Edit tour

Linux Analysis Report
Space.spc.elf

Overview

General Information

Sample name:	Space.spc.elf
Analysis ID:	1584439
MD5:	864d5ba13e765b44e5e1b15d69e6c937
SHA1:	a083b0de00381384242d7982d5ac67606bb578d1
SHA256:	56080985071f7ba48e964fcc5119984c28f27ba9425307d40419bd27284ff0d6
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584439
Start date and time:	2025-01-05 14:42:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.spc.elf
Detection:	MAL
Classification:	mal76.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.spc.elf
PID:	6233
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6206, Parent: 4332)

rm (PID: 6206, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.gcHM11sS17 /tmp/tmp.2Fn5jPrdbI /tmp/tmp.x8KYsQekzN

dash New Fork (PID: 6207, Parent: 4332)

rm (PID: 6207, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.gcHM11sS17 /tmp/tmp.2Fn5jPrdbI /tmp/tmp.x8KYsQekzN

Space.spc.elf (PID: 6233, Parent: 6126, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/Space.spc.elf

Space.spc.elf New Fork (PID: 6235, Parent: 6233)

Space.spc.elf New Fork (PID: 6237, Parent: 6235)

Space.spc.elf New Fork (PID: 6238, Parent: 6235)

Space.spc.elf New Fork (PID: 6243, Parent: 6233)

Space.spc.elf New Fork (PID: 6244, Parent: 6233)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Space.spc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Space.spc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1550c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1555c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6235.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6235.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1550c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1555c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6233.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6233.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1550c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1555c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6243.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6243.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1550c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1555c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6237.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6237.1.00007fcf70011000.00007fcf70029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1550c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1555c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 6233	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 6233	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x246:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 6235	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 6235	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x166b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1693:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 6237	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 6237	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xae60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xae74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xae88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xae9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaeb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaeec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xafa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xafb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xafc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xafdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.spc.elf PID: 6243	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.spc.elf PID: 6243	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Space.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Space.spc.elf	Virustotal: Detection: 59%			Perma Link
Source: Space.spc.elf	ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.23:47576 -> 79.133.46.252:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Space.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6235.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6233.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6243.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6237.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 6235, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.spc.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_discord.c
Source: ELF static info symbol of initial sample	Name: attack_game.c
Source: ELF static info symbol of initial sample	Name: attack_game_samp
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init

Source: Space.spc.elf	ELF static info symbol of initial sample: hexPayload
Source: Space.spc.elf	ELF static info symbol of initial sample: scanner.c
Source: Space.spc.elf	ELF static info symbol of initial sample: scanner_kill
Source: Space.spc.elf	ELF static info symbol of initial sample: scanner_pid

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/net/tcp/proc/proc/%d/exe/proc/%s/statusrName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc79.133.46.252

Source: Space.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6235.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6233.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6243.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6237.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 6235, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.spc.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.linELF@0/0@0/0

Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/6233/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/6227/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/6226/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/6228/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/6238/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.spc.elf (PID: 6233)	File opened: /proc/6148/status	Jump to behavior

Source: /usr/bin/dash (PID: 6206)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.gcHM11sS17 /tmp/tmp.2Fn5jPrdbI /tmp/tmp.x8KYsQekzN			Jump to behavior
Source: /usr/bin/dash (PID: 6207)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.gcHM11sS17 /tmp/tmp.2Fn5jPrdbI /tmp/tmp.x8KYsQekzN			Jump to behavior

Source: /tmp/Space.spc.elf (PID: 6233)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.spc.elf, 6233.1.0000555969407000.000055596948c000.rw-.sdmp, Space.spc.elf, 6235.1.0000555969407000.000055596946c000.rw-.sdmp, Space.spc.elf, 6237.1.0000555969407000.000055596946c000.rw-.sdmp, Space.spc.elf, 6243.1.0000555969407000.000055596948c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: Space.spc.elf, 6233.1.0000555969407000.000055596948c000.rw-.sdmp, Space.spc.elf, 6235.1.0000555969407000.000055596946c000.rw-.sdmp, Space.spc.elf, 6237.1.0000555969407000.000055596946c000.rw-.sdmp, Space.spc.elf, 6243.1.0000555969407000.000055596948c000.rw-.sdmp	Binary or memory string: @iYU!/etc/qemu-binfmt/sparc
Source: Space.spc.elf, 6233.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp, Space.spc.elf, 6235.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp, Space.spc.elf, 6237.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp, Space.spc.elf, 6243.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp	Binary or memory string: ix86_64/usr/bin/qemu-sparc/tmp/Space.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.spc.elf
Source: Space.spc.elf, 6233.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp, Space.spc.elf, 6235.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp, Space.spc.elf, 6237.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp, Space.spc.elf, 6243.1.00007ffd52a09000.00007ffd52a2a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Space.spc.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6237, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6243, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Space.spc.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007fcf70011000.00007fcf70029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6237, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.spc.elf PID: 6243, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.spc.elf	60%	Virustotal		Browse
Space.spc.elf	66%	ReversingLabs	Linux.Backdoor.Mirai
Space.spc.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
79.133.46.252	unknown	Germany	203833	AT-FIRSTCOLOAustriaAT	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
79.133.46.252	Space.mpsl.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.mpsl
	Space.x86.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.x86
	Space.mips.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.mips
	Space.arm7.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.arm7
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.arm6
91.189.91.43	main.mpsl.elf	Get hash	malicious	Mirai	Browse
	z0r0.arc.elf	Get hash	malicious	Mirai	Browse
	main.x86.elf	Get hash	malicious	Mirai	Browse
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	Space.arm7.elf	Get hash	malicious	Mirai	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	main.arm6.elf	Get hash	malicious	Mirai	Browse
	main.m68k.elf	Get hash	malicious	Mirai	Browse
	fuckunix.arm5.elf	Get hash	malicious	Mirai	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	main.mpsl.elf	Get hash	malicious	Mirai	Browse
	z0r0.arc.elf	Get hash	malicious	Mirai	Browse
	main.x86.elf	Get hash	malicious	Mirai	Browse
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	Space.arm7.elf	Get hash	malicious	Mirai	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	main.arm6.elf	Get hash	malicious	Mirai	Browse
	main.m68k.elf	Get hash	malicious	Mirai	Browse
	fuckunix.arm5.elf	Get hash	malicious	Mirai	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	main.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	z0r0.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	z0r0.mips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	z0r0.mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	main.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	main.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	z0r0.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	z0r0.mips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	z0r0.mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	main.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
AT-FIRSTCOLOAustriaAT	Space.arm7.elf	Get hash	malicious	Mirai	Browse	79.133.46.252
	Space.arm.elf	Get hash	malicious	Mirai	Browse	79.133.46.252
	Space.mips.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	79.133.46.252
	Space.ppc.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.x86.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.sh4.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.x86.elf	Get hash	malicious	Mirai	Browse	79.133.46.252
INIT7CH	main.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	z0r0.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fuckunix.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.127710311977205
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.spc.elf
File size:	124'258 bytes
MD5:	864d5ba13e765b44e5e1b15d69e6c937
SHA1:	a083b0de00381384242d7982d5ac67606bb578d1
SHA256:	56080985071f7ba48e964fcc5119984c28f27ba9425307d40419bd27284ff0d6
SHA512:	bf1b51c48f4402d231b9bd1d4efc2363d20fdd3d9d20436f19e560517006a6159a6beca010c4808c52219dcac92b3fc89694e176d4bdc32338801cdf0c53a731
SSDEEP:	3072:UqeUYbquv5FXNENItDY9wjH9uKo3I8jLP:UZUOqkXaN99dLP
TLSH:	27C36B2272390A27C0E6A13901E7D737B7F64BC82A60520F7E655FD83B166E036877B5
File Content Preview:	.ELF...........................4.........4. ...(......................~p..~p...........................,..8................H...H...H................dt.Q................................@..(....@.T.................#.....`0..`.....!....." ..@.....".........`

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101c4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	102332
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	14

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100b4	0xb4	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100d0	0xd0	0x15268	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x25338	0x15338	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x25350	0x15350	0x2b20	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x38000	0x18000	0x48	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x38048	0x18048	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x38048	0x18048	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x38050	0x18050	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x38058	0x18058	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x3805c	0x1805c	0x1c0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x3821c	0x1821c	0x210	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x38430	0x1842c	0x3450	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1842c	0xb1c	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x18f48	0x71	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x19264	0x2eb0	0x10	0x0		16	283	4
.strtab	STRTAB	0x0	0x1c114	0x244e	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x17e70	0x17e70	6.1340	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18000	0x38000	0x38000	0x42c	0x3880	4.5602	0x6	RW	0x10000	.eh_frame .tbss .ctors .dtors .jcr .got .data .bss
TLS	0x18048	0x38048	0x38048	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x100b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x25338	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x25350	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x38000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x38048	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x38048	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x38050	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x38058	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x3805c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x3821c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x38430	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
.LLC3	.symtab	0x27a28	0	NOTYPE	<unknown>	DEFAULT	4
.rem	.symtab	0x17464	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x17444	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x17458	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x17424	32	FUNC	<unknown>	DEFAULT	2
C.23.5636	.symtab	0x26cd0	24	OBJECT	<unknown>	DEFAULT	4
C.5.4430	.symtab	0x25400	8	OBJECT	<unknown>	DEFAULT	4
C.6.4431	.symtab	0x253f8	8	OBJECT	<unknown>	DEFAULT	4
C.7.4432	.symtab	0x253f0	8	OBJECT	<unknown>	DEFAULT	4
C.8.4433	.symtab	0x253e8	8	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x3af94	4	OBJECT	<unknown>	DEFAULT	12
_Exit	.symtab	0x20584	128	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x3805c	0	OBJECT	<unknown>	HIDDEN	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x3804c	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x38048	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x38424	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x27a3a	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x38054	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x38050	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x38000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x38044	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x38424	4	OBJECT	<unknown>	HIDDEN	11
__GI___close	.symtab	0x1f988	124	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1f994	32	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x38428	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x17da8	36	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x17498	196	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x234a0	344	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1c64c	32	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1f988	124	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1755c	248	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1fa04	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1fb0c	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1fa88	132	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1fa04	132	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1fa10	32	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1fb0c	132	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1fb18	32	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1cc28	44	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1cc54	44	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1cc00	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1fdb0	168	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1feac	92	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1fa88	132	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1fa94	32	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1c674	300	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x20584	128	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1e034	280	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1c854	96	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1e6c0	24	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1c8b4	36	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x248f4	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1f988	124	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x179c4	208	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x210f8	64	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x21140	80	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x20d9c	860	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1c8d8	96	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1e8d4	168	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x17e0c	860	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1755c	248	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x19f2c	992	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x23358	320	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x234a0	344	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x19b40	260	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1a30c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x18168	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1f1c4	1088	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1a3ac	60	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x24c18	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x24e24	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x2060c	116	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1a3f0	196	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x234a0	344	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x20738	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x20760	32	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x20780	32	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x207a0	32	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x207c8	56	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1f6c8	88	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x20808	92	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1c938	36	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x20864	32	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1c82c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x23dd8	244	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1e4b8	244	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1767c	228	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1c7a0	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x17768	92	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x25274	124	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x24a8c	168	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x24b3c	220	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x23678	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1aae0	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1a4fc	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x23b1c	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x23b3c	256	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1bb88	416	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x2088c	108	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x20900	104	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x20970	92	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x20a30	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1fa04	132	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x17b4c	228	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1f728	264	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1e164	108	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1e330	152	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1fb0c	132	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x17ce8	184	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x20ce0	188	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1c988	92	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x20a80	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x17834	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1c9e4	92	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1ca40	96	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x17890	80	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1caa0	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1e5ac	276	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x20380	264	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1caf8	72	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1cb40	16	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1cb58	168	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x178e8	172	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1f838	336	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x18180	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1cacc	36	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1e3c8	232	FUNC	<unknown>	HIDDEN	2
__GI_sscanf	.symtab	0x19aa0	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1bd9c	524	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x23c3c	260	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1c0fc	648	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1c0fc	648	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x237f8	804	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x23d40	60	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1c3ec	120	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x1c464	244	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1c558	244	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1bfa8	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x23d7c	84	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1e6d8	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1ed48	1140	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1c7c0	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x17994	40	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x20aec	40	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x24c3c	480	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x22104	1992	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x181b0	164	FUNC	<unknown>	HIDDEN	2
__GI_vsscanf	.symtab	0x19ad0	112	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x21190	76	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x21200	192	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x211dc	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1fa88	132	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x38058	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x38058	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x3aa3c	4	OBJECT	<unknown>	HIDDEN	12
__atexit_lock	.symtab	0x38400	24	OBJECT	<unknown>	DEFAULT	11
__bss_start	.symtab	0x3842c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1fe58	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1f988	124	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1f994	32	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x38428	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x3af80	4	OBJECT	<unknown>	HIDDEN	12
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x252f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100d0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x3821c	0	OBJECT	<unknown>	HIDDEN	11
__environ	.symtab	0x3aa34	4	OBJECT	<unknown>	DEFAULT	12
__errno_location	.symtab	0x17da8	36	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x3a4e4	4	OBJECT	<unknown>	HIDDEN	12
__fcntl_nocancel	.symtab	0x17498	196	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x234a0	344	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x38048	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x38048	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x1f1c4	1088	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x3b84c	4	OBJECT	<unknown>	HIDDEN	12
__fork_handlers	.symtab	0x3b850	4	OBJECT	<unknown>	HIDDEN	12
__fork_lock	.symtab	0x3a4e8	4	OBJECT	<unknown>	HIDDEN	12
__getdents	.symtab	0x20688	176	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x24954	304	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x207c8	56	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1f6c8	88	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1c64c	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x38048	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x38048	0	NOTYPE	<unknown>	HIDDEN	6
__init_scan_cookie	.symtab	0x228e8	104	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x1c854	96	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1f988	124	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1c8d8	96	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1fb98	196	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1fc5c	268	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x1755c	248	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1f1c4	1088	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x20a30	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1fa04	132	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1fb0c	132	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1c988	92	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x17834	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1c9e4	92	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1ca40	96	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x245bc	636	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x20380	264	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x3aa30	4	OBJECT	<unknown>	DEFAULT	12
__libc_write	.symtab	0x1fa88	132	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x1f61c	172	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1dc0c	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1cc80	144	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x38324	24	OBJECT	<unknown>	DEFAULT	11
__malloc_state	.symtab	0x3b4d4	888	OBJECT	<unknown>	DEFAULT	12
__malloc_trim	.symtab	0x1db5c	176	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x1fa04	132	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1fa10	32	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x3aa38	4	OBJECT	<unknown>	DEFAULT	12
__preinit_array_end	.symtab	0x38048	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x38048	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x3841c	4	OBJECT	<unknown>	DEFAULT	11
__progname_full	.symtab	0x38420	4	OBJECT	<unknown>	DEFAULT	11
__psfs_do_numeric	.symtab	0x22d64	1524	FUNC	<unknown>	HIDDEN	2
__psfs_do_numeric.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__psfs_parse_spec	.symtab	0x22a20	828	FUNC	<unknown>	HIDDEN	2
__psfs_parse_spec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__pthread_initialize_minimal	.symtab	0x24838	24	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1fd70	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1fd68	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1fd68	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1fd68	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1fd68	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x1fb0c	132	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1fb18	32	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__rt_sigreturn_stub	.symtab	0x20358	16	FUNC	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x3aa40	4	OBJECT	<unknown>	HIDDEN	12
__scan_cookie.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__scan_getc	.symtab	0x22950	120	FUNC	<unknown>	HIDDEN	2
__scan_ungetc	.symtab	0x229c8	80	FUNC	<unknown>	HIDDEN	2
__sigaddset	.symtab	0x1cc28	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1cc54	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1cc00	40	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x23ecc	60	FUNC	<unknown>	HIDDEN	2
__sigreturn_stub	.symtab	0x20368	16	FUNC	<unknown>	DEFAULT	2
__sigsetjmp	.symtab	0x204fc	28	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x20520	92	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__sparc32_atomic_locks	.symtab	0x38470	64	OBJECT	<unknown>	HIDDEN	12
__stdin	.symtab	0x38248	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x24fe4	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x212c8	248	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x25054	248	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x213c0	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x2514c	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x25238	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x2518c	172	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x21508	272	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x188c0	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x3824c	4	OBJECT	<unknown>	DEFAULT	11
__strtofpmax	.symtab	0x24190	848	FUNC	<unknown>	HIDDEN	2
__strtofpmax.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_error	.symtab	0x20330	40	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x209d4	92	FUNC	<unknown>	DEFAULT	2
__syscall_select	.symtab	0x177cc	104	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x1fdb0	168	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1feac	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1ff08	1056	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x23678	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x38418	4	OBJECT	<unknown>	HIDDEN	11
__write	.symtab	0x1fa88	132	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x1fa94	32	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x1c674	300	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x20ba0	132	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x20b14	140	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x20c24	180	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x3a4d0	10	OBJECT	<unknown>	DEFAULT	12
_charpad	.symtab	0x188f8	64	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x3b47c	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_handler	.symtab	0x3b4a4	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_spec	.symtab	0x38320	4	OBJECT	<unknown>	HIDDEN	11
_dl_aux_init	.symtab	0x24858	64	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x24898	84	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x3b874	4	OBJECT	<unknown>	DEFAULT	12
_dl_phnum	.symtab	0x3b878	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_gaps	.symtab	0x3b868	1	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_slotinfo_list	.symtab	0x3b864	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_generation	.symtab	0x3b86c	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_max_dtv_idx	.symtab	0x3b85c	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_setup	.symtab	0x24560	92	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x3b858	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_nelem	.symtab	0x3b870	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_size	.symtab	0x3b860	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_used	.symtab	0x3b854	4	OBJECT	<unknown>	DEFAULT	12
_edata	.symtab	0x3842c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x3b880	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x20584	128	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x25338	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x384d0	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x18938	116	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x21824	2032	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x100b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x21618	144	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1911c	156	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1945c	1604	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x191b8	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x191f4	492	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x193e8	116	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1fd84	36	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1fd78	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x204f0	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x3b4cc	8	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x101c4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1825c	1188	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x18708	124	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x38250	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x384b0	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x19c4c	736	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x384cc	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_del_lock	.symtab	0x384bc	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x384c8	4	OBJECT	<unknown>	DEFAULT	12
_stdio_streams	.symtab	0x38254	204	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x18784	316	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x38238	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l	.symtab	0x1e6f4	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdlib_strto_ll	.symtab	0x23f10	632	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_ll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x216a8	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x26e30	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x216e4	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x189b4	1896	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1e034	280	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x1c854	96	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0x14eec	20	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x1e6c0	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1e6c0	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app_http	.symtab	0x10238	7880	FUNC	<unknown>	DEFAULT	2
attack_discord.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_game.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_game_samp	.symtab	0x12b04	788	FUNC	<unknown>	DEFAULT	2
attack_get_opt_int	.symtab	0x124b4	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x12444	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0x12100	92	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x12524	856	FUNC	<unknown>	DEFAULT	2
attack_method_discord_voip	.symtab	0x1287c	648	FUNC	<unknown>	DEFAULT	2
attack_method_hexflood	.symtab	0x136fc	664	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0x1455c	1408	FUNC	<unknown>	DEFAULT	2
attack_method_raw	.symtab	0x13ef4	1640	FUNC	<unknown>	DEFAULT	2
attack_method_std	.symtab	0x1346c	656	FUNC	<unknown>	DEFAULT	2
attack_method_stdhex	.symtab	0x13c2c	712	FUNC	<unknown>	DEFAULT	2
attack_method_tcp	.symtab	0x12e18	1620	FUNC	<unknown>	DEFAULT	2
attack_method_udphex	.symtab	0x13994	664	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0x12234	528	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x1215c	216	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x1a4f0	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x3a4e0	4	OBJECT	<unknown>	DEFAULT	12
bind	.symtab	0x1c8b4	36	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x248f4	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1cb58	168	FUNC	<unknown>	DEFAULT	2
bzero	.symtab	0x1bb54	52	FUNC	<unknown>	DEFAULT	2
call___do_global_ctors_aux	.symtab	0x2532c	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1014c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x101b8	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1d6a4	284	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x14adc	100	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x14b40	200	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x17dcc	56	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1f988	124	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x179c4	208	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4753	.symtab	0x38430	1	OBJECT	<unknown>	DEFAULT	12
conn_table	.symtab	0x3afb4	4	OBJECT	<unknown>	DEFAULT	12
connect	.symtab	0x1c8d8	96	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decpt_str	.symtab	0x27de0	2	OBJECT	<unknown>	DEFAULT	4
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x3aa34	4	OBJECT	<unknown>	DEFAULT	12
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x26da0	126	OBJECT	<unknown>	DEFAULT	4
exit	.symtab	0x1e8d4	168	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x27d98	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x17e0c	860	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1755c	248	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x38228	4	OBJECT	<unknown>	DEFAULT	11
fd_serv	.symtab	0x3822c	4	OBJECT	<unknown>	DEFAULT	11
fd_to_DIR	.symtab	0x17a9c	176	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x17c30	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x19f2c	992	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x23358	320	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x234a0	344	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x19b40	260	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1a30c	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x27d80	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x18168	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1f1c4	1088	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x3a4ec	1348	OBJECT	<unknown>	DEFAULT	12
fputs_unlocked	.symtab	0x1a3ac	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10158	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1ddc8	564	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x24c18	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x24c18	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x24e24	448	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x2060c	116	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1a3f0	196	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x23358	320	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x234a0	344	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x20738	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x20760	32	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x20780	32	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x207a0	32	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x207c8	56	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1f6c8	88	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x17654	32	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x20808	92	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1c938	36	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1c95c	44	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x20864	32	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hexPayload	.symtab	0x38224	4	OBJECT	<unknown>	DEFAULT	11
index	.symtab	0x1bd9c	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1c82c	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x23dd8	244	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x244e8	120	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x1e24c	124	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1e4b8	244	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1767c	228	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1c7a0	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x17768	92	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_condi	.symtab	0x14c08	676	FUNC	<unknown>	DEFAULT	2
killer_init	.symtab	0x14eac	64	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x3af9c	4	OBJECT	<unknown>	DEFAULT	12
killer_pid_sentity	.symtab	0x3afa0	4	OBJECT	<unknown>	DEFAULT	12
killer_realpath	.symtab	0x3af98	4	OBJECT	<unknown>	DEFAULT	12
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x25274	124	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x1516c	1624	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x1cd18	2436	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x1dffc	48	FUNC	<unknown>	DEFAULT	2
mbrtowc	.symtab	0x24a8c	168	FUNC	<unknown>	DEFAULT	2
mbrtowc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbsnrtowcs	.symtab	0x24b3c	220	FUNC	<unknown>	DEFAULT	2
mbsnrtowcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbstate.5063	.symtab	0x3af84	8	OBJECT	<unknown>	DEFAULT	12
mbstate.5064	.symtab	0x3af8c	8	OBJECT	<unknown>	DEFAULT	12
memchr	.symtab	0x23678	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x1aae0	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x1a4fc	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x23b1c	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x23b3c	256	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1bb88	416	FUNC	<unknown>	DEFAULT	2
methods	.symtab	0x38450	4	OBJECT	<unknown>	DEFAULT	12
methods_len	.symtab	0x3844c	1	OBJECT	<unknown>	DEFAULT	12
mmap	.symtab	0x2088c	108	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x20900	104	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x20970	92	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x3833c	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x38354	24	OBJECT	<unknown>	DEFAULT	11
nan_inf_str.2499	.symtab	0x27e58	21	OBJECT	<unknown>	DEFAULT	4
nan_inf_str.6640	.symtab	0x27e48	11	OBJECT	<unknown>	DEFAULT	4
nanosleep	.symtab	0x20a30	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nil_string	.symtab	0x26ce8	6	OBJECT	<unknown>	DEFAULT	4
object.4768	.symtab	0x38434	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x1fa04	132	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x17b4c	228	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.4751	.symtab	0x38220	0	OBJECT	<unknown>	DEFAULT	11
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pending_connection	.symtab	0x38458	1	OBJECT	<unknown>	DEFAULT	12
prefix.6476	.symtab	0x26cf8	12	OBJECT	<unknown>	DEFAULT	4
program_invocation_name	.symtab	0x38420	4	OBJECT	<unknown>	DEFAULT	11
program_invocation_short_name	.symtab	0x3841c	4	OBJECT	<unknown>	DEFAULT	11
qual_chars	.symtab	0x27e08	18	OBJECT	<unknown>	DEFAULT	4
qual_chars.6485	.symtab	0x26d10	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x1f728	264	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1e14c	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_init	.symtab	0x15814	80	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x157c4	80	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x15864	248	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1e164	108	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x279a8	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1e330	152	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x3836c	128	OBJECT	<unknown>	DEFAULT	11
read	.symtab	0x1fb0c	132	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x17ce8	184	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x20ce0	188	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1d7c8	916	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x1c988	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolve_cnc_addr	.symtab	0x14f00	68	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x38230	4	OBJECT	<unknown>	DEFAULT	11
rindex	.symtab	0x1bfa8	192	FUNC	<unknown>	DEFAULT	2
rsck	.symtab	0x3afb8	4	OBJECT	<unknown>	DEFAULT	12
rsck_out	.symtab	0x3afc0	4	OBJECT	<unknown>	DEFAULT	12
rt_sigaction	.symtab	0x20488	104	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x20a80	108	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sc_getc	.symtab	0x228cc	20	FUNC	<unknown>	DEFAULT	2
scan_getwc	.symtab	0x2201c	232	FUNC	<unknown>	DEFAULT	2
scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanner_kill	.symtab	0x1595c	28	FUNC	<unknown>	DEFAULT	2
scanner_pid	.symtab	0x3afbc	4	OBJECT	<unknown>	DEFAULT	12
select	.symtab	0x17834	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1c9e4	92	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x1ca40	96	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setjmp	.symtab	0x204f8	4	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x17890	80	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1caa0	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1e1d0	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1e5ac	276	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x20380	264	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x1caf8	72	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x1cb40	16	FUNC	<unknown>	DEFAULT	2
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x1cb58	168	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x178e8	172	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1f838	336	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x18180	48	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1cacc	36	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
spec_allowed	.symtab	0x27e28	16	OBJECT	<unknown>	DEFAULT	4
spec_and_mask.6484	.symtab	0x26d24	16	OBJECT	<unknown>	DEFAULT	4
spec_base	.symtab	0x27e38	15	OBJECT	<unknown>	DEFAULT	4
spec_base.6475	.symtab	0x26d08	7	OBJECT	<unknown>	DEFAULT	4
spec_chars	.symtab	0x27df0	23	OBJECT	<unknown>	DEFAULT	4
spec_chars.6481	.symtab	0x26d80	21	OBJECT	<unknown>	DEFAULT	4
spec_flags	.symtab	0x27de8	4	OBJECT	<unknown>	DEFAULT	4
spec_flags.6480	.symtab	0x26d98	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6483	.symtab	0x26d34	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges	.symtab	0x27e20	8	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6482	.symtab	0x26d48	9	OBJECT	<unknown>	DEFAULT	4
srand	.symtab	0x1e2c8	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x1e2c8	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x1e3c8	232	FUNC	<unknown>	DEFAULT	2
srv_addr	.symtab	0x3afa4	16	OBJECT	<unknown>	DEFAULT	12
sscanf	.symtab	0x19aa0	48	FUNC	<unknown>	DEFAULT	2
sscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x3aa44	512	OBJECT	<unknown>	DEFAULT	12
static_map	.symtab	0x3af4c	52	OBJECT	<unknown>	DEFAULT	12
static_slotinfo	.symtab	0x3ac44	776	OBJECT	<unknown>	DEFAULT	12
stderr	.symtab	0x38244	4	OBJECT	<unknown>	DEFAULT	11
stdin	.symtab	0x3823c	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x38240	4	OBJECT	<unknown>	DEFAULT	11
strchr	.symtab	0x1bd9c	524	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x23c3c	260	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x1c0fc	648	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1c0fc	648	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x237f8	804	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x23d40	60	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1c674	300	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1c3ec	120	FUNC	<unknown>	DEFAULT	2
strncmp	.symtab	0x1c464	244	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1c558	244	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1bfa8	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x23d7c	84	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1e6d8	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x1ed48	1140	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table	.symtab	0x3afc4	1208	OBJECT	<unknown>	DEFAULT	12
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x15ad0	4928	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x38234	4	OBJECT	<unknown>	DEFAULT	11
table_lock_val	.symtab	0x159a0	152	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x15978	40	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x15a38	152	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1c7c0	108	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x17994	40	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x20aec	40	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x26d52	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x26d70	12	OBJECT	<unknown>	DEFAULT	4
ungetc	.symtab	0x24c3c	480	FUNC	<unknown>	DEFAULT	2
ungetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1356	.symtab	0x26e20	14	OBJECT	<unknown>	DEFAULT	4
unlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unsafe_state	.symtab	0x383ec	20	OBJECT	<unknown>	DEFAULT	11
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x16f4c	376	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x1731c	264	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x170c4	132	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x16e94	44	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x16ee8	100	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x171f8	136	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x16e40	84	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x17148	176	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x16e10	48	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x17280	156	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x16ec0	40	FUNC	<unknown>	DEFAULT	2
vfscanf	.symtab	0x22104	1992	FUNC	<unknown>	DEFAULT	2
vfscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x181b0	164	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsscanf	.symtab	0x19ad0	112	FUNC	<unknown>	DEFAULT	2
vsscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x38468	4	OBJECT	<unknown>	DEFAULT	12
watchdog_maintain	.symtab	0x14f44	552	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x38454	4	OBJECT	<unknown>	DEFAULT	12
wcrtomb	.symtab	0x21190	76	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x21200	192	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x211dc	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x1fa88	132	FUNC	<unknown>	DEFAULT	2
x	.symtab	0x3845c	4	OBJECT	<unknown>	DEFAULT	12
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x38460	4	OBJECT	<unknown>	DEFAULT	12
z	.symtab	0x38464	4	OBJECT	<unknown>	DEFAULT	12

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 14:42:44.705682993 CET	47576	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:44.710737944 CET	3778	47576	79.133.46.252	192.168.2.23
Jan 5, 2025 14:42:44.710802078 CET	47576	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:44.741799116 CET	47576	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:44.746603966 CET	3778	47576	79.133.46.252	192.168.2.23
Jan 5, 2025 14:42:44.746648073 CET	47576	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:44.751471996 CET	3778	47576	79.133.46.252	192.168.2.23
Jan 5, 2025 14:42:46.396895885 CET	43928	443	192.168.2.23	91.189.91.42
Jan 5, 2025 14:42:50.260684967 CET	47578	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:50.265594959 CET	3778	47578	79.133.46.252	192.168.2.23
Jan 5, 2025 14:42:50.265682936 CET	47578	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:50.282519102 CET	47578	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:50.287297010 CET	3778	47578	79.133.46.252	192.168.2.23
Jan 5, 2025 14:42:50.287373066 CET	47578	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:50.292085886 CET	3778	47578	79.133.46.252	192.168.2.23
Jan 5, 2025 14:42:51.772176981 CET	42836	443	192.168.2.23	91.189.91.43
Jan 5, 2025 14:42:53.564032078 CET	42516	80	192.168.2.23	109.202.202.202
Jan 5, 2025 14:42:54.750637054 CET	47576	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:42:54.755640984 CET	3778	47576	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:00.291878939 CET	47578	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:00.296772003 CET	3778	47578	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:06.071011066 CET	3778	47576	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:06.071451902 CET	47576	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:06.076359987 CET	3778	47576	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:06.618216038 CET	43928	443	192.168.2.23	91.189.91.42
Jan 5, 2025 14:43:07.072967052 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:07.077860117 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:07.077908993 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:07.078480005 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:07.083292007 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:07.083336115 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:07.088141918 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:11.701603889 CET	3778	47578	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:11.702512026 CET	47578	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:11.707402945 CET	3778	47578	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:12.704787016 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:12.709803104 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:12.709916115 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:12.710797071 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:12.715668917 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:12.715728998 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:12.720560074 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:18.904381990 CET	42836	443	192.168.2.23	91.189.91.43
Jan 5, 2025 14:43:22.999811888 CET	42516	80	192.168.2.23	109.202.202.202
Jan 5, 2025 14:43:28.451045036 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:28.451320887 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:28.456547022 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:29.453394890 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:29.458878994 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:29.458970070 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:29.460016966 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:29.465528965 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:29.465605021 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:29.471678019 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:34.075253963 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:34.075553894 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:34.080348969 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:35.077399015 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:35.082355976 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:35.082417011 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:35.083379030 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:35.088239908 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:35.088283062 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:35.093034029 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:47.572514057 CET	43928	443	192.168.2.23	91.189.91.42
Jan 5, 2025 14:43:50.889717102 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:50.889949083 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:50.894747972 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:51.891571999 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:51.896433115 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:51.896553993 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:51.897124052 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:51.901897907 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:51.901961088 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:51.906707048 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:56.446763992 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:56.446991920 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:56.451894045 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:57.448920012 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:57.453763008 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:57.453860998 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:57.455106020 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:57.460033894 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 5, 2025 14:43:57.460093975 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:43:57.464860916 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:01.902434111 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:01.907361984 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:07.463835955 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:07.468693972 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:13.291524887 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:13.291785955 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:13.296569109 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:14.293001890 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:14.297903061 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:14.297954082 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:14.298531055 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:14.303272963 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:14.303319931 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:14.308098078 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:18.826051950 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:18.826250076 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:18.831192017 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:19.828102112 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:19.832988024 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:19.833045959 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:19.834254980 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:19.839013100 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:19.839059114 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:19.843883991 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:41.232589960 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:41.232929945 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:41.237723112 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:42.234884977 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:42.239759922 CET	3778	47596	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:42.239823103 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:42.240719080 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:42.245446920 CET	3778	47596	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:42.245496035 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:42.250257969 CET	3778	47596	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:44.303065062 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:44.303215027 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:44.308088064 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:45.304425001 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:45.309314013 CET	3778	47598	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:45.309370995 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:45.309948921 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:45.314732075 CET	3778	47598	79.133.46.252	192.168.2.23
Jan 5, 2025 14:44:45.314771891 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 5, 2025 14:44:45.319581985 CET	3778	47598	79.133.46.252	192.168.2.23

System Behavior

Analysis Process: dash PID: 6206, Parent PID: 4332

General

Start time (UTC):	13:42:40
Start date (UTC):	05/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6206, Parent PID: 4332

General

Start time (UTC):	13:42:40
Start date (UTC):	05/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.gcHM11sS17 /tmp/tmp.2Fn5jPrdbI /tmp/tmp.x8KYsQekzN
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6207, Parent PID: 4332

General

Start time (UTC):	13:42:40
Start date (UTC):	05/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6207, Parent PID: 4332

General

Start time (UTC):	13:42:40
Start date (UTC):	05/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.gcHM11sS17 /tmp/tmp.2Fn5jPrdbI /tmp/tmp.x8KYsQekzN
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: Space.spc.elf PID: 6233, Parent PID: 6126

General

Start time (UTC):	13:42:43
Start date (UTC):	05/01/2025
Path:	/tmp/Space.spc.elf
Arguments:	/tmp/Space.spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 6235, Parent PID: 6233

General

Start time (UTC):	13:42:43
Start date (UTC):	05/01/2025
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 6237, Parent PID: 6235

General

Start time (UTC):	13:42:43
Start date (UTC):	05/01/2025
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 6238, Parent PID: 6235

General

Start time (UTC):	13:42:43
Start date (UTC):	05/01/2025
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 6243, Parent PID: 6233

General

Start time (UTC):	13:42:48
Start date (UTC):	05/01/2025
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Space.spc.elf PID: 6244, Parent PID: 6233

General

Start time (UTC):	13:42:48
Start date (UTC):	05/01/2025
Path:	/tmp/Space.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6206, Parent PID: 4332

General

Chronological Activities

Analysis Process: rm PID: 6206, Parent PID: 4332

General

Chronological Activities

Analysis Process: dash PID: 6207, Parent PID: 4332

General

Chronological Activities

Analysis Process: rm PID: 6207, Parent PID: 4332

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 6233, Parent PID: 6126

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 6235, Parent PID: 6233

General

Chronological Activities

Analysis Process: Space.spc.elf PID: 6237, Parent PID: 6235

Linux Analysis Report
Space.spc.elf