Edit tour

Linux Analysis Report
ssg.elf

Overview

General Information

Sample name:	ssg.elf
Analysis ID:	1588107
MD5:	f7ed48fc0de0651626d9f87b4727df79
SHA1:	ed72b4b70d2709aa1d3ba02c012936c6e429879d
SHA256:	07955ebd5a47d8a8d646b8e62cf7e4af1497609a66a4045a5a90251446e1ffc9
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588107
Start date and time:	2025-01-10 21:25:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ssg.elf
Detection:	MAL
Classification:	mal88.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/ssg.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

ssg.elf (PID: 5432, Parent: 5354, MD5: f7ed48fc0de0651626d9f87b4727df79) Arguments: /tmp/ssg.elf

ssg.elf New Fork (PID: 5433, Parent: 5432)

ssg.elf New Fork (PID: 5434, Parent: 5432)

ssg.elf New Fork (PID: 5435, Parent: 5434)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ssg.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
ssg.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
ssg.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
ssg.elf	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
ssg.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89

Memory Dumps

Source	Rule	Description	Author	Strings
5432.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5432.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5432.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5432.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5434.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5434.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5434.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5434.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
5433.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x937:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5433.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x9d4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5433.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x124e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5433.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x887e:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
Click to see the 7 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:26:32.356391+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57552	89.33.192.138	65487	TCP
2025-01-10T21:26:47.764750+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57554	89.33.192.138	65487	TCP
2025-01-10T21:27:03.192961+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57556	89.33.192.138	65487	TCP
2025-01-10T21:27:18.618744+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57558	89.33.192.138	65487	TCP
2025-01-10T21:27:34.034117+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57560	89.33.192.138	65487	TCP
2025-01-10T21:27:49.456074+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57562	89.33.192.138	65487	TCP
2025-01-10T21:28:04.898622+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57564	89.33.192.138	65487	TCP
2025-01-10T21:28:20.325796+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57566	89.33.192.138	65487	TCP
2025-01-10T21:28:35.734731+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57568	89.33.192.138	65487	TCP
2025-01-10T21:28:51.147029+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57570	89.33.192.138	65487	TCP
2025-01-10T21:29:06.562902+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57572	89.33.192.138	65487	TCP
2025-01-10T21:29:21.974666+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57574	89.33.192.138	65487	TCP
2025-01-10T21:29:37.448854+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57576	89.33.192.138	65487	TCP
2025-01-10T21:29:52.911200+0100	2839491	1	Malware Command and Control Activity Detected	192.168.2.13	57578	89.33.192.138	65487	TCP

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ssg.elf	Virustotal: Detection: 57%			Perma Link
Source: ssg.elf	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: ssg.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/ssg.elf (PID: 5432)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57552 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57556 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57558 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57554 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57566 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57560 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57564 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57562 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57576 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57574 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57568 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57572 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57578 -> 89.33.192.138:65487
Source: Network traffic	Suricata IDS: 2839491 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2 : 192.168.2.13:57570 -> 89.33.192.138:65487

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 89.33.192.138 ports 65487,4,5,6,7,8

Source: global traffic

TCP traffic: 192.168.2.13:57552 -> 89.33.192.138:65487

Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.spre.troj.linELF@0/0@2/0

Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: ssg.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: ssg.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ssg.elf	58%	Virustotal		Browse
ssg.elf	68%	ReversingLabs	Linux.Backdoor.Bashlite
ssg.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.33.192.138	unknown	Romania		9009	M247GB	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.33.192.138	ssy.elf	Get hash	malicious	Gafgyt	Browse
	ssh.elf	Get hash	malicious	Gafgyt	Browse
	ssc.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	ssx.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse
	ssi.elf	Get hash	malicious	Gafgyt	Browse
	sse.elf	Get hash	malicious	Gafgyt	Browse
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	ssh.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	UnHAnaAW.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	UnHAnaAW.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	UnHAnaAW.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	UnHAnaAW.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	ssy.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssh.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssc.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	173.211.38.225
	sst.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	3.elf	Get hash	malicious	Unknown	Browse	38.202.83.251
	ssx.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssi.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sse.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.397520794795983
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ssg.elf
File size:	97'798 bytes
MD5:	f7ed48fc0de0651626d9f87b4727df79
SHA1:	ed72b4b70d2709aa1d3ba02c012936c6e429879d
SHA256:	07955ebd5a47d8a8d646b8e62cf7e4af1497609a66a4045a5a90251446e1ffc9
SHA512:	72647ac0abb4624e96f4d6bdf78b47062323cebb6672ac95d68e47329854c41cbf1f562014365fe36e74f9d227a42718a1a1e48ef35a6561550f54d2bca8c4fb
SSDEEP:	1536:Lvj2YK9xURspSo9MCFP81biDjnFS4UEreqSiUMzHWgyZN3ErCqmFOUk9tvEg51:Lvj21vURsGCFPCCjFS4UEii7WzZNUCqV
TLSH:	70A32951A390D1B3C143177202E7CF260533FEB7275E9E1AD3683EF49B3A08471A5A6A
File Content Preview:	.ELF....................t...4.... ......4. ...(.........................................................Tj..........Q.td............................U..S.......{....x........[]...$.............U......=.....t..D...................(......(.......u........t..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048174
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	73728
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0xdf34	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8055fe4	0xdfe4	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8056000	0xe000	0x2ca4	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8059000	0x11000	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x8059004	0x11004	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x805900c	0x1100c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8059014	0x11014	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8059018	0x11018	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8059024	0x11024	0x2b0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x80592e0	0x112d4	0x6774	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x112d4	0xcba	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x11f8e	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x12280	0x3440	0x10	0x0		15	296	4
.strtab	STRTAB	0x0	0x156c0	0x2746	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x10ca4	0x10ca4	6.5488	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11000	0x8059000	0x8059000	0x2d4	0x6a54	3.7441	0x6	RW	0x1000	.eh_frame .ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8055fe4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8056000	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8059000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8059004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805900c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8059014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8059018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8059024	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x80592e0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.11.3599	.symtab	0x805884c	24	OBJECT	<unknown>	DEFAULT	4
C.152.6307	.symtab	0x80569e0	36	OBJECT	<unknown>	DEFAULT	4
C.156.6349	.symtab	0x8056d80	24	OBJECT	<unknown>	DEFAULT	4
C.186.6634	.symtab	0x8056fa4	20	OBJECT	<unknown>	DEFAULT	4
Hexed	.symtab	0x804a66e	303	FUNC	<unknown>	DEFAULT	2
KHcommSOCK	.symtab	0x8059300	4	OBJECT	<unknown>	DEFAULT	11
KHserverHACKER	.symtab	0x8059060	4	OBJECT	<unknown>	DEFAULT	10
LOCAL_ADDR	.symtab	0x805f560	4	OBJECT	<unknown>	DEFAULT	11
Percocet_bp	.symtab	0x8059040	4	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x8059320	16384	OBJECT	<unknown>	DEFAULT	11
RSF	.symtab	0x804a79d	482	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0x804b1e1	501	FUNC	<unknown>	DEFAULT	2
UDPBYPASS	.symtab	0x8049da5	252	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x8059054	12	OBJECT	<unknown>	DEFAULT	10
_Exit	.symtab	0x804efd4	36	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8059018	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8059008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8059004	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8059074	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8057204	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80592cc	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x80589a4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x805907c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8057504	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8059010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x805900c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8059000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8059000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8059074	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower	.symtab	0x80592cc	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper	.symtab	0x805907c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_b	.symtab	0x8059078	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x80592d0	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x8059080	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804f078	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x804ef14	84	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x805015c	26	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8052704	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x8050630	32	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x8050650	32	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x805060c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8051f4b	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8051faf	48	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x80501a8	190	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804efd4	36	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80515a8	191	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x80519ec	17	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x805403c	43	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x80522fc	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804f030	40	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x805247c	128	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x8052973	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x805299f	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x805270c	615	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8050384	40	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x804eca8	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x805f534	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x8051e84	101	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8052284	48	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8051b2c	90	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8052aa8	244	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x80538b9	282	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x805370c	119	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8053784	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8053aa0	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8052b9c	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804eda4	32	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804fee4	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8054370	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8054388	219	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8054068	67	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804ff14	110	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804ee74	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8052354	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x804ed9c	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x805239c	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8050340	14	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x8050350	50	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8053d78	668	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8055750	666	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x8055a1c	88	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80522e0	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804ed48	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8052328	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x80503ac	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x80522f4	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x805f538	4	OBJECT	<unknown>	HIDDEN	11
__GI_htonl	.symtab	0x8050304	7	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x80502f8	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x8050320	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8053ce4	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8054939	430	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x805467f	467	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8051944	165	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804ef98	59	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x805027c	27	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804ee94	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8055ab8	89	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804ffd0	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8053b00	37	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8053be0	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8050040	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8052234	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x80523fc	58	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x80523a4	44	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80523d0	44	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x8050317	7	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x805030b	12	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804ecdc	66	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x8052584	145	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x804ed20	40	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80559ec	48	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8054014	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8051670	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8051845	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80545f4	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804ee44	48	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x8052680	129	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x805040c	48	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x805043c	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x805235c	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804ee08	58	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x805047c	48	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80504ac	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80504ec	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x805179c	169	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80521e3	80	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x805054c	33	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x8050570	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8050584	135	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804eff8	53	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8051b88	146	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8050524	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804f0a4	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x80518a4	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x8055a74	67	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8055eec	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8050074	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x8053b44	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x804ff98	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x804ff98	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804fffc	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x8053bb0	45	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8055b14	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804ff84	19	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8050018	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804ffb8	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8053cc0	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x8053b28	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8053c94	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8050094	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8050190	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8053b60	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8051a00	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8051ce0	420	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8050298	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804ed50	16	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x8052438	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804f058	29	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x8055ec4	40	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x804ec90	21	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804f0c4	161	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8052250	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804edc4	23	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x80529cc	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8052a28	127	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8052a0c	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804ef68	48	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8059014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8059014	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x805f52c	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x80592a0	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x80592d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8051f83	44	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x80556c4	96	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x8059078	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x80592d0	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x8059080	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805f53c	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x805902c	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x8054ae8	259	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8055bfc	166	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8054bec	1815	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8055fb0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8059024	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8055f24	130	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8055b44	182	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8055ca4	82	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805f524	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804f078	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805f51c	4	OBJECT	<unknown>	HIDDEN	11
__fcntl_nocancel	.symtab	0x804ef14	84	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x8055724	41	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x8054268	264	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80522e0	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x805015c	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8052704	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x804f030	40	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8050384	40	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804eda4	32	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8055ab8	89	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80523d0	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804ecdc	66	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804ee44	48	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x805040c	48	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x805043c	64	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804ee08	58	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x805047c	48	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80504ac	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80521e3	80	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805f520	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804edc4	23	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804ef68	48	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x8058984	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x8051281	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8050670	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80591c4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x805f6c0	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x8051204	125	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805fa48	4	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x805fa4c	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8055cf8	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8055357	876	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x805f528	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8059004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x80592bc	4	OBJECT	<unknown>	DEFAULT	10
__progname_full	.symtab	0x80592c0	4	OBJECT	<unknown>	DEFAULT	10
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8051f1f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8051f1c	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x8055d04	446	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x805fa40	4	OBJECT	<unknown>	HIDDEN	11
__resolv_attempts	.symtab	0x80592c9	1	OBJECT	<unknown>	HIDDEN	10
__resolv_lock	.symtab	0x805f544	24	OBJECT	<unknown>	DEFAULT	11
__resolv_timeout	.symtab	0x80592c8	1	OBJECT	<unknown>	HIDDEN	10
__restore	.symtab	0x80521db	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x80521d4	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805f530	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x805fa44	4	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x805fa50	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x8050630	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8050650	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x805060c	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80522b4	44	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8059090	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8054464	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8052bb4	117	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80544a4	153	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8052e44	232	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804f168	20	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4711	.symtab	0x8057804	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x8054540	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80545c4	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8054568	91	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8052f2c	153	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804f22c	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8059094	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x80521c0	17	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x8052448	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8051f4b	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8051faf	48	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8051fdf	480	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80592b8	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x804ec90	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x80501a8	190	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x80541dc	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x80540ac	163	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x805414f	141	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x805f33c	10	OBJECT	<unknown>	DEFAULT	11
_charpad	.symtab	0x804f254	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x805f668	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_handler	.symtab	0x805f690	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_spec	.symtab	0x80591c0	4	OBJECT	<unknown>	HIDDEN	10
_dl_aux_init	.symtab	0x8054028	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x805fa38	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x805fa3c	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80592d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805fa54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_endswith	.symtab	0x804ea15	125	FUNC	<unknown>	DEFAULT	2
_errno	.symtab	0x805f534	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804efd4	36	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8055fe4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x805d33c	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804f289	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8053144	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x805f538	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8052fc8	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x804e811	47	FUNC	<unknown>	DEFAULT	2
_memmove	.symtab	0x804e840	101	FUNC	<unknown>	DEFAULT	2
_memset	.symtab	0x804e8a5	42	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x804f8f0	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804fad5	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804f958	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804f994	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804faac	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8051f34	23	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8051f22	18	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x805f6b8	8	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048174	34	FUNC	<unknown>	DEFAULT	2
_startswith	.symtab	0x804e9d6	63	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8052c2c	534	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804f17c	58	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8059098	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x805909c	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x80537e8	209	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x805d338	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x80590b4	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x805d334	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x80590d0	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804f1b6	117	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80590cc	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x8051a18	276	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8053020	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strcat	.symtab	0x804e901	55	FUNC	<unknown>	DEFAULT	2
_strcmp	.symtab	0x804e7a7	106	FUNC	<unknown>	DEFAULT	2
_strcpy	.symtab	0x804e8cf	50	FUNC	<unknown>	DEFAULT	2
_strdup	.symtab	0x804e938	54	FUNC	<unknown>	DEFAULT	2
_string_syserrmsgs	.symtab	0x80578d4	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strlen	.symtab	0x804e786	33	FUNC	<unknown>	DEFAULT	2
_strstr	.symtab	0x804e96e	104	FUNC	<unknown>	DEFAULT	2
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8053060	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804f2e7	1545	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80515a8	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x804eddc	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x804b05e	162	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x804e0ae	89	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x80519ec	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x80519ec	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x8050178	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805f518	1	OBJECT	<unknown>	DEFAULT	11
brk	.symtab	0x805403c	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8050584	135	FUNC	<unknown>	DEFAULT	2
buf.5561	.symtab	0x805f34c	440	OBJECT	<unknown>	DEFAULT	11
bzero	.symtab	0x8050268	19	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x8059068	4	OBJECT	<unknown>	DEFAULT	10
calloc	.symtab	0x8050e1c	235	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x8048198	97	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x80481f9	223	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x80482d8	223	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x804f080	34	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x80522fc	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804f030	40	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x805247c	128	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4817	.symtab	0x80592e0	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x8050384	40	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x804941a	459	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049727	168	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x805902c	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x804eca8	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805f524	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x805f534	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x8051e84	101	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8052284	48	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8051b2c	90	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8058880	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8052aa8	244	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804eec0	84	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x80524fc	136	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8048fcf	104	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x805d320	4	OBJECT	<unknown>	DEFAULT	11
fdopendir	.symtab	0x8052615	106	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0x8048ea7	296	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x8048cb2	501	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x80538b9	282	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x805370c	119	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8053784	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8053aa0	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x80496f7	48	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x8058864	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8052b9c	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804eda4	32	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804fee4	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048120	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x80513fc	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8054370	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8054370	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8054388	219	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8054068	67	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x804ff14	110	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x804cf98	5	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x80491b1	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804cd9d	507	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x805370c	119	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x80539d4	204	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x804ee74	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8052354	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x804ed9c	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x805239c	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8050340	14	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x8050350	50	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8053d78	668	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8055750	666	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x8055a1c	88	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x80522e0	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804ed48	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x804ecd4	8	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8052328	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x80503ac	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80503d4	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x80522f4	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x805f538	4	OBJECT	<unknown>	DEFAULT	11
hacks	.symtab	0x8059030	4	OBJECT	<unknown>	DEFAULT	10
hacks2	.symtab	0x8059034	4	OBJECT	<unknown>	DEFAULT	10
hacks3	.symtab	0x8059038	4	OBJECT	<unknown>	DEFAULT	10
hacks4	.symtab	0x805903c	4	OBJECT	<unknown>	DEFAULT	10
hextable	.symtab	0x80562e0	1024	OBJECT	<unknown>	DEFAULT	4
hoste.5560	.symtab	0x805f504	20	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x8050304	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x80502f8	12	FUNC	<unknown>	DEFAULT	2
i.5030	.symtab	0x805906c	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x8050074	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8050320	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8053ce4	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x8054939	430	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8054852	231	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x805467f	467	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8054608	119	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804cc35	360	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x80484cd	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8051709	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8051944	165	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804ef98	59	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x805027c	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804ee94	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x8059310	4	OBJECT	<unknown>	DEFAULT	11
last_id.5618	.symtab	0x80592c4	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.5617	.symtab	0x805f540	4	OBJECT	<unknown>	DEFAULT	11
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x80495e5	274	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8055ab8	89	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8059314	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804cf9d	1663	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x804987a	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x804921f	106	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x804aaed	141	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8050696	1926	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x805158b	29	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x804ffd0	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8053b00	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8053be0	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8050040	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8052234	27	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x80523fc	58	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x80523a4	44	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80591dc	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80591f4	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x80523d0	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x805f348	4	OBJECT	<unknown>	DEFAULT	11
ngPid	.symtab	0x805f568	4	OBJECT	<unknown>	DEFAULT	11
nprocessors_onln	.symtab	0x8051c1c	196	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8050317	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x805030b	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8059308	8	OBJECT	<unknown>	DEFAULT	11
object.4829	.symtab	0x80592e4	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804ecdc	66	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x8052584	145	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805f564	4	OBJECT	<unknown>	DEFAULT	11
p.4815	.symtab	0x8059028	0	OBJECT	<unknown>	DEFAULT	10
parseHex	.symtab	0x8049037	68	FUNC	<unknown>	DEFAULT	2
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x805f570	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x804ed20	40	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x80559ec	48	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x804ed60	58	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4931	.symtab	0x805782c	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8048989	581	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8048756	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048867	290	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048790	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804b3d6	6239	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x80592c0	4	OBJECT	<unknown>	DEFAULT	10
program_invocation_short_name	.symtab	0x80592bc	4	OBJECT	<unknown>	DEFAULT	10
qual_chars.4940	.symtab	0x8057840	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8054014	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8051668	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x804d6d1	102	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x804d737	95	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x80486b1	165	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x80485f3	190	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x804d61c	77	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x804d669	104	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8051670	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8058430	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8051845	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstrings	.symtab	0x8059044	16	OBJECT	<unknown>	DEFAULT	10
randtbl	.symtab	0x8059220	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x80545f4	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804ee44	48	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x8052680	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8050f08	762	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x805040c	48	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8049289	401	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x805043c	64	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.5603	.symtab	0x805f55c	4	OBJECT	<unknown>	DEFAULT	11
resolv_domain_to_hostname	.symtab	0x804d798	125	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x804de03	56	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x804d8a0	1379	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x804d815	139	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x8053b28	26	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x804a313	859	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x805235c	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x805f56c	4	OBJECT	<unknown>	DEFAULT	11
select	.symtab	0x804ee08	58	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x805047c	48	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x804a97f	366	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x80504ac	64	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80504ec	56	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80516b2	87	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x805179c	169	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80521e3	80	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x805054c	33	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x8050570	20	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x8050584	135	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804eff8	53	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x805532c	43	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x8055304	40	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x8051b88	146	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x8050524	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x804b100	225	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048c14	158	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4939	.symtab	0x8057854	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4930	.symtab	0x8057838	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4936	.symtab	0x8057880	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4935	.symtab	0x8057898	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4938	.symtab	0x8057864	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4937	.symtab	0x8057874	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804f0a4	30	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x805175e	61	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x805175e	61	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x80518a4	160	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x8055a74	67	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stderr	.symtab	0x805908c	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x8059084	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x8059088	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8055eec	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8050074	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x8053b44	25	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x804ff98	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x804ff98	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804fffc	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x8053bb0	45	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8055b14	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x80501a8	190	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804ff84	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8050018	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804ffb8	24	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8053cc0	35	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x8053b28	26	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8053c94	42	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8050094	197	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8050190	22	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8053b60	80	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8051a00	23	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x8051ce0	420	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x8048bf0	36	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x805f580	232	OBJECT	<unknown>	DEFAULT	11
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x804de3c	468	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x8059070	4	OBJECT	<unknown>	DEFAULT	10
table_lock_val	.symtab	0x804e045	53	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x804e07a	52	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x804e010	53	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8050298	96	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x8049ea1	1138	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x80497cf	171	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804ed50	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x8052438	16	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x804e107	237	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x804f058	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x804853c	183	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x80578a0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x80578b8	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x80498f8	1197	FUNC	<unknown>	DEFAULT	2
uname	.symtab	0x8055ec4	40	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1473	.symtab	0x80578c4	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x805920c	20	OBJECT	<unknown>	DEFAULT	10
uppercase	.symtab	0x80491ec	51	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x8059064	4	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x8051eec	47	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x804e3a4	424	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x804eb43	129	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x804ebf1	57	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x804ec63	45	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x804ec2a	57	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x804ebc4	45	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x804e54c	253	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x804ea92	177	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x804e353	47	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x804e649	116	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x804e327	44	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x804e28e	106	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x804e2f8	47	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x804e6bd	201	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x804e1f4	40	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x804e21c	114	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x804e382	34	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x804ec90	21	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x804ab7a	1252	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x804f0c4	161	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x805d330	4	OBJECT	<unknown>	DEFAULT	11
wait4	.symtab	0x8052250	52	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804edc4	23	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x80483b8	277	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x8059304	4	OBJECT	<unknown>	DEFAULT	11
wcrtomb	.symtab	0x80529cc	63	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8052a28	127	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8052a0c	27	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x804907b	310	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x804ef68	48	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x805d324	4	OBJECT	<unknown>	DEFAULT	11
xdigits.3497	.symtab	0x8058930	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x805d328	4	OBJECT	<unknown>	DEFAULT	11
z	.symtab	0x805d32c	4	OBJECT	<unknown>	DEFAULT	11
zprintf	.symtab	0x8048bce	34	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:26:32.356391+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57552	89.33.192.138	65487	TCP
2025-01-10T21:26:47.764750+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57554	89.33.192.138	65487	TCP
2025-01-10T21:27:03.192961+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57556	89.33.192.138	65487	TCP
2025-01-10T21:27:18.618744+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57558	89.33.192.138	65487	TCP
2025-01-10T21:27:34.034117+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57560	89.33.192.138	65487	TCP
2025-01-10T21:27:49.456074+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57562	89.33.192.138	65487	TCP
2025-01-10T21:28:04.898622+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57564	89.33.192.138	65487	TCP
2025-01-10T21:28:20.325796+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57566	89.33.192.138	65487	TCP
2025-01-10T21:28:35.734731+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57568	89.33.192.138	65487	TCP
2025-01-10T21:28:51.147029+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57570	89.33.192.138	65487	TCP
2025-01-10T21:29:06.562902+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57572	89.33.192.138	65487	TCP
2025-01-10T21:29:21.974666+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57574	89.33.192.138	65487	TCP
2025-01-10T21:29:37.448854+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57576	89.33.192.138	65487	TCP
2025-01-10T21:29:52.911200+0100	2839491	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M2	1	192.168.2.13	57578	89.33.192.138	65487	TCP

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:26:32.351110935 CET	57552	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:32.356144905 CET	65487	57552	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:32.356328011 CET	57552	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:32.356390953 CET	57552	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:32.361229897 CET	65487	57552	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:32.753725052 CET	65487	57552	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:32.753760099 CET	65487	57552	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:32.754158020 CET	57552	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:32.754158020 CET	57552	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:32.758965015 CET	65487	57552	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:47.759789944 CET	57554	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:47.764641047 CET	65487	57554	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:47.764729977 CET	57554	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:47.764750004 CET	57554	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:47.769550085 CET	65487	57554	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:48.181729078 CET	65487	57554	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:48.181811094 CET	65487	57554	89.33.192.138	192.168.2.13
Jan 10, 2025 21:26:48.182116985 CET	57554	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:48.182301044 CET	57554	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:26:48.187128067 CET	65487	57554	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:03.187752962 CET	57556	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:03.192754030 CET	65487	57556	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:03.192909002 CET	57556	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:03.192960978 CET	57556	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:03.197968006 CET	65487	57556	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:03.607546091 CET	65487	57556	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:03.607570887 CET	65487	57556	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:03.607717991 CET	57556	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:03.607768059 CET	57556	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:03.612588882 CET	65487	57556	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:18.613419056 CET	57558	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:18.618594885 CET	65487	57558	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:18.618706942 CET	57558	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:18.618743896 CET	57558	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:18.623552084 CET	65487	57558	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:19.023992062 CET	65487	57558	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:19.024014950 CET	65487	57558	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:19.024095058 CET	57558	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:19.024266005 CET	57558	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:19.029135942 CET	65487	57558	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:34.029139996 CET	57560	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:34.034003019 CET	65487	57560	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:34.034101963 CET	57560	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:34.034116983 CET	57560	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:34.038832903 CET	65487	57560	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:34.445247889 CET	65487	57560	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:34.445353985 CET	65487	57560	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:34.445437908 CET	57560	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:34.445557117 CET	57560	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:34.450357914 CET	65487	57560	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:49.450793982 CET	57562	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:49.455933094 CET	65487	57562	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:49.456029892 CET	57562	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:49.456073999 CET	57562	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:49.460896015 CET	65487	57562	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:49.888173103 CET	65487	57562	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:49.888191938 CET	65487	57562	89.33.192.138	192.168.2.13
Jan 10, 2025 21:27:49.888364077 CET	57562	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:49.888462067 CET	57562	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:27:49.893249989 CET	65487	57562	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:04.893585920 CET	57564	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:04.898466110 CET	65487	57564	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:04.898595095 CET	57564	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:04.898622036 CET	57564	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:04.903417110 CET	65487	57564	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:05.307501078 CET	65487	57564	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:05.307552099 CET	65487	57564	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:05.307811022 CET	57564	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:05.308000088 CET	57564	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:05.313085079 CET	65487	57564	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:20.320653915 CET	57566	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:20.325649023 CET	65487	57566	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:20.325761080 CET	57566	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:20.325795889 CET	57566	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:20.330545902 CET	65487	57566	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:20.723499060 CET	65487	57566	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:20.723521948 CET	65487	57566	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:20.723645926 CET	57566	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:20.723684072 CET	57566	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:20.728451014 CET	65487	57566	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:35.729598045 CET	57568	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:35.734610081 CET	65487	57568	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:35.734695911 CET	57568	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:35.734730959 CET	57568	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:35.739509106 CET	65487	57568	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:36.132786036 CET	65487	57568	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:36.132824898 CET	65487	57568	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:36.133064032 CET	57568	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:36.133064032 CET	57568	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:36.137904882 CET	65487	57568	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:51.141721964 CET	57570	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:51.146811008 CET	65487	57570	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:51.147028923 CET	57570	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:51.147028923 CET	57570	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:51.151894093 CET	65487	57570	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:51.547568083 CET	65487	57570	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:51.547621012 CET	65487	57570	89.33.192.138	192.168.2.13
Jan 10, 2025 21:28:51.547808886 CET	57570	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:51.547933102 CET	57570	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:28:51.554008961 CET	65487	57570	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:06.557766914 CET	57572	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:06.562789917 CET	65487	57572	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:06.562861919 CET	57572	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:06.562901974 CET	57572	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:06.567653894 CET	65487	57572	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:06.963391066 CET	65487	57572	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:06.963422060 CET	65487	57572	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:06.963649988 CET	57572	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:06.963733912 CET	57572	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:06.968594074 CET	65487	57572	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:21.969542980 CET	57574	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:21.974473000 CET	65487	57574	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:21.974559069 CET	57574	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:21.974666119 CET	57574	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:21.979388952 CET	65487	57574	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:22.438334942 CET	65487	57574	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:22.438363075 CET	65487	57574	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:22.438479900 CET	57574	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:22.438512087 CET	57574	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:22.443298101 CET	65487	57574	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:37.443857908 CET	57576	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:37.448730946 CET	65487	57576	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:37.448822975 CET	57576	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:37.448853970 CET	57576	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:37.453617096 CET	65487	57576	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:37.900686979 CET	65487	57576	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:37.900724888 CET	65487	57576	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:37.900834084 CET	57576	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:37.901071072 CET	57576	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:37.905914068 CET	65487	57576	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:52.905857086 CET	57578	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:52.911061049 CET	65487	57578	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:52.911164045 CET	57578	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:52.911200047 CET	57578	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:52.916090965 CET	65487	57578	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:53.331325054 CET	65487	57578	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:53.331358910 CET	65487	57578	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:53.331476927 CET	57578	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:53.331545115 CET	57578	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:53.543589115 CET	57578	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:53.559849024 CET	65487	57578	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:53.559957027 CET	57578	65487	192.168.2.13	89.33.192.138
Jan 10, 2025 21:29:53.562071085 CET	65487	57578	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:53.562136889 CET	65487	57578	89.33.192.138	192.168.2.13
Jan 10, 2025 21:29:53.562256098 CET	57578	65487	192.168.2.13	89.33.192.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:29:15.561712980 CET	50500	53	192.168.2.13	8.8.8.8
Jan 10, 2025 21:29:15.561781883 CET	50718	53	192.168.2.13	8.8.8.8
Jan 10, 2025 21:29:15.568175077 CET	53	50500	8.8.8.8	192.168.2.13
Jan 10, 2025 21:29:15.568192005 CET	53	50718	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:29:15.561712980 CET	192.168.2.13	8.8.8.8	0x5a5c	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:29:15.561781883 CET	192.168.2.13	8.8.8.8	0x5f8f	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:29:15.568175077 CET	8.8.8.8	192.168.2.13	0x5a5c	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:29:15.568175077 CET	8.8.8.8	192.168.2.13	0x5a5c	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ssg.elf PID: 5432, Parent PID: 5354

General

Start time (UTC):	20:26:31
Start date (UTC):	10/01/2025
Path:	/tmp/ssg.elf
Arguments:	/tmp/ssg.elf
File size:	97798 bytes
MD5 hash:	f7ed48fc0de0651626d9f87b4727df79

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: ssg.elf PID: 5433, Parent PID: 5432

General

Start time (UTC):	20:26:31
Start date (UTC):	10/01/2025
Path:	/tmp/ssg.elf
Arguments:	-
File size:	97798 bytes
MD5 hash:	f7ed48fc0de0651626d9f87b4727df79

File Activities

File Opened

Chronological Activities

Analysis Process: ssg.elf PID: 5434, Parent PID: 5432

General

Start time (UTC):	20:26:31
Start date (UTC):	10/01/2025
Path:	/tmp/ssg.elf
Arguments:	-
File size:	97798 bytes
MD5 hash:	f7ed48fc0de0651626d9f87b4727df79

Process Activities

Process Forked

Chronological Activities

Analysis Process: ssg.elf PID: 5435, Parent PID: 5434

General

Start time (UTC):	20:26:31
Start date (UTC):	10/01/2025
Path:	/tmp/ssg.elf
Arguments:	-
File size:	97798 bytes
MD5 hash:	f7ed48fc0de0651626d9f87b4727df79

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ssg.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ssg.elf PID: 5432, Parent PID: 5354

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: ssg.elf PID: 5433, Parent PID: 5432

General

File Activities

File Opened

Chronological Activities

Analysis Process: ssg.elf PID: 5434, Parent PID: 5432

General

Process Activities

Process Forked

Chronological Activities

Linux Analysis Report
ssg.elf