Edit tour

Linux Analysis Report
army6.elf

Overview

General Information

Sample name:	army6.elf
Analysis ID:	1586278
MD5:	f5766e54f5df87a84bb3cb507140f983
SHA1:	92809fb7294d6e15a4ed75af713c34209a78c289
SHA256:	2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Suricata IDS alerts with low severity for network traffic

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586278
Start date and time:	2025-01-08 23:57:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	army6.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/army6.elf
PID:	5488
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

army6.elf (PID: 5488, Parent: 5412, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/army6.elf

army6.elf New Fork (PID: 5652, Parent: 5488)

army6.elf New Fork (PID: 5654, Parent: 5488)

army6.elf New Fork (PID: 5656, Parent: 5654)

gnome-session-binary New Fork (PID: 5492, Parent: 1383)

sh (PID: 5492, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5492, Parent: 1383, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5497, Parent: 1)

systemd-hostnamed (PID: 5497, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 5586, Parent: 1289)

Default (PID: 5586, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5649, Parent: 1289)

Default (PID: 5649, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5664, Parent: 1)

systemd-user-runtime-dir (PID: 5664, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
army6.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
army6.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
army6.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x27e7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27e91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ea5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27eb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ecd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ee1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ef5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fa9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fe5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ff9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2800d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
army6.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x27e30:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x33e60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
army6.elf	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x2c5a:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
army6.elf	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x2b6a:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x27e7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27e91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ea5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27eb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ecd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ee1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ef5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fa9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fe5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ff9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2800d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x27e30:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x33e60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x2c5a:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x2b6a:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x27e7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27e91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ea5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27eb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ecd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ee1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ef5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fa9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fe5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ff9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2800d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x27e30:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x33e60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x2c5a:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x2b6a:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x27e7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27e91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ea5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27eb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ecd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ee1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ef5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27f95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fa9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27fe5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27ff9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2800d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x27e30:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x33e60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x2c5a:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x2b6a:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
Process Memory Space: army6.elf PID: 5488	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: army6.elf PID: 5488	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x37f7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37f93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37fa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37fbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37fcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37fe3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37ff7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3800b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3801f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38033:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38047:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3805b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3806f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38083:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38097:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x380ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x380bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x380d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x380e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x380fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3810f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: army6.elf PID: 5488	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x37f32:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x4db06:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: army6.elf PID: 5652	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: army6.elf PID: 5652	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e68f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e6a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e6b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e6cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e6df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e6f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e71b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e72f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e76b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e77f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e7a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e7bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e7cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e7e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e7f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e80b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e81f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: army6.elf PID: 5652	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1e642:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x34216:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: army6.elf PID: 5654	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: army6.elf PID: 5654	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x20c33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20c47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20c5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20c6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20c83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20c97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20cab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20cbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20cd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ce7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20cfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20daf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: army6.elf PID: 5654	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x20be6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x367ba:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 22 entries

Suricata Signatures

ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T23:57:59.250668+0100	2848448	1	A Network Trojan was detected	192.168.2.14	44590	154.216.20.70	6478	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: army6.elf

Avira: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/army6.elf (PID: 5488)

Opens: /proc/net/route

Jump to behavior

Source: army6.elf

String: shps902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfsoraSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismDeportedXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAmnesiaOwariUnHAnaAWz3hirobbomiorieagledoxxRollielessie.hax.yakuzawordminerminerwordSinixV4hohog0dbu7tuorphicfurasshuhorizonassailantAresKawaiihelperECHOBOTDEMONSkalonJoshodaddyscumakira.akHilixdakuTsunamiestellaSolarrift_-255.NetCayosinOkamiKoshabushidotrojanshiinaReaper.Corona.wrgnuwrijoBOXOFABOXAkaHarioragefibregalilstresserpwstresser.pwcatnetTheCowSaysGoodByedistrubter22269reportbacktelportzyad1234stresser.suTohrujeffspenderbotnetOmnihamlogmirailoversxlk.busyboxxxbusyboxxkawaiiFrostisxj472szHU6FIZTQUPFF1500RGplzjustfuckoffnvitpjelfLoadAmakanotokupdatercum-n-gooblivionVoltagesc

Source: global traffic	TCP traffic: 192.168.2.14:55622 -> 66.59.198.122:7733
Source: global traffic	TCP traffic: 192.168.2.14:44590 -> 154.216.20.70:6478

Source: Network traffic

Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:44590 -> 154.216.20.70:6478

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 66.59.198.122
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: Process Memory Space: army6.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: army6.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: army6.elf PID: 5652, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: army6.elf PID: 5652, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: army6.elf PID: 5654, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: army6.elf PID: 5654, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: attacks_vector_wabba_jack

Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: shps902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfsoraSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismDeportedXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0

Source: /tmp/army6.elf (PID: 5488)	SIGKILL sent: pid: 1639, result: successful			Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	SIGKILL sent: pid: 5492, result: successful			Jump to behavior

Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: army6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: Process Memory Space: army6.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: army6.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: army6.elf PID: 5652, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: army6.elf PID: 5652, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: army6.elf PID: 5654, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: army6.elf PID: 5654, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.spre.troj.linELF@0/0@2/0

Source: army6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: army6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: army6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: army6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: army6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: army6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: army6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm

Source: /tmp/army6.elf (PID: 5488)	Directory: /tmp/.	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	Directory: /tmp/..	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	Directory: /tmp/.	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	Directory: /tmp/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5492)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5492)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5497)	Directory: <invalid fd (10)>/..	Jump to behavior

Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3752/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3752/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3754/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3754/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3755/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3755/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3756/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3756/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/army6.elf (PID: 5488)	File opened: /proc/247/cmdline	Jump to behavior

Source: /tmp/army6.elf (PID: 5488)	Queries kernel information via 'uname':			Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5497)	Queries kernel information via 'uname':			Jump to behavior

Source: army6.elf, 5488.1.000056403be8d000.000056403bfdc000.rw-.sdmp, army6.elf, 5652.1.000056403be8d000.000056403bfdc000.rw-.sdmp, army6.elf, 5654.1.000056403be8d000.000056403bfdc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: army6.elf, 5488.1.00007ffe6c491000.00007ffe6c4b2000.rw-.sdmp, army6.elf, 5652.1.00007ffe6c491000.00007ffe6c4b2000.rw-.sdmp, army6.elf, 5654.1.00007ffe6c491000.00007ffe6c4b2000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: army6.elf, 5488.1.000056403be8d000.000056403bfdc000.rw-.sdmp, army6.elf, 5652.1.000056403be8d000.000056403bfdc000.rw-.sdmp, army6.elf, 5654.1.000056403be8d000.000056403bfdc000.rw-.sdmp	Binary or memory string: ;@V!/etc/qemu-binfmt/arm
Source: army6.elf, 5488.1.00007ffe6c491000.00007ffe6c4b2000.rw-.sdmp, army6.elf, 5652.1.00007ffe6c491000.00007ffe6c4b2000.rw-.sdmp, army6.elf, 5654.1.00007ffe6c491000.00007ffe6c4b2000.rw-.sdmp	Binary or memory string: x"x86_64/usr/bin/qemu-arm/tmp/army6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/army6.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: army6.elf, type: SAMPLE
Source: Yara match	File source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: army6.elf, type: SAMPLE
Source: Yara match	File source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: army6.elf PID: 5488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: army6.elf PID: 5652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: army6.elf PID: 5654, type: MEMORYSTR

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: army6.elf, type: SAMPLE
Source: Yara match	File source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: army6.elf, type: SAMPLE
Source: Yara match	File source: 5488.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5654.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5652.1.00007f16b0017000.00007f16b004d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: army6.elf PID: 5488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: army6.elf PID: 5652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: army6.elf PID: 5654, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
army6.elf	100%	Avira	LINUX/Gafgyt.opnd

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false
154.216.20.70	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
66.59.198.122	unknown	Reserved	17184	ATL-CBEYONDUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse
	uYtea.sh4.elf	Get hash	malicious	Unknown	Browse
	uYtea.arc.elf	Get hash	malicious	Mirai	Browse
	386.elf	Get hash	malicious	Unknown	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	gigops.mpsl.elf	Get hash	malicious	Gafgyt	Browse
	94.156.227.153-sora.arm5-2025-01-07T16_09_13.elf	Get hash	malicious	Mirai	Browse
	94.156.227.153-sora.m68k-2025-01-07T16_09_14.elf	Get hash	malicious	Mirai	Browse
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	fenty.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	m1.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	gompsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	empsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATL-CBEYONDUS	armv7l.elf	Get hash	malicious	Unknown	Browse	173.200.178.217
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	72.54.140.80
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	72.16.202.25
	armv5l.elf	Get hash	malicious	Mirai	Browse	69.199.235.231
	armv4l.elf	Get hash	malicious	Mirai	Browse	69.198.187.233
	nabarm5.elf	Get hash	malicious	Unknown	Browse	69.199.34.183
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	69.199.45.224
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	50.21.114.195
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	69.15.59.107
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	216.192.135.159
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	gompsl.elf	Get hash	malicious	Mirai	Browse	156.254.70.172
	garm.elf	Get hash	malicious	Mirai	Browse	156.241.11.50
	earm5.elf	Get hash	malicious	Mirai	Browse	156.254.70.166
	emips.elf	Get hash	malicious	Mirai	Browse	156.226.9.162
	LayyB0R.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.20.162
	aNfqvgu.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.20.162
	miori.x86.elf	Get hash	malicious	Unknown	Browse	45.207.240.67
	Jeffparish.docx	Get hash	malicious	Unknown	Browse	154.216.17.193
	wind.m68k.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.sh4.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
CANONICAL-ASGB	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Kloki.arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.039536500046767
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	army6.elf
File size:	266'141 bytes
MD5:	f5766e54f5df87a84bb3cb507140f983
SHA1:	92809fb7294d6e15a4ed75af713c34209a78c289
SHA256:	2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5
SHA512:	ad77af96f0ddca58db25e49d7e025c6cff7964742ca261c9096fe46957b97295a4d9303780c883dc704f4d1df11963de9a4f2f542ce96bc5972112b24f639900
SSDEEP:	6144:MargtN+467jhcaVogahXGAm20Q7tJPjNS:MJN165cayFIAm20ItJPjNS
TLSH:	CB446824AC16D217C0E3FFB9EFE97A8AE719FBC64B8553036560106D1EF1A59281FC84
File Content Preview:	.ELF..............(.........4...........4. ...(........pdY..d...d...................................tY..tY..............tY..tY..tY.......s..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	229540
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x187b8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x20888	0x18888	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x20898	0x18898	0x1d0b4	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x3d94c	0x3594c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x3d964	0x35964	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x45974	0x35974	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x45978	0x35978	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x4597c	0x3597c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x45980	0x35980	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x45984	0x35984	0x7c	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x45a00	0x35a00	0xb18	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x46518	0x36518	0x684c	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x36518	0xdcc	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x372e8	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x373c8	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x37878	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x37904	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x37f5c	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x37fb4	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x37fc4	0xdd	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x38464	0x5b90	0x10	0x0		23	802	4
.strtab	STRTAB	0x0	0x3dff4	0x2fa9	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x35964	0x3d964	0x3d964	0x10	0x10	2.7500	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x35974	0x35974	5.9736	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x35974	0x45974	0x45974	0xba4	0x73f0	4.5504	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x20888	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x20898	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x3d94c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x3d964	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x45974	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x45978	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x4597c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x45980	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x45984	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x45a00	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x46518	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x20888	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x20894	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x96d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x981c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa9ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xab44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd94c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe15c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe59c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1261c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1368c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1473c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1486c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1540c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1620c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1728c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1737c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1783c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x186b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x186e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1872c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1885c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a3d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a81c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b03c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b77c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b98c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c16c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d79c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d84c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d92c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1deb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ecf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eda4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f9a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fbac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fbe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fcf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fe3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x206f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x4597c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x45978	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x45a04	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x45a08	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x86f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8994	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x96cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x4627c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x9818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x98ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9a48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9b84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa9e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x219f8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xab40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb55c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdb3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdfc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe35c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe590	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe6ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xecec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10578	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1254c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1260c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x462a0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x134a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13590	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1380c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ce4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x462a4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x462ac	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x14dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3c874	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x150cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1512c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1585c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x462e8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x462b4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x3c898	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1649c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x463f0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x16b0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17350	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17664	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17af4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x463f4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x18118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x184e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1858c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18634	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x186ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x186e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18728	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x189b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x4640c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x194e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ea0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x46424	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x19f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a00c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a170	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x4643c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x464d4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1a268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a2fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a3cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a4b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3d4f4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a6b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x464e8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1a818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b038	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b1ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x46500	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1b5dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b79c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b984	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x4650c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1bd98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x4c790	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1bdc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3d898	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d00c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dedc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ecbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f1b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f280	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f9a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fba0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fc44	0	NOTYPE	<unknown>	DEFAULT	2
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x3c874	24	OBJECT	<unknown>	DEFAULT	4
C.168.6322	.symtab	0x2fe00	48	OBJECT	<unknown>	DEFAULT	4
C.182.6435	.symtab	0x32d68	44	OBJECT	<unknown>	DEFAULT	4
C.186.6477	.symtab	0x32f0c	32	OBJECT	<unknown>	DEFAULT	4
C.189.6511	.symtab	0x394b4	8	OBJECT	<unknown>	DEFAULT	4
C.192.6545	.symtab	0x395d4	12	OBJECT	<unknown>	DEFAULT	4
C.195.6580	.symtab	0x3ac90	24	OBJECT	<unknown>	DEFAULT	4
C.198.6612	.symtab	0x3b090	1024	OBJECT	<unknown>	DEFAULT	4
C.201.6657	.symtab	0x3b760	16	OBJECT	<unknown>	DEFAULT	4
C.205.6703	.symtab	0x3bd20	12	OBJECT	<unknown>	DEFAULT	4
C.209.6742	.symtab	0x3bf48	16	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x46538	4	OBJECT	<unknown>	DEFAULT	13
KHserverHACKER	.symtab	0x46290	4	OBJECT	<unknown>	DEFAULT	12
KillStructure	.symtab	0x45a10	2012	OBJECT	<unknown>	DEFAULT	12
LOCAL_ADDR	.symtab	0x4c7bc	4	OBJECT	<unknown>	DEFAULT	13
Laligned	.symtab	0x17108	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x17124	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x46554	16384	OBJECT	<unknown>	DEFAULT	13
Randhex	.symtab	0xdfc4	408	FUNC	<unknown>	DEFAULT	2
Send100UP	.symtab	0xde60	356	FUNC	<unknown>	DEFAULT	2
SendBINARY	.symtab	0xe15c	520	FUNC	<unknown>	DEFAULT	2
SendKPAC	.symtab	0xdc94	460	FUNC	<unknown>	DEFAULT	2
SendOnePacket	.symtab	0xdb40	340	FUNC	<unknown>	DEFAULT	2
SendRAPE	.symtab	0xe364	568	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xe59c	340	FUNC	<unknown>	DEFAULT	2
SendUDPBYPASS	.symtab	0xd418	344	FUNC	<unknown>	DEFAULT	2
WalmartBag	.symtab	0xd94c	500	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x14c24	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x45984	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x462a4	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x3c274	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x4650c	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x3d580	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x462ac	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x3c574	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x45974	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x45974	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x462a4	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x4650c	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x462ac	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_b	.symtab	0x462a8	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x46510	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x462b0	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x150e0	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x14b30	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1d020	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x17528	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x1bdac	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x14ac4	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x189e4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x18a08	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x189c0	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1b080	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1b150	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x17570	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14c24	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x19d8c	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1a4bc	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x18640	56	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1dee8	76	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x1b7b8	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x14c88	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x14cec	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1c0f0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1c124	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1bdc8	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x18678	56	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x14790	52	FUNC	<unknown>	HIDDEN	2
__GI_endprotoent	.symtab	0x1783c	188	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x4c790	4	OBJECT	<unknown>	HIDDEN	13
__GI_execl	.symtab	0x1af40	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1b748	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1a6b8	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x15130	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x14ac4	108	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16ca8	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1cf44	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1d020	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x16a64	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x16eb4	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x152e4	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x14904	52	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x15378	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x16f54	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1e084	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1e0a8	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1b8c8	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x16f8c	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1d020	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x14a30	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1b820	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x148f0	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1b98c	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x185bc	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x185d8	104	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1dc10	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1f2e4	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1f610	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1b77c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1486c	20	FUNC	<unknown>	HIDDEN	2
__GI_getprotobyname_r	.symtab	0x17c6c	296	FUNC	<unknown>	HIDDEN	2
__GI_getprotobynumber_r	.symtab	0x17b1c	248	FUNC	<unknown>	HIDDEN	2
__GI_getprotoent_r	.symtab	0x179c4	344	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1b7ec	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x186b0	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x14a90	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1b7a4	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x4c794	4	OBJECT	<unknown>	HIDDEN	13
__GI_htonl	.symtab	0x177a4	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x17794	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x18594	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1db18	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x18578	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x184ec	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x18268	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x17f08	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1a3d8	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x14bd0	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x176f4	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x14a5c	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1f6e0	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1d5f0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x17170	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1d5e0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1d9c8	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1d84c	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x17040	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1b5ec	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1bc38	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1bbd0	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1bc04	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x177d4	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x177c4	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x147d8	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x14eb4	172	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x15304	116	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x14838	52	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1f5dc	52	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x18894	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x19ecc	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1a270	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1d79c	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x149fc	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x14ff8	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1bcc0	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x149c8	52	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1872c	56	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x18764	60	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1b920	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14988	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x187a0	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x187d8	64	FUNC	<unknown>	HIDDEN	2
__GI_setprotoent	.symtab	0x178f8	204	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x18818	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1a18c	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1b674	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x188b0	68	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x188f4	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x18908	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x14c50	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1a770	172	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x153a8	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1885c	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x153d8	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1a300	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1f688	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1fbe0	108	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x17670	132	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x17438	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1d9ec	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x17150	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x17150	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x17358	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1d758	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1f744	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x170e0	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1737c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1728c	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1dad8	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1d978	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1d92c	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x17190	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x17540	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1d6e0	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1a4dc	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1a968	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17718	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x14880	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1bc78	20	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x14cbc	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1fbac	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x14750	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x15968	228	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1540c	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1b714	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x14938	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1c16c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1c1e4	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1c1c0	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x14b9c	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x45980	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x45980	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x1fe48	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x207a4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x207a4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x20788	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x20834	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1fe48	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x207bc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x20804	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x2081c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x207ec	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x207d4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x204e8	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x20258	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1fe3c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1fe44	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x201a4	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x2017c	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1fcf8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1fe24	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x201f8	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x20158	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x14628	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x14724	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x201e4	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1df34	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x1df38	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x1df3c	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x4c788	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x464e8	24	OBJECT	<unknown>	DEFAULT	12
__bss_end__	.symtab	0x4cd64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x46518	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x46518	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1b0fc	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1f200	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x20704	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x462a8	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x46510	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x462b0	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x4c798	4	OBJECT	<unknown>	HIDDEN	13
__data_start	.symtab	0x45a00	0	NOTYPE	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x1e418	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1f864	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x1b70c	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1b700	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x1473c	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x204e8	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1fcf8	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1e510	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x4597c	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x45a00	0	OBJECT	<unknown>	HIDDEN	12
__encode_dotted	.symtab	0x1fc4c	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1f778	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1f918	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x4cd64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x4c780	4	OBJECT	<unknown>	DEFAULT	13
__eqdf2	.symtab	0x20704	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x150e0	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x1478c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x3d974	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x3d964	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x4c778	4	OBJECT	<unknown>	HIDDEN	13
__extendsfdf2	.symtab	0x201a4	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x14b30	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1d020	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x45980	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x4597c	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x20834	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x201f8	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x2017c	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x201e4	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x20158	36	FUNC	<unknown>	HIDDEN	2
__frame_dummy_init_array_entry	.symtab	0x45978	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x206f4	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1f298	76	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1b834	148	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1df40	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1b77c	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x17528	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x206f4	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x1bdac	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x4597c	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x45978	0	NOTYPE	<unknown>	HIDDEN	8
__initbuf	.symtab	0x177f4	72	FUNC	<unknown>	DEFAULT	2
__ledf2	.symtab	0x206fc	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x14c88	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x18678	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x14ac4	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x14904	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1f6e0	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1bc04	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x147d8	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x149fc	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1872c	56	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x18764	60	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x14988	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x187a0	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x187d8	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1b674	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x4c77c	4	OBJECT	<unknown>	DEFAULT	13
__libc_system	.symtab	0x1b490	348	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x14938	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x14b9c	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x3d92c	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x206fc	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1995c	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x18a2c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x4640c	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x4c9d0	888	OBJECT	<unknown>	DEFAULT	13
__malloc_trim	.symtab	0x198ac	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x20258	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x4cd58	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x4cd5c	4	OBJECT	<unknown>	HIDDEN	13
__nedf2	.symtab	0x20704	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x1f978	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1eda4	1116	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x4c784	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x45978	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x45978	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x46504	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x46508	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x1b044	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1b03c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1b03c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1b03c	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1b03c	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1f9a8	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x4cd50	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x46517	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x4c7a0	24	OBJECT	<unknown>	DEFAULT	13
__resolv_timeout	.symtab	0x46516	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x4c78c	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x4cd54	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x4cd60	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x189e4	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x18a08	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x189c0	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x462f4	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1e1f8	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1c294	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1e250	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1c348	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x15830	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x3c898	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x1e314	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1e3dc	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1e344	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1c488	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x15938	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x462f8	4	OBJECT	<unknown>	DEFAULT	12
__subdf3	.symtab	0x1fe44	788	FUNC	<unknown>	HIDDEN	2
__syscall_error	.symtab	0x1b654	32	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1bc8c	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x1b080	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1b150	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1b1bc	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x46500	4	OBJECT	<unknown>	HIDDEN	12
__udivsi3	.symtab	0x14628	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x14750	64	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x17570	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1ba6c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1b9a0	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x1bb18	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x4c570	10	OBJECT	<unknown>	DEFAULT	13
_bss_end__	.symtab	0x4cd64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x15a4c	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x4c978	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_handler	.symtab	0x4c9a0	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_spec	.symtab	0x463f0	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x1deb0	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x4cd48	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x4cd4c	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x46518	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x4cd64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x4c790	4	OBJECT	<unknown>	DEFAULT	13
_exit	.symtab	0x14c24	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x20888	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x4a570	8192	OBJECT	<unknown>	DEFAULT	13
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x15aa0	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1c750	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x4c794	4	OBJECT	<unknown>	DEFAULT	13
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1c558	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1d150	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x1620c	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x164f4	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x162ac	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x162f0	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x164a0	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1b054	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1b04c	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x4c9c8	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x154c0	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x157c8	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x462fc	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x462b4	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x16b20	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x4a56c	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x462cc	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x4a568	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x46300	240	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0x15864	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x462e4	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x1a4f8	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1c5c8	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x3c968	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1c5f4	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x15b24	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x19d8c	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x14954	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0xf384	208	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x13600	140	FUNC	<unknown>	DEFAULT	2
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x1a4bc	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1a4bc	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attacks_vector_wabba_jack	.symtab	0xc260	1056	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x17140	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x4c774	4	OBJECT	<unknown>	DEFAULT	13
bind	.symtab	0x18640	56	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacklist	.symtab	0x461ec	116	OBJECT	<unknown>	DEFAULT	12
brk	.symtab	0x1dee8	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x18908	184	FUNC	<unknown>	DEFAULT	2
buf.2975	.symtab	0x4c598	16	OBJECT	<unknown>	DEFAULT	13
buf.5444	.symtab	0x4c5a8	440	OBJECT	<unknown>	DEFAULT	13
bzero	.symtab	0x17180	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x46298	4	OBJECT	<unknown>	DEFAULT	12
cal_chksum	.symtab	0xbf2c	264	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x193c4	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x81ec	216	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x82c4	424	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x846c	424	FUNC	<unknown>	DEFAULT	2
cia_bp	.symtab	0x4628c	4	OBJECT	<unknown>	DEFAULT	12
clock	.symtab	0x150fc	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x1b7b8	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x14c88	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x14cec	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4959	.symtab	0x46518	1	OBJECT	<unknown>	DEFAULT	13
connect	.symtab	0x18678	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0xb148	628	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xb5c8	340	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x45a04	0	NOTYPE	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x14790	52	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endprotoent	.symtab	0x1783c	188	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x4c780	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x4c790	4	OBJECT	<unknown>	DEFAULT	13
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x1af40	172	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x1b748	52	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1a6b8	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x3d898	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x15130	436	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T23:57:59.250668+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	44590	154.216.20.70	6478	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 23:57:51.508292913 CET	55622	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:51.513226986 CET	7733	55622	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:51.513550043 CET	55622	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:51.518508911 CET	55622	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:51.520117998 CET	55622	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:51.523371935 CET	7733	55622	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:51.570455074 CET	7733	55622	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:51.887900114 CET	7733	55622	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:51.888029099 CET	55622	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:52.122142076 CET	55624	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:52.127077103 CET	7733	55624	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:52.127202988 CET	55624	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:52.133280039 CET	55624	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:52.138525963 CET	55624	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:52.139003038 CET	7733	55624	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:52.187449932 CET	7733	55624	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:52.514326096 CET	7733	55624	66.59.198.122	192.168.2.14
Jan 8, 2025 23:57:52.514410973 CET	55624	7733	192.168.2.14	66.59.198.122
Jan 8, 2025 23:57:59.240248919 CET	44590	6478	192.168.2.14	154.216.20.70
Jan 8, 2025 23:57:59.245254040 CET	6478	44590	154.216.20.70	192.168.2.14
Jan 8, 2025 23:57:59.245379925 CET	44590	6478	192.168.2.14	154.216.20.70
Jan 8, 2025 23:57:59.245857000 CET	44590	6478	192.168.2.14	154.216.20.70
Jan 8, 2025 23:57:59.250612974 CET	6478	44590	154.216.20.70	192.168.2.14
Jan 8, 2025 23:57:59.250668049 CET	44590	6478	192.168.2.14	154.216.20.70
Jan 8, 2025 23:57:59.255476952 CET	6478	44590	154.216.20.70	192.168.2.14
Jan 8, 2025 23:58:02.294590950 CET	46540	443	192.168.2.14	185.125.190.26
Jan 8, 2025 23:58:33.781368017 CET	46540	443	192.168.2.14	185.125.190.26

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 00:00:36.385879993 CET	56022	53	192.168.2.14	1.1.1.1
Jan 9, 2025 00:00:36.385921955 CET	34314	53	192.168.2.14	1.1.1.1
Jan 9, 2025 00:00:36.392694950 CET	53	56022	1.1.1.1	192.168.2.14
Jan 9, 2025 00:00:36.393032074 CET	53	34314	1.1.1.1	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 00:00:36.385879993 CET	192.168.2.14	1.1.1.1	0x5314	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 00:00:36.385921955 CET	192.168.2.14	1.1.1.1	0x8b27	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 00:00:36.392694950 CET	1.1.1.1	192.168.2.14	0x5314	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 9, 2025 00:00:36.392694950 CET	1.1.1.1	192.168.2.14	0x5314	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: army6.elf PID: 5488, Parent PID: 5412

General

Start time (UTC):	22:57:49
Start date (UTC):	08/01/2025
Path:	/tmp/army6.elf
Arguments:	/tmp/army6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:57:58
Start date (UTC):	08/01/2025
Path:	/tmp/army6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:57:58
Start date (UTC):	08/01/2025
Path:	/tmp/army6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:57:58
Start date (UTC):	08/01/2025
Path:	/tmp/army6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:57:50
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	22:57:50
Start date (UTC):	08/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:57:50
Start date (UTC):	08/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Start time (UTC):	22:57:51
Start date (UTC):	08/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:57:51
Start date (UTC):	08/01/2025
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Start time (UTC):	22:57:51
Start date (UTC):	08/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	22:57:51
Start date (UTC):	08/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:57:51
Start date (UTC):	08/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	22:57:51
Start date (UTC):	08/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:58:01
Start date (UTC):	08/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:58:01
Start date (UTC):	08/01/2025
Path:	/lib/systemd/systemd-user-runtime-dir
Arguments:	/lib/systemd/systemd-user-runtime-dir stop 127
File size:	22672 bytes
MD5 hash:	d55f4b0847f88131dbcfb07435178e54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report army6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: army6.elf PID: 5488, Parent PID: 5412

General

Chronological Activities

Analysis Process: army6.elf PID: 5652, Parent PID: 5488

General

Chronological Activities

Analysis Process: army6.elf PID: 5654, Parent PID: 5488

General

Chronological Activities

Analysis Process: army6.elf PID: 5656, Parent PID: 5654

General

Chronological Activities

Analysis Process: gnome-session-binary PID: 5492, Parent PID: 1383

General

Chronological Activities

Linux Analysis Report
army6.elf