Edit tour

Linux Analysis Report
mippytippy.elf

Overview

General Information

Sample name:	mippytippy.elf
Analysis ID:	1586276
MD5:	2100ce69b057d85fc3eae4d9e1f1fd1b
SHA1:	0678a71a36a0b1e9673713db060151179256d87f
SHA256:	a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Suricata IDS alerts with low severity for network traffic

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586276
Start date and time:	2025-01-08 23:57:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mippytippy.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/1@0/0

Runtime Messages

Command:	/tmp/mippytippy.elf
PID:	6245
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

mippytippy.elf (PID: 6245, Parent: 6161, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mippytippy.elf

mippytippy.elf New Fork (PID: 6254, Parent: 6245)

mippytippy.elf New Fork (PID: 6256, Parent: 6245)

mippytippy.elf New Fork (PID: 6258, Parent: 6256)

gnome-session-binary New Fork (PID: 6247, Parent: 1477)

sh (PID: 6247, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6247, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mippytippy.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
mippytippy.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
mippytippy.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2e43d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e451:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e465:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e479:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e48d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e505:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e519:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e52d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e541:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e555:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e569:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e57d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e591:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
mippytippy.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2e3f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x39f8c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6254.1.00007f5160400000.00007f516043c000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6254.1.00007f5160400000.00007f516043c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6254.1.00007f5160400000.00007f516043c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2e43d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e451:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e465:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e479:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e48d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e505:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e519:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e52d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e541:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e555:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e569:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e57d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e591:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6245.1.00007f5160400000.00007f516043c000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6256.1.00007f5160400000.00007f516043c000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6256.1.00007f5160400000.00007f516043c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6245.1.00007f5160400000.00007f516043c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6245.1.00007f5160400000.00007f516043c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2e43d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e451:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e465:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e479:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e48d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e505:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e519:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e52d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e541:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e555:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e569:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e57d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e591:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6245.1.00007f5160400000.00007f516043c000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2e3f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x39f8c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6256.1.00007f5160400000.00007f516043c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2e43d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e451:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e465:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e479:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e48d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e4f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e505:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e519:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e52d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e541:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e555:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e569:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e57d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e591:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6256.1.00007f5160400000.00007f516043c000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2e3f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x39f8c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6254.1.00007f5160400000.00007f516043c000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2e3f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x39f8c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: mippytippy.elf PID: 6245	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: mippytippy.elf PID: 6245	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a273:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a287:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a29b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a33b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a34f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a38b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a39f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: mippytippy.elf PID: 6245	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a226:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x2a22a:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3df23:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: mippytippy.elf PID: 6254	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: mippytippy.elf PID: 6254	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16946:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1695a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1696e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16982:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16996:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16aae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ad6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: mippytippy.elf PID: 6254	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x168f9:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x268fd:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3a5f6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: mippytippy.elf PID: 6256	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: mippytippy.elf PID: 6256	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1aada:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aba2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: mippytippy.elf PID: 6256	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1aa8d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x2aa91:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3e78a:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 16 entries

Suricata Signatures

ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T23:57:56.280184+0100	2848448	1	A Network Trojan was detected	192.168.2.23	52408	154.216.20.70	6478	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mippytippy.elf

Avira: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/mippytippy.elf (PID: 6245)

Opens: /proc/net/route

Jump to behavior

Source: mippytippy.elf

String: shps902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfsoraSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismDeportedXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAmnesiaOwariUnHAnaAWz3hirobbomiorieagledoxxRollielessie.hax.yakuzawordminerminerwordSinixV4hohog0dbu7tuorphicfurasshuhorizonassailantAresKawaiihelperECHOBOTDEMONSkalonJoshodaddyscumakira.akHilixdakuTsunamiestellaSolarrift_-255.NetCayosinOkamiKoshabushidotrojanshiinaReaper.Corona.wrgnuwrijoBOXOFABOXAkaHarioragefibregalilstresserpwstresser.pwcatnetTheCowSaysGoodByedistrubter22269reportbacktelportzyad1234stresser.suTohrujeffspenderbotnetOmnihamlogmirailoversxlk.busyboxxxbusyboxxkawaiiFrostisxj472szHU6FIZTQUPFF1500RGplzjustfuckoffnvitpjelfLoadAmakanotokupdatercum-n-gooblivionVoltages

Source: global traffic	TCP traffic: 192.168.2.23:43922 -> 66.59.198.122:7733
Source: global traffic	TCP traffic: 192.168.2.23:52408 -> 154.216.20.70:6478

Source: Network traffic

Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.23:52408 -> 154.216.20.70:6478

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: mippytippy.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: mippytippy.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: mippytippy.elf PID: 6245, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mippytippy.elf PID: 6245, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: mippytippy.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mippytippy.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: mippytippy.elf PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mippytippy.elf PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attacks_vector_wabba_jack
Source: ELF static info symbol of initial sample	Name: vseattack

Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: shps902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfsoraSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismDeportedXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer

Source: /tmp/mippytippy.elf (PID: 6245)	SIGKILL sent: pid: 1638, result: successful			Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: successful			Jump to behavior

Source: mippytippy.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: mippytippy.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: mippytippy.elf PID: 6245, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mippytippy.elf PID: 6245, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: mippytippy.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mippytippy.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: mippytippy.elf PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mippytippy.elf PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.spre.troj.linELF@0/1@0/0

Source: mippytippy.elf	ELF static info symbol of initial sample: libc/string/mips/memcpy.S
Source: mippytippy.elf	ELF static info symbol of initial sample: libc/string/mips/memset.S
Source: mippytippy.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
Source: mippytippy.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
Source: mippytippy.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
Source: mippytippy.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/pipe.S

Source: /tmp/mippytippy.elf (PID: 6245)	Directory: /tmp/.	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	Directory: /tmp/..	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	Directory: /tmp/.	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	Directory: /tmp/..	Jump to behavior

Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/mippytippy.elf (PID: 6245)	File opened: /proc/125/cmdline	Jump to behavior

Source: /tmp/mippytippy.elf (PID: 6245)

Queries kernel information via 'uname':

Jump to behavior

Source: mippytippy.elf, 6245.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.kdPUeo\4
Source: mippytippy.elf, 6245.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp, mippytippy.elf, 6254.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp, mippytippy.elf, 6256.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp	Binary or memory string: 2x86_64/usr/bin/qemu-mips/tmp/mippytippy.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mippytippy.elf
Source: mippytippy.elf, 6245.1.000055aa80af4000.000055aa80b9c000.rw-.sdmp, mippytippy.elf, 6254.1.000055aa80af4000.000055aa80b9c000.rw-.sdmp, mippytippy.elf, 6256.1.000055aa80af4000.000055aa80b9c000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: mippytippy.elf, 6245.1.000055aa80af4000.000055aa80b9c000.rw-.sdmp, mippytippy.elf, 6254.1.000055aa80af4000.000055aa80b9c000.rw-.sdmp, mippytippy.elf, 6256.1.000055aa80af4000.000055aa80b9c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: mippytippy.elf, 6245.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp, mippytippy.elf, 6254.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp, mippytippy.elf, 6256.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: mippytippy.elf, 6245.1.00007ffc38359000.00007ffc3837a000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.kdPUeo

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: mippytippy.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: mippytippy.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mippytippy.elf PID: 6245, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mippytippy.elf PID: 6254, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mippytippy.elf PID: 6256, type: MEMORYSTR

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: mippytippy.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: mippytippy.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.00007f5160400000.00007f516043c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mippytippy.elf PID: 6245, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mippytippy.elf PID: 6254, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mippytippy.elf PID: 6256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mippytippy.elf	100%	Avira	LINUX/Mirai.Gafgyt.

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.216.20.70	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
66.59.198.122	unknown	Reserved	17184	ATL-CBEYONDUS	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	arm5.elf	Get hash	malicious	Mirai	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	fenty.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse
	Kloki.arm7.elf	Get hash	malicious	Unknown	Browse
	Kloki.arm6.elf	Get hash	malicious	Unknown	Browse
	dlr.mips.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	arm5.elf	Get hash	malicious	Mirai	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	fenty.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse
	Kloki.arm7.elf	Get hash	malicious	Unknown	Browse
	Kloki.arm6.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATL-CBEYONDUS	armv7l.elf	Get hash	malicious	Unknown	Browse	173.200.178.217
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	72.54.140.80
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	72.16.202.25
	armv5l.elf	Get hash	malicious	Mirai	Browse	69.199.235.231
	armv4l.elf	Get hash	malicious	Mirai	Browse	69.198.187.233
	nabarm5.elf	Get hash	malicious	Unknown	Browse	69.199.34.183
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	69.199.45.224
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	50.21.114.195
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	69.15.59.107
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	216.192.135.159
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	gompsl.elf	Get hash	malicious	Mirai	Browse	156.254.70.172
	garm.elf	Get hash	malicious	Mirai	Browse	156.241.11.50
	earm5.elf	Get hash	malicious	Mirai	Browse	156.254.70.166
	emips.elf	Get hash	malicious	Mirai	Browse	156.226.9.162
	LayyB0R.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.20.162
	aNfqvgu.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.20.162
	miori.x86.elf	Get hash	malicious	Unknown	Browse	45.207.240.67
	Jeffparish.docx	Get hash	malicious	Unknown	Browse	154.216.17.193
	wind.m68k.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.sh4.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
CANONICAL-ASGB	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Kloki.arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fenty.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Kloki.arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Kloki.arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

Process:	/tmp/mippytippy.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.5770822074461766
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mippytippy.elf
File size:	290'917 bytes
MD5:	2100ce69b057d85fc3eae4d9e1f1fd1b
SHA1:	0678a71a36a0b1e9673713db060151179256d87f
SHA256:	a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38
SHA512:	843d69b3461d3c6d2b4426e230e9863a7351ef83a182f82a0c30e16337b8ed7c92e04ca56cbf90a0fa270433ee7cdec2b0a924d569e9ebcad5eb4f4a92274c21
SSDEEP:	3072:7BAsIgkocwgzd0GOoUr3Ixla8MBTObtF43WwNIZR6gwpUEMTQllq+l9ydILwcC6X:7YUe1wdmQi3mIPTBJGXbXi+Nx
TLSH:	B25452397D26E32AD0A6EEB49BF57EA1C758B6C31B818343E1A8915C0DF055D284FDC8
File Content Preview:	.ELF.....................@.....4...(.....4. ...(....p........@...@...........................@...@...........................G...G........}.........dt.Q.................................................HQ.<...'.Q....!'.......................<...'.P....!...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4002a0
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	265512
Section Header Size:	40
Number of Section Headers:	21
Header String Table Index:	18

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.reginfo	MIPS_REGINFO	0x4000b4	0xb4	0x18	0x18	0x2	A	0	0	4
.init	PROGBITS	0x4000cc	0xcc	0x8c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x400160	0x160	0x1ecc0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x41ee20	0x1ee20	0x5c	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x41ee80	0x1ee80	0x1ccfc	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x43bb7c	0x3bb7c	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x47c000	0x3c000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x47c008	0x3c008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x47c010	0x3c010	0x4	0x0	0x3	WA	0	0	4
.data.rel.ro	PROGBITS	0x47c014	0x3c014	0x4d4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x47c4f0	0x3c4f0	0xcf0	0x0	0x3	WA	0	0	16
.got	PROGBITS	0x47d1e0	0x3d1e0	0x600	0x4	0x10000003	WAp	0	0	16
.sbss	NOBITS	0x47d7e0	0x3d7e0	0x30	0x0	0x10000003	WAp	0	0	4
.bss	NOBITS	0x47d810	0x3d7e0	0x6570	0x0	0x3	WA	0	0	16
.comment	PROGBITS	0x0	0x3d7e0	0xd4a	0x0	0x0		0	0	1
.mdebug.abi32	PROGBITS	0xd4a	0x3e52a	0x0	0x0	0x0		0	0	1
.pdr	PROGBITS	0x0	0x3e52c	0x2760	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x40c8c	0x9a	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x41070	0x3730	0x10	0x0		20	367	4
.strtab	STRTAB	0x0	0x447a0	0x28c5	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
<unknown>	0xb4	0x4000b4	0x4000b4	0x18	0x18	0.9834	0x4	R	0x4	.reginfo
LOAD	0x0	0x400000	0x400000	0x3bb80	0x3bb80	5.5251	0x5	R E	0x10000	.reginfo .init .text .fini .rodata .eh_frame
LOAD	0x3c000	0x47c000	0x47c000	0x17e0	0x7d80	4.7812	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x4000cc	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x400160	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x41ee20	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x41ee80	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x43bb7c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x47c000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x47c008	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x47c010	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x47c014	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x47c4f0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x47d1e0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x47d7e0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x47d810	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0xd4a	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
C.172.5856	.symtab	0x47c014	48	OBJECT	<unknown>	DEFAULT	10
C.187.5979	.symtab	0x47c044	44	OBJECT	<unknown>	DEFAULT	10
C.192.6027	.symtab	0x47c070	32	OBJECT	<unknown>	DEFAULT	10
C.196.6063	.symtab	0x47c090	8	OBJECT	<unknown>	DEFAULT	10
C.200.6099	.symtab	0x47c098	12	OBJECT	<unknown>	DEFAULT	10
C.204.6136	.symtab	0x47c0a4	24	OBJECT	<unknown>	DEFAULT	10
C.208.6170	.symtab	0x47c0bc	1024	OBJECT	<unknown>	DEFAULT	10
C.212.6216	.symtab	0x47c4bc	16	OBJECT	<unknown>	DEFAULT	10
C.217.6264	.symtab	0x47c4cc	12	OBJECT	<unknown>	DEFAULT	10
C.222.6305	.symtab	0x47c4d8	16	OBJECT	<unknown>	DEFAULT	10
KHcommSOCK	.symtab	0x47d830	4	OBJECT	<unknown>	DEFAULT	14
KHserverHACKER	.symtab	0x47cdb4	4	OBJECT	<unknown>	DEFAULT	11
KillStructure	.symtab	0x47c528	2012	OBJECT	<unknown>	DEFAULT	11
LOCAL_ADDR	.symtab	0x47d7e0	4	OBJECT	<unknown>	DEFAULT	13
Q	.symtab	0x47d84c	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0x408a6c	604	FUNC	<unknown>	DEFAULT	3
Send100UP	.symtab	0x408820	588	FUNC	<unknown>	DEFAULT	3
SendBINARY	.symtab	0x408cc8	844	FUNC	<unknown>	DEFAULT	3
SendKPAC	.symtab	0x408550	720	FUNC	<unknown>	DEFAULT	3
SendOnePacket	.symtab	0x408334	540	FUNC	<unknown>	DEFAULT	3
SendRAPE	.symtab	0x409014	896	FUNC	<unknown>	DEFAULT	3
SendSTDHEX	.symtab	0x409394	568	FUNC	<unknown>	DEFAULT	3
SendUDPBYPASS	.symtab	0x4077e4	596	FUNC	<unknown>	DEFAULT	3
WalmartBag	.symtab	0x408014	800	FUNC	<unknown>	DEFAULT	3
_GLOBAL_OFFSET_TABLE_	.symtab	0x47d1e0	0	OBJECT	<unknown>	DEFAULT	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x47c004	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x47c000	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x47cde0	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x43a3a0	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_tolower	.symtab	0x47d1a0	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x43b750	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_toupper	.symtab	0x47cdf0	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x43a6a0	768	OBJECT	<unknown>	DEFAULT	5
__DTOR_END__	.symtab	0x47c00c	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x47c008	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x43bb7c	0	OBJECT	<unknown>	DEFAULT	6
__FRAME_END__	.symtab	0x43bb7c	0	OBJECT	<unknown>	DEFAULT	6
__GI___C_ctype_b	.symtab	0x47cde0	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_b_data	.symtab	0x43a3a0	768	OBJECT	<unknown>	HIDDEN	5
__GI___C_ctype_tolower	.symtab	0x47d1a0	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_tolower_data	.symtab	0x43b750	768	OBJECT	<unknown>	HIDDEN	5
__GI___C_ctype_toupper	.symtab	0x47cdf0	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_toupper_data	.symtab	0x43a6a0	768	OBJECT	<unknown>	HIDDEN	5
__GI___ctype_b	.symtab	0x47cde4	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_tolower	.symtab	0x47d1a4	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_toupper	.symtab	0x47cdf4	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x413300	24	FUNC	<unknown>	HIDDEN	3
__GI___fgetc_unlocked	.symtab	0x41c090	388	FUNC	<unknown>	HIDDEN	3
__GI___glibc_strerror_r	.symtab	0x416030	68	FUNC	<unknown>	HIDDEN	3
__GI___h_errno_location	.symtab	0x41af40	24	FUNC	<unknown>	HIDDEN	3
__GI___libc_fcntl	.symtab	0x412520	136	FUNC	<unknown>	HIDDEN	3
__GI___libc_fcntl64	.symtab	0x4125b0	104	FUNC	<unknown>	HIDDEN	3
__GI___libc_open	.symtab	0x412af0	124	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_fini	.symtab	0x419ec0	196	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_init	.symtab	0x41a01c	140	FUNC	<unknown>	HIDDEN	3
__GI___xpg_strerror_r	.symtab	0x416080	392	FUNC	<unknown>	HIDDEN	3
__GI__exit	.symtab	0x412620	80	FUNC	<unknown>	HIDDEN	3
__GI_abort	.symtab	0x418c10	428	FUNC	<unknown>	HIDDEN	3
__GI_atoi	.symtab	0x4197a0	28	FUNC	<unknown>	HIDDEN	3
__GI_atol	.symtab	0x4197a0	28	FUNC	<unknown>	HIDDEN	3
__GI_bind	.symtab	0x417c30	84	FUNC	<unknown>	HIDDEN	3
__GI_brk	.symtab	0x41d8b0	112	FUNC	<unknown>	HIDDEN	3
__GI_close	.symtab	0x4126d0	84	FUNC	<unknown>	HIDDEN	3
__GI_closedir	.symtab	0x412f30	292	FUNC	<unknown>	HIDDEN	3
__GI_connect	.symtab	0x417c90	84	FUNC	<unknown>	HIDDEN	3
__GI_dup2	.symtab	0x412730	84	FUNC	<unknown>	HIDDEN	3
__GI_endprotoent	.symtab	0x4167d4	176	FUNC	<unknown>	HIDDEN	3
__GI_errno	.symtab	0x483af0	4	OBJECT	<unknown>	HIDDEN	14
__GI_execl	.symtab	0x419b20	204	FUNC	<unknown>	HIDDEN	3
__GI_execve	.symtab	0x41a5b0	84	FUNC	<unknown>	HIDDEN	3
__GI_exit	.symtab	0x419a30	236	FUNC	<unknown>	HIDDEN	3
__GI_fclose	.symtab	0x413390	512	FUNC	<unknown>	HIDDEN	3
__GI_fcntl	.symtab	0x412520	136	FUNC	<unknown>	HIDDEN	3
__GI_fcntl64	.symtab	0x4125b0	104	FUNC	<unknown>	HIDDEN	3
__GI_fflush_unlocked	.symtab	0x415450	628	FUNC	<unknown>	HIDDEN	3
__GI_fgetc_unlocked	.symtab	0x41c090	388	FUNC	<unknown>	HIDDEN	3
__GI_fgets	.symtab	0x4151e0	216	FUNC	<unknown>	HIDDEN	3
__GI_fgets_unlocked	.symtab	0x4156d0	268	FUNC	<unknown>	HIDDEN	3
__GI_fopen	.symtab	0x413590	28	FUNC	<unknown>	HIDDEN	3
__GI_fork	.symtab	0x412790	84	FUNC	<unknown>	HIDDEN	3
__GI_fprintf	.symtab	0x413610	72	FUNC	<unknown>	HIDDEN	3
__GI_fputs_unlocked	.symtab	0x4157e0	128	FUNC	<unknown>	HIDDEN	3
__GI_fseek	.symtab	0x41d980	68	FUNC	<unknown>	HIDDEN	3
__GI_fseeko64	.symtab	0x41d9d0	388	FUNC	<unknown>	HIDDEN	3
__GI_fstat	.symtab	0x41a610	140	FUNC	<unknown>	HIDDEN	3
__GI_fwrite_unlocked	.symtab	0x415860	280	FUNC	<unknown>	HIDDEN	3
__GI_getc_unlocked	.symtab	0x41c090	388	FUNC	<unknown>	HIDDEN	3
__GI_getdtablesize	.symtab	0x4127f0	72	FUNC	<unknown>	HIDDEN	3
__GI_getegid	.symtab	0x41a940	88	FUNC	<unknown>	HIDDEN	3
__GI_geteuid	.symtab	0x412840	88	FUNC	<unknown>	HIDDEN	3
__GI_getgid	.symtab	0x41a9a0	84	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname	.symtab	0x417750	116	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname_r	.symtab	0x4177d0	1108	FUNC	<unknown>	HIDDEN	3
__GI_getpid	.symtab	0x4128a0	84	FUNC	<unknown>	HIDDEN	3
__GI_getprotobyname_r	.symtab	0x416b2c	408	FUNC	<unknown>	HIDDEN	3
__GI_getprotobynumber_r	.symtab	0x41696c	332	FUNC	<unknown>	HIDDEN	3
__GI_getprotoent_r	.symtab	0x416490	732	FUNC	<unknown>	HIDDEN	3
__GI_getrlimit	.symtab	0x412960	84	FUNC	<unknown>	HIDDEN	3
__GI_getsockname	.symtab	0x417cf0	84	FUNC	<unknown>	HIDDEN	3
__GI_gettimeofday	.symtab	0x4129c0	84	FUNC	<unknown>	HIDDEN	3
__GI_getuid	.symtab	0x41aa00	84	FUNC	<unknown>	HIDDEN	3
__GI_h_errno	.symtab	0x483af4	4	OBJECT	<unknown>	HIDDEN	14
__GI_inet_addr	.symtab	0x417700	72	FUNC	<unknown>	HIDDEN	3
__GI_inet_aton	.symtab	0x41c8d0	244	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa	.symtab	0x4176dc	32	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa_r	.symtab	0x417640	156	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntop	.symtab	0x4172e0	852	FUNC	<unknown>	HIDDEN	3
__GI_inet_pton	.symtab	0x416e30	700	FUNC	<unknown>	HIDDEN	3
__GI_initstate_r	.symtab	0x419410	328	FUNC	<unknown>	HIDDEN	3
__GI_ioctl	.symtab	0x412a20	104	FUNC	<unknown>	HIDDEN	3
__GI_isatty	.symtab	0x416310	60	FUNC	<unknown>	HIDDEN	3
__GI_kill	.symtab	0x412a90	88	FUNC	<unknown>	HIDDEN	3
__GI_lseek64	.symtab	0x41aa60	168	FUNC	<unknown>	HIDDEN	3
__GI_memchr	.symtab	0x41c220	264	FUNC	<unknown>	HIDDEN	3
__GI_memcpy	.symtab	0x415980	308	FUNC	<unknown>	HIDDEN	3
__GI_memmove	.symtab	0x41c330	816	FUNC	<unknown>	HIDDEN	3
__GI_mempcpy	.symtab	0x41c660	76	FUNC	<unknown>	HIDDEN	3
__GI_memrchr	.symtab	0x41c6b0	272	FUNC	<unknown>	HIDDEN	3
__GI_memset	.symtab	0x415ac0	144	FUNC	<unknown>	HIDDEN	3
__GI_nanosleep	.symtab	0x41ab10	84	FUNC	<unknown>	HIDDEN	3
__GI_open	.symtab	0x412af0	124	FUNC	<unknown>	HIDDEN	3
__GI_opendir	.symtab	0x413060	408	FUNC	<unknown>	HIDDEN	3
__GI_perror	.symtab	0x4135b0	84	FUNC	<unknown>	HIDDEN	3
__GI_pipe	.symtab	0x4124e0	64	FUNC	<unknown>	HIDDEN	3
__GI_poll	.symtab	0x41d920	84	FUNC	<unknown>	HIDDEN	3
__GI_raise	.symtab	0x41d830	76	FUNC	<unknown>	HIDDEN	3
__GI_random	.symtab	0x418de0	164	FUNC	<unknown>	HIDDEN	3
__GI_random_r	.symtab	0x4191ec	176	FUNC	<unknown>	HIDDEN	3
__GI_rawmemchr	.symtab	0x41df00	200	FUNC	<unknown>	HIDDEN	3
__GI_read	.symtab	0x412c10	84	FUNC	<unknown>	HIDDEN	3
__GI_readdir	.symtab	0x413200	256	FUNC	<unknown>	HIDDEN	3
__GI_readlink	.symtab	0x412c70	84	FUNC	<unknown>	HIDDEN	3
__GI_recv	.symtab	0x417dd0	84	FUNC	<unknown>	HIDDEN	3
__GI_recvfrom	.symtab	0x417e30	128	FUNC	<unknown>	HIDDEN	3
__GI_rewind	.symtab	0x41b100	192	FUNC	<unknown>	HIDDEN	3
__GI_sbrk	.symtab	0x41ab70	144	FUNC	<unknown>	HIDDEN	3
__GI_select	.symtab	0x412cd0	120	FUNC	<unknown>	HIDDEN	3
__GI_send	.symtab	0x417eb0	84	FUNC	<unknown>	HIDDEN	3
__GI_sendto	.symtab	0x417f10	128	FUNC	<unknown>	HIDDEN	3
__GI_setprotoent	.symtab	0x416884	232	FUNC	<unknown>	HIDDEN	3
__GI_setsockopt	.symtab	0x417f90	120	FUNC	<unknown>	HIDDEN	3
__GI_setstate_r	.symtab	0x4190b0	316	FUNC	<unknown>	HIDDEN	3
__GI_sigaction	.symtab	0x41a460	232	FUNC	<unknown>	HIDDEN	3
__GI_sigaddset	.symtab	0x418070	104	FUNC	<unknown>	HIDDEN	3
__GI_sigemptyset	.symtab	0x4180e0	60	FUNC	<unknown>	HIDDEN	3
__GI_signal	.symtab	0x418120	252	FUNC	<unknown>	HIDDEN	3
__GI_sigprocmask	.symtab	0x412d50	148	FUNC	<unknown>	HIDDEN	3
__GI_sleep	.symtab	0x419bf0	564	FUNC	<unknown>	HIDDEN	3
__GI_snprintf	.symtab	0x413660	68	FUNC	<unknown>	HIDDEN	3
__GI_socket	.symtab	0x418010	84	FUNC	<unknown>	HIDDEN	3
__GI_sprintf	.symtab	0x4136b0	80	FUNC	<unknown>	HIDDEN	3
__GI_srandom_r	.symtab	0x41929c	372	FUNC	<unknown>	HIDDEN	3
__GI_strcasecmp	.symtab	0x41ea70	108	FUNC	<unknown>	HIDDEN	3
__GI_strcasestr	.symtab	0x416250	152	FUNC	<unknown>	HIDDEN	3
__GI_strchr	.symtab	0x415b50	256	FUNC	<unknown>	HIDDEN	3
__GI_strcmp	.symtab	0x415c50	44	FUNC	<unknown>	HIDDEN	3
__GI_strcoll	.symtab	0x415c50	44	FUNC	<unknown>	HIDDEN	3
__GI_strcpy	.symtab	0x415c80	36	FUNC	<unknown>	HIDDEN	3
__GI_strdup	.symtab	0x41e0e0	144	FUNC	<unknown>	HIDDEN	3
__GI_strlen	.symtab	0x415cb0	184	FUNC	<unknown>	HIDDEN	3
__GI_strncat	.symtab	0x41dfd0	180	FUNC	<unknown>	HIDDEN	3
__GI_strncpy	.symtab	0x415d70	188	FUNC	<unknown>	HIDDEN	3
__GI_strnlen	.symtab	0x415e30	256	FUNC	<unknown>	HIDDEN	3
__GI_strpbrk	.symtab	0x41c890	64	FUNC	<unknown>	HIDDEN	3
__GI_strspn	.symtab	0x41e090	76	FUNC	<unknown>	HIDDEN	3
__GI_strstr	.symtab	0x415f30	256	FUNC	<unknown>	HIDDEN	3
__GI_strtok	.symtab	0x4162f0	32	FUNC	<unknown>	HIDDEN	3
__GI_strtok_r	.symtab	0x41c7c0	204	FUNC	<unknown>	HIDDEN	3
__GI_strtol	.symtab	0x4197c0	28	FUNC	<unknown>	HIDDEN	3
__GI_tcgetattr	.symtab	0x416350	176	FUNC	<unknown>	HIDDEN	3
__GI_time	.symtab	0x412df0	84	FUNC	<unknown>	HIDDEN	3
__GI_times	.symtab	0x41ac00	84	FUNC	<unknown>	HIDDEN	3
__GI_tolower	.symtab	0x41af00	60	FUNC	<unknown>	HIDDEN	3
__GI_toupper	.symtab	0x412ef0	60	FUNC	<unknown>	HIDDEN	3
__GI_vfork	.symtab	0x412e50	28	FUNC	<unknown>	HIDDEN	3
__GI_vfprintf	.symtab	0x413df0	260	FUNC	<unknown>	HIDDEN	3
__GI_vsnprintf	.symtab	0x413700	260	FUNC	<unknown>	HIDDEN	3
__GI_wait4	.symtab	0x41ac60	88	FUNC	<unknown>	HIDDEN	3
__GI_waitpid	.symtab	0x412e70	28	FUNC	<unknown>	HIDDEN	3
__GI_wcrtomb	.symtab	0x41af60	112	FUNC	<unknown>	HIDDEN	3
__GI_wcsnrtombs	.symtab	0x41b010	228	FUNC	<unknown>	HIDDEN	3
__GI_wcsrtombs	.symtab	0x41afd0	64	FUNC	<unknown>	HIDDEN	3
__GI_write	.symtab	0x412e90	84	FUNC	<unknown>	HIDDEN	3
__JCR_END__	.symtab	0x47c010	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x47c010	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x483adc	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x47d170	24	OBJECT	<unknown>	DEFAULT	11
__bsd_signal	.symtab	0x418120	252	FUNC	<unknown>	HIDDEN	3
__bss_start	.symtab	0x47d7e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x419f94	136	FUNC	<unknown>	DEFAULT	3
__ctype_b	.symtab	0x47cde4	4	OBJECT	<unknown>	DEFAULT	11
__ctype_tolower	.symtab	0x47d1a4	4	OBJECT	<unknown>	DEFAULT	11
__ctype_toupper	.symtab	0x47cdf4	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x483b20	4	OBJECT	<unknown>	HIDDEN	14
__data_start	.symtab	0x47c510	0	OBJECT	<unknown>	DEFAULT	11
__decode_answer	.symtab	0x41e470	340	FUNC	<unknown>	HIDDEN	3
__decode_dotted	.symtab	0x41ec00	340	FUNC	<unknown>	HIDDEN	3
__decode_header	.symtab	0x41e280	228	FUNC	<unknown>	HIDDEN	3
__deregister_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x41c9d0	2568	FUNC	<unknown>	HIDDEN	3
__do_global_ctors_aux	.symtab	0x41edb0	0	FUNC	<unknown>	DEFAULT	3
__do_global_dtors_aux	.symtab	0x400160	0	FUNC	<unknown>	DEFAULT	3
__dso_handle	.symtab	0x47c4f0	0	OBJECT	<unknown>	HIDDEN	11
__encode_dotted	.symtab	0x41eae0	280	FUNC	<unknown>	HIDDEN	3
__encode_header	.symtab	0x41e170	272	FUNC	<unknown>	HIDDEN	3
__encode_question	.symtab	0x41e370	172	FUNC	<unknown>	HIDDEN	3
__environ	.symtab	0x483ad4	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x413300	24	FUNC	<unknown>	DEFAULT	3
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x483ac0	4	OBJECT	<unknown>	HIDDEN	14
__fgetc_unlocked	.symtab	0x41c090	388	FUNC	<unknown>	DEFAULT	3
__fini_array_end	.symtab	0x47c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x47c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x41d7c0	104	FUNC	<unknown>	HIDDEN	3
__getdents	.symtab	0x41a6a0	200	FUNC	<unknown>	HIDDEN	3
__getdents64	.symtab	0x41a770	452	FUNC	<unknown>	HIDDEN	3
__glibc_strerror_r	.symtab	0x416030	68	FUNC	<unknown>	DEFAULT	3
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x41af40	24	FUNC	<unknown>	DEFAULT	3
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x4188d0	188	FUNC	<unknown>	DEFAULT	3
__heap_alloc_at	.symtab	0x418990	184	FUNC	<unknown>	DEFAULT	3
__heap_free	.symtab	0x418a98	364	FUNC	<unknown>	DEFAULT	3
__heap_link_free_area	.symtab	0x418a50	44	FUNC	<unknown>	DEFAULT	3
__heap_link_free_area_after	.symtab	0x418a7c	28	FUNC	<unknown>	DEFAULT	3
__init_array_end	.symtab	0x47c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x47c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x416420	112	FUNC	<unknown>	DEFAULT	3
__length_dotted	.symtab	0x41ed60	72	FUNC	<unknown>	HIDDEN	3
__length_question	.symtab	0x41e420	72	FUNC	<unknown>	HIDDEN	3
__libc_close	.symtab	0x4126d0	84	FUNC	<unknown>	DEFAULT	3
__libc_connect	.symtab	0x417c90	84	FUNC	<unknown>	DEFAULT	3
__libc_creat	.symtab	0x412b6c	28	FUNC	<unknown>	DEFAULT	3
__libc_fcntl	.symtab	0x412520	136	FUNC	<unknown>	DEFAULT	3
__libc_fcntl64	.symtab	0x4125b0	104	FUNC	<unknown>	DEFAULT	3
__libc_fork	.symtab	0x412790	84	FUNC	<unknown>	DEFAULT	3
__libc_getpid	.symtab	0x4128a0	84	FUNC	<unknown>	DEFAULT	3
__libc_lseek64	.symtab	0x41aa60	168	FUNC	<unknown>	DEFAULT	3
__libc_nanosleep	.symtab	0x41ab10	84	FUNC	<unknown>	DEFAULT	3
__libc_open	.symtab	0x412af0	124	FUNC	<unknown>	DEFAULT	3
__libc_poll	.symtab	0x41d920	84	FUNC	<unknown>	DEFAULT	3
__libc_read	.symtab	0x412c10	84	FUNC	<unknown>	DEFAULT	3
__libc_recv	.symtab	0x417dd0	84	FUNC	<unknown>	DEFAULT	3
__libc_recvfrom	.symtab	0x417e30	128	FUNC	<unknown>	DEFAULT	3
__libc_select	.symtab	0x412cd0	120	FUNC	<unknown>	DEFAULT	3
__libc_send	.symtab	0x417eb0	84	FUNC	<unknown>	DEFAULT	3
__libc_sendto	.symtab	0x417f10	128	FUNC	<unknown>	DEFAULT	3
__libc_sigaction	.symtab	0x41a460	232	FUNC	<unknown>	DEFAULT	3
__libc_stack_end	.symtab	0x483ad0	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x419560	568	FUNC	<unknown>	DEFAULT	3
__libc_waitpid	.symtab	0x412e70	28	FUNC	<unknown>	DEFAULT	3
__libc_write	.symtab	0x412e90	84	FUNC	<unknown>	DEFAULT	3
__malloc_heap	.symtab	0x47d080	4	OBJECT	<unknown>	DEFAULT	11
__malloc_heap_lock	.symtab	0x483a90	24	OBJECT	<unknown>	DEFAULT	14
__malloc_sbrk_lock	.symtab	0x483d4c	24	OBJECT	<unknown>	DEFAULT	14
__nameserver	.symtab	0x483d74	12	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x47d800	4	OBJECT	<unknown>	HIDDEN	13
__open_etc_hosts	.symtab	0x41e5d0	108	FUNC	<unknown>	HIDDEN	3
__open_nameservers	.symtab	0x41d3e0	984	FUNC	<unknown>	HIDDEN	3
__pagesize	.symtab	0x483ad8	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x47c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x47c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x419f84	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_lock	.symtab	0x419f84	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_trylock	.symtab	0x419f84	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_unlock	.symtab	0x419f84	8	FUNC	<unknown>	DEFAULT	3
__pthread_return_0	.symtab	0x419f84	8	FUNC	<unknown>	DEFAULT	3
__pthread_return_void	.symtab	0x419f8c	8	FUNC	<unknown>	DEFAULT	3
__raise	.symtab	0x41d830	76	FUNC	<unknown>	HIDDEN	3
__read_etc_hosts_r	.symtab	0x41e63c	1076	FUNC	<unknown>	HIDDEN	3
__register_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x47d1c0	24	OBJECT	<unknown>	DEFAULT	11
__rtld_fini	.symtab	0x483ae0	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x483d64	16	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x47d804	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x418248	44	FUNC	<unknown>	DEFAULT	3
__sigdelset	.symtab	0x418274	48	FUNC	<unknown>	DEFAULT	3
__sigismember	.symtab	0x418220	40	FUNC	<unknown>	DEFAULT	3
__start	.symtab	0x4002a0	100	FUNC	<unknown>	DEFAULT	3
__stdin	.symtab	0x47ce4c	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x41db60	140	FUNC	<unknown>	HIDDEN	3
__stdio_WRITE	.symtab	0x41b1c0	280	FUNC	<unknown>	HIDDEN	3
__stdio_adjust_position	.symtab	0x41dbf0	324	FUNC	<unknown>	HIDDEN	3
__stdio_fwrite	.symtab	0x41b2e0	472	FUNC	<unknown>	HIDDEN	3
__stdio_init_mutex	.symtab	0x413c38	32	FUNC	<unknown>	HIDDEN	3
__stdio_mutex_initializer.3833	.symtab	0x43a9b0	24	OBJECT	<unknown>	DEFAULT	5
__stdio_rfill	.symtab	0x41dd40	88	FUNC	<unknown>	HIDDEN	3
__stdio_seek	.symtab	0x41de90	112	FUNC	<unknown>	HIDDEN	3
__stdio_trans2r_o	.symtab	0x41dda0	228	FUNC	<unknown>	HIDDEN	3
__stdio_trans2w_o	.symtab	0x41b4c0	308	FUNC	<unknown>	HIDDEN	3
__stdio_wcommit	.symtab	0x413d80	100	FUNC	<unknown>	HIDDEN	3
__stdout	.symtab	0x47ce50	4	OBJECT	<unknown>	DEFAULT	11
__syscall_error	.symtab	0x41a410	72	FUNC	<unknown>	HIDDEN	3
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x41a550	84	FUNC	<unknown>	HIDDEN	3
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x419ec0	196	FUNC	<unknown>	DEFAULT	3
__uClibc_init	.symtab	0x41a01c	140	FUNC	<unknown>	DEFAULT	3
__uClibc_main	.symtab	0x41a0a8	864	FUNC	<unknown>	DEFAULT	3
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x47d190	4	OBJECT	<unknown>	HIDDEN	11
__vfork	.symtab	0x412e50	28	FUNC	<unknown>	HIDDEN	3
__xpg_strerror_r	.symtab	0x416080	392	FUNC	<unknown>	DEFAULT	3
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat64_conv	.symtab	0x41acc0	288	FUNC	<unknown>	HIDDEN	3
__xstat_conv	.symtab	0x41ade0	276	FUNC	<unknown>	HIDDEN	3
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x413f00	128	FUNC	<unknown>	DEFAULT	3
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x41d880	44	FUNC	<unknown>	DEFAULT	3
_dl_phdr	.symtab	0x47d808	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x47d80c	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x47d7e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x483d80	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x483af0	4	OBJECT	<unknown>	DEFAULT	14
_exit	.symtab	0x412620	80	FUNC	<unknown>	DEFAULT	3
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fbss	.symtab	0x47d7e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fdata	.symtab	0x47c4f0	0	NOTYPE	<unknown>	DEFAULT	11
_fini	.symtab	0x41ee20	28	FUNC	<unknown>	DEFAULT	4
_fixed_buffers	.symtab	0x481868	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x413f80	228	FUNC	<unknown>	DEFAULT	3
_fpmaxtostr	.symtab	0x41b840	2120	FUNC	<unknown>	HIDDEN	3
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ftext	.symtab	0x400160	0	NOTYPE	<unknown>	DEFAULT	3
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_gp	.symtab	0x4851d0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_gp_disp	.symtab	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_h_errno	.symtab	0x483af4	4	OBJECT	<unknown>	DEFAULT	14
_init	.symtab	0x4000cc	28	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x41b600	136	FUNC	<unknown>	HIDDEN	3
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x414810	220	FUNC	<unknown>	HIDDEN	3
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x414bec	1512	FUNC	<unknown>	HIDDEN	3
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x4148f0	100	FUNC	<unknown>	HIDDEN	3
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x414960	540	FUNC	<unknown>	HIDDEN	3
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x414b80	108	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_pop_restore	.symtab	0x419f8c	8	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_push_defer	.symtab	0x419f8c	8	FUNC	<unknown>	DEFAULT	3
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x483ccc	128	OBJECT	<unknown>	HIDDEN	14
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x413810	880	FUNC	<unknown>	HIDDEN	3
_stdio_init	.symtab	0x413b80	184	FUNC	<unknown>	HIDDEN	3
_stdio_openlist	.symtab	0x47ce54	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x47ce00	24	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_dec_use	.symtab	0x4152c0	400	FUNC	<unknown>	DEFAULT	3
_stdio_openlist_del_count	.symtab	0x481864	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x47ce18	24	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_use_count	.symtab	0x481860	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x47ce58	240	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x413c58	284	FUNC	<unknown>	HIDDEN	3
_stdio_user_locking	.symtab	0x47ce30	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l	.symtab	0x4197e0	592	FUNC	<unknown>	HIDDEN	3
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x41b690	68	FUNC	<unknown>	HIDDEN	3
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x43ab20	2934	OBJECT	<unknown>	HIDDEN	5
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x41b6e0	340	FUNC	<unknown>	HIDDEN	3
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x414064	1960	FUNC	<unknown>	HIDDEN	3
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x418c10	428	FUNC	<unknown>	DEFAULT	3
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x412670	84	FUNC	<unknown>	DEFAULT	3
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x40a5b0	372	FUNC	<unknown>	DEFAULT	3
add_entry	.symtab	0x410f14	200	FUNC	<unknown>	DEFAULT	3
atoi	.symtab	0x4197a0	28	FUNC	<unknown>	DEFAULT	3
atol	.symtab	0x4197a0	28	FUNC	<unknown>	DEFAULT	3
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attacks_vector_wabba_jack	.symtab	0x4060d4	1104	FUNC	<unknown>	DEFAULT	3
bcopy	.symtab	0x416210	32	FUNC	<unknown>	DEFAULT	3
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x483ab0	4	OBJECT	<unknown>	DEFAULT	14
been_there_done_that.2792	.symtab	0x483ae4	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x417c30	84	FUNC	<unknown>	DEFAULT	3
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacklist	.symtab	0x47cd04	116	OBJECT	<unknown>	DEFAULT	11
brk	.symtab	0x41d8b0	112	FUNC	<unknown>	DEFAULT	3
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x418120	252	FUNC	<unknown>	DEFAULT	3
buf.2601	.symtab	0x4838a0	16	OBJECT	<unknown>	DEFAULT	14
buf.4833	.symtab	0x4838b0	460	OBJECT	<unknown>	DEFAULT	14
bzero	.symtab	0x416230	28	FUNC	<unknown>	DEFAULT	3
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x47cdbc	4	OBJECT	<unknown>	DEFAULT	11
cal_chksum	.symtab	0x405c44	336	FUNC	<unknown>	DEFAULT	3
calloc	.symtab	0x4184a0	180	FUNC	<unknown>	DEFAULT	3
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x400310	268	FUNC	<unknown>	DEFAULT	3
checksum_tcp_udp	.symtab	0x40041c	572	FUNC	<unknown>	DEFAULT	3
checksum_tcpudp	.symtab	0x400658	572	FUNC	<unknown>	DEFAULT	3
cia_bp	.symtab	0x47cdb0	4	OBJECT	<unknown>	DEFAULT	11
clock	.symtab	0x413320	108	FUNC	<unknown>	DEFAULT	3
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x4126d0	84	FUNC	<unknown>	DEFAULT	3
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x412f30	292	FUNC	<unknown>	DEFAULT	3
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2296	.symtab	0x47d810	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x417c90	84	FUNC	<unknown>	DEFAULT	3
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x404814	828	FUNC	<unknown>	DEFAULT	3
creat	.symtab	0x412b6c	28	FUNC	<unknown>	DEFAULT	3
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x404e78	460	FUNC	<unknown>	DEFAULT	3
data_start	.symtab	0x47c510	0	OBJECT	<unknown>	DEFAULT	11
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x412730	84	FUNC	<unknown>	DEFAULT	3
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endprotoent	.symtab	0x4167d4	176	FUNC	<unknown>	DEFAULT	3
environ	.symtab	0x483ad4	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x483af0	4	OBJECT	<unknown>	DEFAULT	14
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x43aa90	126	OBJECT	<unknown>	DEFAULT	5
execl	.symtab	0x419b20	204	FUNC	<unknown>	DEFAULT	3
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x41a5b0	84	FUNC	<unknown>	DEFAULT	3
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x419a30	236	FUNC	<unknown>	DEFAULT	3
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x43baa8	72	OBJECT	<unknown>	DEFAULT	5
fclose	.symtab	0x413390	512	FUNC	<unknown>	DEFAULT	3
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x412520	136	FUNC	<unknown>	DEFAULT	3
fcntl64	.symtab	0x4125b0	104	FUNC	<unknown>	DEFAULT	3
fd	.symtab	0x47d7e4	4	OBJECT	<unknown>	DEFAULT	13
fdgets	.symtab	0x403df4	292	FUNC	<unknown>	DEFAULT	3
fdopen_pids	.symtab	0x48184c	4	OBJECT	<unknown>	DEFAULT	14
fdpclose	.symtab	0x403b78	636	FUNC	<unknown>	DEFAULT	3
fdpopen	.symtab	0x403704	1140	FUNC	<unknown>	DEFAULT	3
fflush_unlocked	.symtab	0x415450	628	FUNC	<unknown>	DEFAULT	3
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x41c090	388	FUNC	<unknown>	DEFAULT	3
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x4151e0	216	FUNC	<unknown>	DEFAULT	3
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x4156d0	268	FUNC	<unknown>	DEFAULT	3
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x404dcc	172	FUNC	<unknown>	DEFAULT	3
fmt	.symtab	0x43ba90	20	OBJECT	<unknown>	DEFAULT	5
fopen	.symtab	0x413590	28	FUNC	<unknown>	DEFAULT	3
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x412790	84	FUNC	<unknown>	DEFAULT	3
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x413610	72	FUNC	<unknown>	DEFAULT	3
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x4157e0	128	FUNC	<unknown>	DEFAULT	3
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x40021c	0	FUNC	<unknown>	DEFAULT	3
free	.symtab	0x418560	396	FUNC	<unknown>	DEFAULT	3
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x41d980	68	FUNC	<unknown>	DEFAULT	3
fseeko	.symtab	0x41d980	68	FUNC	<unknown>	DEFAULT	3
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x41d9d0	388	FUNC	<unknown>	DEFAULT	3
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x41a610	140	FUNC	<unknown>	DEFAULT	3
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x415860	280	FUNC	<unknown>	DEFAULT	3
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x40e880	56	FUNC	<unknown>	DEFAULT	3
getHost	.symtab	0x404258	160	FUNC	<unknown>	DEFAULT	3
getOurIP	.symtab	0x40e500	896	FUNC	<unknown>	DEFAULT	3
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x41c090	388	FUNC	<unknown>	DEFAULT	3
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x4127f0	72	FUNC	<unknown>	DEFAULT	3
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x41a940	88	FUNC	<unknown>	DEFAULT	3
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x412840	88	FUNC	<unknown>	DEFAULT	3
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x41a9a0	84	FUNC	<unknown>	DEFAULT	3
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x417750	116	FUNC	<unknown>	DEFAULT	3
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x4177d0	1108	FUNC	<unknown>	DEFAULT	3
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x4128a0	84	FUNC	<unknown>	DEFAULT	3
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x412900	84	FUNC	<unknown>	DEFAULT	3
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getproto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getprotobyname	.symtab	0x416cc4	116	FUNC	<unknown>	DEFAULT	3
getprotobyname_r	.symtab	0x416b2c	408	FUNC	<unknown>	DEFAULT	3
getprotobynumber	.symtab	0x416ab8	116	FUNC	<unknown>	DEFAULT	3
getprotobynumber_r	.symtab	0x41696c	332	FUNC	<unknown>	DEFAULT	3
getprotoent	.symtab	0x41676c	104	FUNC	<unknown>	DEFAULT	3
getprotoent_r	.symtab	0x416490	732	FUNC	<unknown>	DEFAULT	3
getrlimit	.symtab	0x412960	84	FUNC	<unknown>	DEFAULT	3
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x417cf0	84	FUNC	<unknown>	DEFAULT	3
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x417d50	120	FUNC	<unknown>	DEFAULT	3
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x4129c0	84	FUNC	<unknown>	DEFAULT	3
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x41aa00	84	FUNC	<unknown>	DEFAULT	3
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4832	.symtab	0x483a7c	20	OBJECT	<unknown>	DEFAULT	14
h_errno	.symtab	0x483af4	4	OBJECT	<unknown>	DEFAULT	14
hacks	.symtab	0x47cda0	4	OBJECT	<unknown>	DEFAULT	11
hacks2	.symtab	0x47cda4	4	OBJECT	<unknown>	DEFAULT	11
hacks3	.symtab	0x47cda8	4	OBJECT	<unknown>	DEFAULT	11
hacks4	.symtab	0x47cdac	4	OBJECT	<unknown>	DEFAULT	11
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x41ffe8	1024	OBJECT	<unknown>	DEFAULT	5
hlt	.symtab	0x4002fc	0	NOTYPE	<unknown>	DEFAULT	3
htonl	.symtab	0x416410	8	FUNC	<unknown>	DEFAULT	3
htons	.symtab	0x416418	8	FUNC	<unknown>	DEFAULT	3
i	.symtab	0x47d7e8	4	OBJECT	<unknown>	DEFAULT	13
i.4487	.symtab	0x47cdc0	4	OBJECT	<unknown>	DEFAULT	11
index	.symtab	0x415b50	256	FUNC	<unknown>	DEFAULT	3
inet_addr	.symtab	0x417700	72	FUNC	<unknown>	DEFAULT	3
inet_aton	.symtab	0x41c8d0	244	FUNC	<unknown>	DEFAULT	3
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x4176dc	32	FUNC	<unknown>	DEFAULT	3
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x417640	156	FUNC	<unknown>	DEFAULT	3
inet_ntop	.symtab	0x4172e0	852	FUNC	<unknown>	DEFAULT	3
inet_ntop4	.symtab	0x4170ec	500	FUNC	<unknown>	DEFAULT	3
inet_pton	.symtab	0x416e30	700	FUNC	<unknown>	DEFAULT	3
inet_pton4	.symtab	0x416d40	240	FUNC	<unknown>	DEFAULT	3
initConnection	.symtab	0x40e23c	708	FUNC	<unknown>	DEFAULT	3
init_rand	.symtab	0x4022c4	300	FUNC	<unknown>	DEFAULT	3
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x47cf70	264	OBJECT	<unknown>	DEFAULT	11
initstate	.symtab	0x418f34	208	FUNC	<unknown>	DEFAULT	3
initstate_r	.symtab	0x419410	328	FUNC	<unknown>	DEFAULT	3
ioctl	.symtab	0x412a20	104	FUNC	<unknown>	DEFAULT	3
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x416310	60	FUNC	<unknown>	DEFAULT	3
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x412a90	88	FUNC	<unknown>	DEFAULT	3
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killdirectories	.symtab	0x47cd78	28	OBJECT	<unknown>	DEFAULT	11
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_kill_by_port	.symtab	0x4013a0	3300	FUNC	<unknown>	DEFAULT	3
killer_status	.symtab	0x47d840	4	OBJECT	<unknown>	DEFAULT	14
killerinit	.symtab	0x400ea4	280	FUNC	<unknown>	DEFAULT	3
killerkillbyname	.symtab	0x400fbc	848	FUNC	<unknown>	DEFAULT	3
killerpid	.symtab	0x47d7ec	4	OBJECT	<unknown>	DEFAULT	13
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/mips/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/mips/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/pipe.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x404b50	636	FUNC	<unknown>	DEFAULT	3
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lock_device	.symtab	0x400a24	1152	FUNC	<unknown>	DEFAULT	3
lseek64	.symtab	0x41aa60	168	FUNC	<unknown>	DEFAULT	3
macAddress	.symtab	0x47d844	6	OBJECT	<unknown>	DEFAULT	14
main	.symtab	0x40e8b8	3728	FUNC	<unknown>	DEFAULT	3
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x4051a8	312	FUNC	<unknown>	DEFAULT	3
makeRandomStr	.symtab	0x40439c	268	FUNC	<unknown>	DEFAULT	3
makevsepacket	.symtab	0x409a88	348	FUNC	<unknown>	DEFAULT	3
malloc	.symtab	0x4182b0	492	FUNC	<unknown>	DEFAULT	3
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x41c220	264	FUNC	<unknown>	DEFAULT	3
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x415980	308	FUNC	<unknown>	DEFAULT	3
memmove	.symtab	0x41c330	816	FUNC	<unknown>	DEFAULT	3
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x41c660	76	FUNC	<unknown>	DEFAULT	3
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x41c6b0	272	FUNC	<unknown>	DEFAULT	3
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x415ac0	144	FUNC	<unknown>	DEFAULT	3
mylock	.symtab	0x47cf50	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x47d090	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x47d0b0	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x483b00	24	OBJECT	<unknown>	DEFAULT	14
nanosleep	.symtab	0x41ab10	84	FUNC	<unknown>	DEFAULT	3
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1065	.symtab	0x483870	4	OBJECT	<unknown>	DEFAULT	14
ngPid	.symtab	0x47d7f4	4	OBJECT	<unknown>	DEFAULT	13
ntohl	.symtab	0x416400	8	FUNC	<unknown>	DEFAULT	3
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x416408	8	FUNC	<unknown>	DEFAULT	3
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x47d838	8	OBJECT	<unknown>	DEFAULT	14
object.2349	.symtab	0x47d814	24	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x412af0	124	FUNC	<unknown>	DEFAULT	3
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
openandclose	.symtab	0x40130c	148	FUNC	<unknown>	DEFAULT	3
opendir	.symtab	0x413060	408	FUNC	<unknown>	DEFAULT	3
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x47d7f0	4	OBJECT	<unknown>	DEFAULT	13
p.2294	.symtab	0x47c500	0	OBJECT	<unknown>	DEFAULT	11
pack	.symtab	0x405fac	296	FUNC	<unknown>	DEFAULT	3
parseHex	.symtab	0x403f18	176	FUNC	<unknown>	DEFAULT	3
perror	.symtab	0x4135b0	84	FUNC	<unknown>	DEFAULT	3
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pidPath	.symtab	0x483b30	100	OBJECT	<unknown>	DEFAULT	14
pids	.symtab	0x47d7fc	4	OBJECT	<unknown>	DEFAULT	13
pipe	.symtab	0x4124e0	64	FUNC	<unknown>	DEFAULT	3
poll	.symtab	0x41d920	84	FUNC	<unknown>	DEFAULT	3
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x412b90	120	FUNC	<unknown>	DEFAULT	3
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4045	.symtab	0x43a9e0	12	OBJECT	<unknown>	DEFAULT	5
print	.symtab	0x402f0c	1456	FUNC	<unknown>	DEFAULT	3
printchar	.symtab	0x402980	184	FUNC	<unknown>	DEFAULT	3
printi	.symtab	0x402c74	664	FUNC	<unknown>	DEFAULT	3
prints	.symtab	0x402a38	572	FUNC	<unknown>	DEFAULT	3
processCmd	.symtab	0x40a8e0	14684	FUNC	<unknown>	DEFAULT	3
proto	.symtab	0x483888	12	OBJECT	<unknown>	DEFAULT	14
proto_stayopen	.symtab	0x483894	4	OBJECT	<unknown>	DEFAULT	14
protof	.symtab	0x483884	4	OBJECT	<unknown>	DEFAULT	14
qual_chars.4050	.symtab	0x43aa00	20	OBJECT	<unknown>	DEFAULT	5
raise	.symtab	0x41d830	76	FUNC	<unknown>	DEFAULT	3
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x418dc0	28	FUNC	<unknown>	DEFAULT	3
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x40f96c	372	FUNC	<unknown>	DEFAULT	3
rand_alpha_str	.symtab	0x40fae0	300	FUNC	<unknown>	DEFAULT	3
rand_alphastr	.symtab	0x4027b0	464	FUNC	<unknown>	DEFAULT	3
rand_cmwc	.symtab	0x4025dc	468	FUNC	<unknown>	DEFAULT	3
rand_init	.symtab	0x40f750	248	FUNC	<unknown>	DEFAULT	3
rand_next	.symtab	0x40f848	292	FUNC	<unknown>	DEFAULT	3
random	.symtab	0x418de0	164	FUNC	<unknown>	DEFAULT	3
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x43b700	40	OBJECT	<unknown>	DEFAULT	5
random_r	.symtab	0x4191ec	176	FUNC	<unknown>	DEFAULT	3
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x47d0c8	128	OBJECT	<unknown>	DEFAULT	11
rawmemchr	.symtab	0x41df00	200	FUNC	<unknown>	DEFAULT	3
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x412c10	84	FUNC	<unknown>	DEFAULT	3
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x413200	256	FUNC	<unknown>	DEFAULT	3
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x412c70	84	FUNC	<unknown>	DEFAULT	3
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x4186f0	472	FUNC	<unknown>	DEFAULT	3
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x417dd0	84	FUNC	<unknown>	DEFAULT	3
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x4044a8	876	FUNC	<unknown>	DEFAULT	3
recvfrom	.symtab	0x417e30	128	FUNC	<unknown>	DEFAULT	3
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
report_kill	.symtab	0x4008a0	388	FUNC	<unknown>	DEFAULT	3
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_domain_to_hostname	.symtab	0x40fc10	360	FUNC	<unknown>	DEFAULT	3
resolv_entries_free	.symtab	0x4108a4	164	FUNC	<unknown>	DEFAULT	3
resolv_lookup	.symtab	0x40febc	2536	FUNC	<unknown>	DEFAULT	3
resolv_skip_name	.symtab	0x40fd78	324	FUNC	<unknown>	DEFAULT	3
rewind	.symtab	0x41b100	192	FUNC	<unknown>	DEFAULT	3
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rtcp	.symtab	0x406e40	1748	FUNC	<unknown>	DEFAULT	3
sbrk	.symtab	0x41ab70	144	FUNC	<unknown>	DEFAULT	3
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x47d7f8	4	OBJECT	<unknown>	DEFAULT	13
select	.symtab	0x412cd0	120	FUNC	<unknown>	DEFAULT	3
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x417eb0	84	FUNC	<unknown>	DEFAULT	3
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x407d34	736	FUNC	<unknown>	DEFAULT	3
sendSYNACK	.symtab	0x4095cc	1212	FUNC	<unknown>	DEFAULT	3
sendZgo	.symtab	0x407514	720	FUNC	<unknown>	DEFAULT	3
sendto	.symtab	0x417f10	128	FUNC	<unknown>	DEFAULT	3
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setprotoent	.symtab	0x416884	232	FUNC	<unknown>	DEFAULT	3
setsockopt	.symtab	0x417f90	120	FUNC	<unknown>	DEFAULT	3
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x418e84	176	FUNC	<unknown>	DEFAULT	3
setstate_r	.symtab	0x4190b0	316	FUNC	<unknown>	DEFAULT	3
sigaction	.symtab	0x41a460	232	FUNC	<unknown>	DEFAULT	3
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x418070	104	FUNC	<unknown>	DEFAULT	3
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x4180e0	60	FUNC	<unknown>	DEFAULT	3
signal	.symtab	0x418120	252	FUNC	<unknown>	DEFAULT	3
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x412d50	148	FUNC	<unknown>	DEFAULT	3
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x419bf0	564	FUNC	<unknown>	DEFAULT	3
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x413660	68	FUNC	<unknown>	DEFAULT	3
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snype	.symtab	0x483b94	80	OBJECT	<unknown>	DEFAULT	14
socket	.symtab	0x418010	84	FUNC	<unknown>	DEFAULT	3
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x40a724	444	FUNC	<unknown>	DEFAULT	3
socket_connect_icmp	.symtab	0x405d94	536	FUNC	<unknown>	DEFAULT	3
sockprintf	.symtab	0x4035ac	344	FUNC	<unknown>	DEFAULT	3
spec_and_mask.4049	.symtab	0x43aa14	16	OBJECT	<unknown>	DEFAULT	5
spec_base.4044	.symtab	0x43a9ec	7	OBJECT	<unknown>	DEFAULT	5
spec_chars.4046	.symtab	0x43aa40	21	OBJECT	<unknown>	DEFAULT	5
spec_flags.4045	.symtab	0x43aa58	8	OBJECT	<unknown>	DEFAULT	5
spec_or_mask.4048	.symtab	0x43aa24	16	OBJECT	<unknown>	DEFAULT	5
spec_ranges.4047	.symtab	0x43aa34	9	OBJECT	<unknown>	DEFAULT	5
sprintf	.symtab	0x4136b0	80	FUNC	<unknown>	DEFAULT	3
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x419004	172	FUNC	<unknown>	DEFAULT	3
srandom	.symtab	0x419004	172	FUNC	<unknown>	DEFAULT	3
srandom_r	.symtab	0x41929c	372	FUNC	<unknown>	DEFAULT	3
static_aliases	.symtab	0x483880	4	OBJECT	<unknown>	DEFAULT	14
static_id	.symtab	0x47d1b0	2	OBJECT	<unknown>	DEFAULT	11
static_ns	.symtab	0x483b18	4	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x47ce48	4	OBJECT	<unknown>	DEFAULT	11
stdin	.symtab	0x47ce40	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x47ce44	4	OBJECT	<unknown>	DEFAULT	11
strcasecmp	.symtab	0x41ea70	108	FUNC	<unknown>	DEFAULT	3
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x416250	152	FUNC	<unknown>	DEFAULT	3
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x415b50	256	FUNC	<unknown>	DEFAULT	3
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x415c50	44	FUNC	<unknown>	DEFAULT	3
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x415c50	44	FUNC	<unknown>	DEFAULT	3
strcpy	.symtab	0x415c80	36	FUNC	<unknown>	DEFAULT	3
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x41e0e0	144	FUNC	<unknown>	DEFAULT	3
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x416080	392	FUNC	<unknown>	DEFAULT	3
strlen	.symtab	0x415cb0	184	FUNC	<unknown>	DEFAULT	3
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x41dfd0	180	FUNC	<unknown>	DEFAULT	3
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x415d70	188	FUNC	<unknown>	DEFAULT	3
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x415e30	256	FUNC	<unknown>	DEFAULT	3
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x41c890	64	FUNC	<unknown>	DEFAULT	3
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x41e090	76	FUNC	<unknown>	DEFAULT	3
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x415f30	256	FUNC	<unknown>	DEFAULT	3
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x4162f0	32	FUNC	<unknown>	DEFAULT	3
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x41c7c0	204	FUNC	<unknown>	DEFAULT	3
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x4197c0	28	FUNC	<unknown>	DEFAULT	3
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x419560	568	FUNC	<unknown>	DEFAULT	3
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x403534	120	FUNC	<unknown>	DEFAULT	3
table	.symtab	0x483be4	232	OBJECT	<unknown>	DEFAULT	14
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x410950	1068	FUNC	<unknown>	DEFAULT	3
table_key	.symtab	0x47cdd0	4	OBJECT	<unknown>	DEFAULT	11
table_lock_val	.symtab	0x410e00	132	FUNC	<unknown>	DEFAULT	3
table_retrieve_val	.symtab	0x410e84	144	FUNC	<unknown>	DEFAULT	3
table_unlock_val	.symtab	0x410d7c	132	FUNC	<unknown>	DEFAULT	3
tcgetattr	.symtab	0x416350	176	FUNC	<unknown>	DEFAULT	3
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x406524	2332	FUNC	<unknown>	DEFAULT	3
tcpcsum	.symtab	0x405044	356	FUNC	<unknown>	DEFAULT	3
time	.symtab	0x412df0	84	FUNC	<unknown>	DEFAULT	3
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x41ac00	84	FUNC	<unknown>	DEFAULT	3
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x410fdc	552	FUNC	<unknown>	DEFAULT	3
tolower	.symtab	0x41af00	60	FUNC	<unknown>	DEFAULT	3
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x412ef0	60	FUNC	<unknown>	DEFAULT	3
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x4023f0	492	FUNC	<unknown>	DEFAULT	3
type_codes	.symtab	0x43aa60	24	OBJECT	<unknown>	DEFAULT	5
type_sizes	.symtab	0x43aa78	12	OBJECT	<unknown>	DEFAULT	5
udp_flood	.symtab	0x407a38	764	FUNC	<unknown>	DEFAULT	3
udpfl00d	.symtab	0x4052e0	2404	FUNC	<unknown>	DEFAULT	3
unknown.1088	.symtab	0x43ab10	14	OBJECT	<unknown>	DEFAULT	5
unsafe_state	.symtab	0x47d150	28	OBJECT	<unknown>	DEFAULT	11
uppercase	.symtab	0x4042f8	164	FUNC	<unknown>	DEFAULT	3
userID	.symtab	0x47cdb8	4	OBJECT	<unknown>	DEFAULT	11
usleep	.symtab	0x419e30	144	FUNC	<unknown>	DEFAULT	3
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x411734	968	FUNC	<unknown>	DEFAULT	3
util_fdgets	.symtab	0x4121bc	320	FUNC	<unknown>	DEFAULT	3
util_isalpha	.symtab	0x412364	144	FUNC	<unknown>	DEFAULT	3
util_isdigit	.symtab	0x412474	104	FUNC	<unknown>	DEFAULT	3
util_isspace	.symtab	0x4123f4	128	FUNC	<unknown>	DEFAULT	3
util_isupper	.symtab	0x4122fc	104	FUNC	<unknown>	DEFAULT	3
util_itoa	.symtab	0x411afc	572	FUNC	<unknown>	DEFAULT	3
util_local_addr	.symtab	0x412068	340	FUNC	<unknown>	DEFAULT	3
util_memcpy	.symtab	0x411618	164	FUNC	<unknown>	DEFAULT	3
util_memsearch	.symtab	0x411d38	292	FUNC	<unknown>	DEFAULT	3
util_strcat	.symtab	0x411570	168	FUNC	<unknown>	DEFAULT	3
util_strcmp	.symtab	0x4113c4	288	FUNC	<unknown>	DEFAULT	3
util_strcpy	.symtab	0x4114e4	140	FUNC	<unknown>	DEFAULT	3
util_stristr	.symtab	0x411e5c	524	FUNC	<unknown>	DEFAULT	3
util_strlen	.symtab	0x411210	116	FUNC	<unknown>	DEFAULT	3
util_strncmp	.symtab	0x411284	320	FUNC	<unknown>	DEFAULT	3
util_zero	.symtab	0x4116bc	120	FUNC	<unknown>	DEFAULT	3
vfork	.symtab	0x412e50	28	FUNC	<unknown>	DEFAULT	3
vfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfprintf	.symtab	0x413df0	260	FUNC	<unknown>	DEFAULT	3
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x409be4	2508	FUNC	<unknown>	DEFAULT	3
vsnprintf	.symtab	0x413700	260	FUNC	<unknown>	DEFAULT	3
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x48185c	4	OBJECT	<unknown>	DEFAULT	14
wait4	.symtab	0x41ac60	88	FUNC	<unknown>	DEFAULT	3
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x412e70	28	FUNC	<unknown>	DEFAULT	3
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x402090	564	FUNC	<unknown>	DEFAULT	3
watchdog_pid	.symtab	0x47d834	4	OBJECT	<unknown>	DEFAULT	14
wcrtomb	.symtab	0x41af60	112	FUNC	<unknown>	DEFAULT	3
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x41b010	228	FUNC	<unknown>	DEFAULT	3
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x41afd0	64	FUNC	<unknown>	DEFAULT	3
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
whitelist	.symtab	0x47c520	8	OBJECT	<unknown>	DEFAULT	11
wildString	.symtab	0x403fc8	656	FUNC	<unknown>	DEFAULT	3
write	.symtab	0x412e90	84	FUNC	<unknown>	DEFAULT	3
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x481850	4	OBJECT	<unknown>	DEFAULT	14
xdigits.3043	.symtab	0x43b6d4	17	OBJECT	<unknown>	DEFAULT	5
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x481854	4	OBJECT	<unknown>	DEFAULT	14
z	.symtab	0x481858	4	OBJECT	<unknown>	DEFAULT	14
zprintf	.symtab	0x4034bc	120	FUNC	<unknown>	DEFAULT	3

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T23:57:56.280184+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.23	52408	154.216.20.70	6478	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 23:57:49.230443954 CET	43922	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.235320091 CET	7733	43922	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:49.235651970 CET	43922	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.239593983 CET	43922	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.240546942 CET	43922	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.244364977 CET	7733	43922	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:49.286436081 CET	7733	43922	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:49.600779057 CET	43924	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.606689930 CET	7733	43924	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:49.606759071 CET	43924	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.608040094 CET	43924	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.608779907 CET	43924	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.613769054 CET	7733	43924	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:49.628637075 CET	7733	43922	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:49.628706932 CET	43922	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:49.654459000 CET	7733	43924	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:50.000582933 CET	7733	43924	66.59.198.122	192.168.2.23
Jan 8, 2025 23:57:50.000664949 CET	43924	7733	192.168.2.23	66.59.198.122
Jan 8, 2025 23:57:50.223305941 CET	43928	443	192.168.2.23	91.189.91.42
Jan 8, 2025 23:57:55.598642111 CET	42836	443	192.168.2.23	91.189.91.43
Jan 8, 2025 23:57:56.269752979 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:57:56.274600029 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:57:56.274919987 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:57:56.275346994 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:57:56.280105114 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:57:56.280184031 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:57:56.285022020 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:57:56.855556965 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:57:56.856004953 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:57:57.390357018 CET	42516	80	192.168.2.23	109.202.202.202
Jan 8, 2025 23:58:11.468549967 CET	43928	443	192.168.2.23	91.189.91.42
Jan 8, 2025 23:58:13.581703901 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:58:13.581815958 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:58:13.734113932 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:58:13.734184980 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:58:21.707041025 CET	42836	443	192.168.2.23	91.189.91.43
Jan 8, 2025 23:58:27.850148916 CET	42516	80	192.168.2.23	109.202.202.202
Jan 8, 2025 23:58:52.422935009 CET	43928	443	192.168.2.23	91.189.91.42
Jan 8, 2025 23:59:12.900084019 CET	42836	443	192.168.2.23	91.189.91.43
Jan 8, 2025 23:59:13.586850882 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:59:13.586966991 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 8, 2025 23:59:13.750844955 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 8, 2025 23:59:13.750950098 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 9, 2025 00:00:13.594311953 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 9, 2025 00:00:13.594633102 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 9, 2025 00:00:13.752008915 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 9, 2025 00:00:13.752135992 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 9, 2025 00:01:13.603491068 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 9, 2025 00:01:13.603677988 CET	52408	6478	192.168.2.23	154.216.20.70
Jan 9, 2025 00:01:13.753146887 CET	6478	52408	154.216.20.70	192.168.2.23
Jan 9, 2025 00:01:13.753248930 CET	52408	6478	192.168.2.23	154.216.20.70

System Behavior

Analysis Process: mippytippy.elf PID: 6245, Parent PID: 6161

General

Start time (UTC):	22:57:47
Start date (UTC):	08/01/2025
Path:	/tmp/mippytippy.elf
Arguments:	/tmp/mippytippy.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	22:57:55
Start date (UTC):	08/01/2025
Path:	/tmp/mippytippy.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	22:57:55
Start date (UTC):	08/01/2025
Path:	/tmp/mippytippy.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	22:57:55
Start date (UTC):	08/01/2025
Path:	/tmp/mippytippy.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	22:57:48
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	22:57:48
Start date (UTC):	08/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:57:48
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mippytippy.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.kdPUeo (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: mippytippy.elf PID: 6245, Parent PID: 6161

General

Chronological Activities

Analysis Process: mippytippy.elf PID: 6254, Parent PID: 6245

General

Chronological Activities

Analysis Process: mippytippy.elf PID: 6256, Parent PID: 6245

General

Chronological Activities

Analysis Process: mippytippy.elf PID: 6258, Parent PID: 6256

General

Chronological Activities

Analysis Process: gnome-session-binary PID: 6247, Parent PID: 1477

General

Chronological Activities

Analysis Process: sh PID: 6247, Parent PID: 1477

General

Linux Analysis Report
mippytippy.elf