854	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4930	.symtab	0x8057838	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4936	.symtab	0x8057880	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4935	.symtab	0x8057898	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4938	.symtab	0x8057864	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4937	.symtab	0x8057874	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804f0a4	30	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x805175e	61	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x805175e	61	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x80518a4	160	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x8055a74	67	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stderr	.symtab	0x805908c	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x8059084	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x8059088	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8055eec	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8050074	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x8053b44	25	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x804ff98	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x804ff98	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804fffc	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x8053bb0	45	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8055b14	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x80501a8	190	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804ff84	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8050018	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804ffb8	24	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8053cc0	35	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x8053b28	26	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8053c94	42	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8050094	197	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8050190	22	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8053b60	80	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8051a00	23	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x8051ce0	420	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x8048bf0	36	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x805f580	232	OBJECT	<unknown>	DEFAULT	11
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x804de3c	468	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x8059070	4	OBJECT	<unknown>	DEFAULT	10
table_lock_val	.symtab	0x804e045	53	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x804e07a	52	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x804e010	53	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8050298	96	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x8049ea1	1138	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x80497cf	171	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804ed50	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x8052438	16	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x804e107	237	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x804f058	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x804853c	183	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x80578a0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x80578b8	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x80498f8	1197	FUNC	<unknown>	DEFAULT	2
uname	.symtab	0x8055ec4	40	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1473	.symtab	0x80578c4	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x805920c	20	OBJECT	<unknown>	DEFAULT	10
uppercase	.symtab	0x80491ec	51	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x8059064	4	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x8051eec	47	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x804e3a4	424	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x804eb43	129	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x804ebf1	57	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x804ec63	45	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x804ec2a	57	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x804ebc4	45	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x804e54c	253	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x804ea92	177	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x804e353	47	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x804e649	116	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x804e327	44	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x804e28e	106	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x804e2f8	47	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x804e6bd	201	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x804e1f4	40	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x804e21c	114	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x804e382	34	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x804ec90	21	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x804ab7a	1252	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x804f0c4	161	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x805d330	4	OBJECT	<unknown>	DEFAULT	11
wait4	.symtab	0x8052250	52	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804edc4	23	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x80483b8	277	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x8059304	4	OBJECT	<unknown>	DEFAULT	11
wcrtomb	.symtab	0x80529cc	63	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8052a28	127	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8052a0c	27	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x804907b	310	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x804ef68	48	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x805d324	4	OBJECT	<unknown>	DEFAULT	11
xdigits.3497	.symtab	0x8058930	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x805d328	4	OBJECT	<unknown>	DEFAULT	11
z	.symtab	0x805d32c	4	OBJECT	<unknown>	DEFAULT	11
zprintf	.symtab	0x8048bce	34	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T08:58:11.469602+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56686	195.133.52.175	65489	TCP
2025-01-05T08:58:27.179169+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56688	195.133.52.175	65489	TCP
2025-01-05T08:58:42.888291+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56690	195.133.52.175	65489	TCP
2025-01-05T08:58:58.608002+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56692	195.133.52.175	65489	TCP
2025-01-05T08:59:14.338606+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56694	195.133.52.175	65489	TCP
2025-01-05T08:59:30.052314+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56696	195.133.52.175	65489	TCP
2025-01-05T08:59:45.774173+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56698	195.133.52.175	65489	TCP
2025-01-05T09:00:01.490506+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56700	195.133.52.175	65489	TCP
2025-01-05T09:00:17.205592+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56702	195.133.52.175	65489	TCP
2025-01-05T09:00:32.923634+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56704	195.133.52.175	65489	TCP
2025-01-05T09:00:48.653559+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56706	195.133.52.175	65489	TCP
2025-01-05T09:01:04.414608+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56708	195.133.52.175	65489	TCP
2025-01-05T09:01:20.132523+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56710	195.133.52.175	65489	TCP
2025-01-05T09:01:35.840981+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.15	56712	195.133.52.175	65489	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 08:58:11.464626074 CET	56686	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:11.469530106 CET	65489	56686	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:11.469584942 CET	56686	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:11.469602108 CET	56686	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:11.474432945 CET	65489	56686	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:12.170156956 CET	65489	56686	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:12.170279980 CET	56686	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:12.170284033 CET	65489	56686	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:12.170377970 CET	56686	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:12.175142050 CET	65489	56686	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:27.174138069 CET	56688	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:27.179075956 CET	65489	56688	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:27.179150105 CET	56688	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:27.179168940 CET	56688	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:27.184019089 CET	65489	56688	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:27.878320932 CET	65489	56688	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:27.878427029 CET	56688	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:27.878443003 CET	65489	56688	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:27.878484964 CET	56688	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:27.883290052 CET	65489	56688	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:42.882216930 CET	56690	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:42.888200045 CET	65489	56690	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:42.888264894 CET	56690	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:42.888290882 CET	56690	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:42.893078089 CET	65489	56690	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:43.597707033 CET	65489	56690	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:43.597826958 CET	56690	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:43.597893953 CET	65489	56690	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:43.597951889 CET	56690	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:43.603027105 CET	65489	56690	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:58.601876974 CET	56692	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:58.607844114 CET	65489	56692	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:58.607939005 CET	56692	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:58.608001947 CET	56692	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:58.612729073 CET	65489	56692	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:59.329930067 CET	65489	56692	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:59.330053091 CET	65489	56692	195.133.52.175	192.168.2.15
Jan 5, 2025 08:58:59.330107927 CET	56692	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:59.330169916 CET	56692	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:58:59.334988117 CET	65489	56692	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:14.333528042 CET	56694	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:14.338486910 CET	65489	56694	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:14.338568926 CET	56694	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:14.338606119 CET	56694	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:14.343434095 CET	65489	56694	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:15.043984890 CET	65489	56694	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:15.044147015 CET	65489	56694	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:15.044212103 CET	56694	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:15.044212103 CET	56694	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:15.049074888 CET	65489	56694	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:30.047318935 CET	56696	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:30.052196980 CET	65489	56696	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:30.052304029 CET	56696	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:30.052314043 CET	56696	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:30.057040930 CET	65489	56696	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:30.764874935 CET	65489	56696	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:30.764987946 CET	65489	56696	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:30.765099049 CET	56696	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:30.765146017 CET	56696	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:30.769994020 CET	65489	56696	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:45.769159079 CET	56698	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:45.774010897 CET	65489	56698	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:45.774137020 CET	56698	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:45.774173021 CET	56698	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:45.778935909 CET	65489	56698	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:46.481142044 CET	65489	56698	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:46.481441021 CET	56698	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:46.481542110 CET	65489	56698	195.133.52.175	192.168.2.15
Jan 5, 2025 08:59:46.481648922 CET	56698	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 08:59:46.486401081 CET	65489	56698	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:01.485528946 CET	56700	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:01.490389109 CET	65489	56700	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:01.490463018 CET	56700	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:01.490505934 CET	56700	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:01.495328903 CET	65489	56700	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:02.197103977 CET	65489	56700	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:02.197226048 CET	56700	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:02.197395086 CET	65489	56700	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:02.197449923 CET	56700	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:02.202255011 CET	65489	56700	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:17.200710058 CET	56702	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:17.205526114 CET	65489	56702	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:17.205591917 CET	56702	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:17.205591917 CET	56702	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:17.210737944 CET	65489	56702	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:17.914773941 CET	65489	56702	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:17.914917946 CET	56702	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:17.914999962 CET	65489	56702	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:17.915056944 CET	56702	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:17.919800043 CET	65489	56702	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:32.918443918 CET	56704	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:32.923491955 CET	65489	56704	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:32.923618078 CET	56704	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:32.923634052 CET	56704	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:32.928486109 CET	65489	56704	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:33.644237041 CET	65489	56704	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:33.644453049 CET	65489	56704	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:33.644484043 CET	56704	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:33.644774914 CET	56704	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:33.649514914 CET	65489	56704	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:48.648507118 CET	56706	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:48.653471947 CET	65489	56706	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:48.653558969 CET	56706	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:48.653558969 CET	56706	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:48.658304930 CET	65489	56706	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:49.363277912 CET	65489	56706	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:49.363352060 CET	65489	56706	195.133.52.175	192.168.2.15
Jan 5, 2025 09:00:49.363477945 CET	56706	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:49.363527060 CET	56706	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:00:49.368269920 CET	65489	56706	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:04.409535885 CET	56708	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:04.414506912 CET	65489	56708	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:04.414582968 CET	56708	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:04.414608002 CET	56708	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:04.419373035 CET	65489	56708	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:05.124330997 CET	65489	56708	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:05.124479055 CET	56708	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:05.124495983 CET	65489	56708	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:05.124716997 CET	56708	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:05.129528999 CET	65489	56708	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:20.127500057 CET	56710	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:20.132462978 CET	65489	56710	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:20.132523060 CET	56710	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:20.132523060 CET	56710	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:20.137396097 CET	65489	56710	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:20.832006931 CET	65489	56710	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:20.832133055 CET	65489	56710	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:20.832176924 CET	56710	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:20.832216024 CET	56710	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:20.837002993 CET	65489	56710	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:35.835907936 CET	56712	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:35.840842962 CET	65489	56712	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:35.840969086 CET	56712	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:35.840981007 CET	56712	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:35.845850945 CET	65489	56712	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:36.565871954 CET	65489	56712	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:36.565951109 CET	65489	56712	195.133.52.175	192.168.2.15
Jan 5, 2025 09:01:36.566129923 CET	56712	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:36.566327095 CET	56712	65489	192.168.2.15	195.133.52.175
Jan 5, 2025 09:01:36.571120977 CET	65489	56712	195.133.52.175	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 09:00:57.839930058 CET	58487	53	192.168.2.15	1.1.1.1
Jan 5, 2025 09:00:57.840003967 CET	45063	53	192.168.2.15	1.1.1.1
Jan 5, 2025 09:00:57.846726894 CET	53	45063	1.1.1.1	192.168.2.15
Jan 5, 2025 09:00:57.846856117 CET	53	58487	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 09:00:57.839930058 CET	192.168.2.15	1.1.1.1	0xa97a	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 09:00:57.840003967 CET	192.168.2.15	1.1.1.1	0x57be	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 09:00:57.846856117 CET	1.1.1.1	192.168.2.15	0xa97a	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 5, 2025 09:00:57.846856117 CET	1.1.1.1	192.168.2.15	0xa97a	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: u.elf PID: 5544, Parent PID: 5463

General

Start time (UTC):	07:58:10
Start date (UTC):	05/01/2025
Path:	/tmp/u.elf
Arguments:	/tmp/u.elf
File size:	97798 bytes
MD5 hash:	616ec606badd89e9ad5f37d1cc550bcd

Chronological Activities

Analysis Process: u.elf PID: 5546, Parent PID: 5544

General

Start time (UTC):	07:58:10
Start date (UTC):	05/01/2025
Path:	/tmp/u.elf
Arguments:	-
File size:	97798 bytes
MD5 hash:	616ec606badd89e9ad5f37d1cc550bcd

Chronological Activities

Analysis Process: u.elf PID: 5547, Parent PID: 5544

General

Start time (UTC):	07:58:10
Start date (UTC):	05/01/2025
Path:	/tmp/u.elf
Arguments:	-
File size:	97798 bytes
MD5 hash:	616ec606badd89e9ad5f37d1cc550bcd

Chronological Activities

Analysis Process: u.elf PID: 5548, Parent PID: 5547

General

Start time (UTC):	07:58:10
Start date (UTC):	05/01/2025
Path:	/tmp/u.elf
Arguments:	-
File size:	97798 bytes
MD5 hash:	616ec606badd89e9ad5f37d1cc550bcd

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report u.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: u.elf PID: 5544, Parent PID: 5463

General

Chronological Activities

Analysis Process: u.elf PID: 5546, Parent PID: 5544

General

Chronological Activities

Analysis Process: u.elf PID: 5547, Parent PID: 5544

General

Chronological Activities

Analysis Process: u.elf PID: 5548, Parent PID: 5547

General

Chronological Activities

Linux Analysis Report
u.elf