Edit tour

Linux Analysis Report
ssi.elf

Overview

General Information

Sample name:	ssi.elf
Analysis ID:	1589042
MD5:	074033f8d86474698c07cc049b2abef9
SHA1:	80bda8af65af4c2acf99df2ca4cb67f4d0e4a8b2
SHA256:	d7e692e9b170b43d4608d39f6cd9ea2bebdbd151166f572c65496d0df162beaf
Tags:	elfGafgytuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589042
Start date and time:	2025-01-11 08:46:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ssi.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 89.33.192.138:65447

Runtime Messages

Command:	/tmp/ssi.elf
PID:	5438
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

ssi.elf (PID: 5438, Parent: 5357, MD5: 074033f8d86474698c07cc049b2abef9) Arguments: /tmp/ssi.elf

ssi.elf New Fork (PID: 5439, Parent: 5438)

ssi.elf New Fork (PID: 5440, Parent: 5439)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ssi.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
ssi.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
ssi.elf	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
ssi.elf	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1

Memory Dumps

Source	Rule	Description	Author	Strings
5439.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5439.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5439.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5438.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x591:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5438.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x81e:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5438.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xc7b:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:46:58.722745+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37982	89.33.192.138	65447	TCP
2025-01-11T08:47:05.650725+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37984	89.33.192.138	65447	TCP
2025-01-11T08:47:07.100039+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37986	89.33.192.138	65447	TCP
2025-01-11T08:47:08.553285+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37988	89.33.192.138	65447	TCP
2025-01-11T08:47:10.011141+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37990	89.33.192.138	65447	TCP
2025-01-11T08:47:11.457269+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37992	89.33.192.138	65447	TCP
2025-01-11T08:47:12.912966+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37994	89.33.192.138	65447	TCP
2025-01-11T08:47:14.380851+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37996	89.33.192.138	65447	TCP
2025-01-11T08:47:15.834640+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	37998	89.33.192.138	65447	TCP
2025-01-11T08:47:17.269706+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38000	89.33.192.138	65447	TCP
2025-01-11T08:47:18.709147+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38002	89.33.192.138	65447	TCP
2025-01-11T08:47:20.181775+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38004	89.33.192.138	65447	TCP
2025-01-11T08:47:21.633896+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38006	89.33.192.138	65447	TCP
2025-01-11T08:47:25.551912+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38008	89.33.192.138	65447	TCP
2025-01-11T08:47:27.007163+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38010	89.33.192.138	65447	TCP
2025-01-11T08:47:28.441916+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38012	89.33.192.138	65447	TCP
2025-01-11T08:47:35.364812+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38014	89.33.192.138	65447	TCP
2025-01-11T08:47:48.780248+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38016	89.33.192.138	65447	TCP
2025-01-11T08:48:02.206070+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38018	89.33.192.138	65447	TCP
2025-01-11T08:48:03.664894+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38020	89.33.192.138	65447	TCP
2025-01-11T08:48:17.077941+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38022	89.33.192.138	65447	TCP
2025-01-11T08:48:21.041848+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38024	89.33.192.138	65447	TCP
2025-01-11T08:48:39.937015+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38026	89.33.192.138	65447	TCP
2025-01-11T08:48:43.834838+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38028	89.33.192.138	65447	TCP
2025-01-11T08:48:57.285529+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38030	89.33.192.138	65447	TCP
2025-01-11T08:49:04.215629+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38032	89.33.192.138	65447	TCP
2025-01-11T08:49:05.664198+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38034	89.33.192.138	65447	TCP
2025-01-11T08:49:07.294676+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38036	89.33.192.138	65447	TCP
2025-01-11T08:49:08.759778+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38038	89.33.192.138	65447	TCP
2025-01-11T08:49:10.211524+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38040	89.33.192.138	65447	TCP
2025-01-11T08:49:11.665665+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38042	89.33.192.138	65447	TCP
2025-01-11T08:49:18.588756+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38044	89.33.192.138	65447	TCP
2025-01-11T08:49:20.022871+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38046	89.33.192.138	65447	TCP
2025-01-11T08:49:23.965973+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38048	89.33.192.138	65447	TCP
2025-01-11T08:49:25.615062+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38050	89.33.192.138	65447	TCP
2025-01-11T08:49:27.090987+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38052	89.33.192.138	65447	TCP
2025-01-11T08:49:28.539984+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38054	89.33.192.138	65447	TCP
2025-01-11T08:49:29.995244+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38056	89.33.192.138	65447	TCP
2025-01-11T08:49:31.449164+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38058	89.33.192.138	65447	TCP
2025-01-11T08:49:32.898108+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38060	89.33.192.138	65447	TCP
2025-01-11T08:49:34.370250+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38062	89.33.192.138	65447	TCP
2025-01-11T08:49:35.803825+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38064	89.33.192.138	65447	TCP
2025-01-11T08:49:37.278625+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38066	89.33.192.138	65447	TCP
2025-01-11T08:49:38.730173+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38068	89.33.192.138	65447	TCP
2025-01-11T08:49:52.161051+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38070	89.33.192.138	65447	TCP
2025-01-11T08:49:53.602871+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38072	89.33.192.138	65447	TCP
2025-01-11T08:49:55.173530+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38074	89.33.192.138	65447	TCP
2025-01-11T08:49:56.616664+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38076	89.33.192.138	65447	TCP
2025-01-11T08:49:58.072879+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38078	89.33.192.138	65447	TCP
2025-01-11T08:49:59.526698+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38080	89.33.192.138	65447	TCP
2025-01-11T08:50:00.995530+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38082	89.33.192.138	65447	TCP
2025-01-11T08:50:02.448420+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38084	89.33.192.138	65447	TCP
2025-01-11T08:50:03.986301+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38086	89.33.192.138	65447	TCP
2025-01-11T08:50:05.428933+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38088	89.33.192.138	65447	TCP
2025-01-11T08:50:06.866972+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38090	89.33.192.138	65447	TCP
2025-01-11T08:50:08.324366+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38092	89.33.192.138	65447	TCP
2025-01-11T08:50:09.785604+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38094	89.33.192.138	65447	TCP
2025-01-11T08:50:11.277634+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38096	89.33.192.138	65447	TCP
2025-01-11T08:50:12.728421+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38098	89.33.192.138	65447	TCP
2025-01-11T08:50:14.183730+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38100	89.33.192.138	65447	TCP
2025-01-11T08:50:15.633696+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38102	89.33.192.138	65447	TCP
2025-01-11T08:50:17.091486+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38104	89.33.192.138	65447	TCP
2025-01-11T08:50:18.544090+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38106	89.33.192.138	65447	TCP
2025-01-11T08:50:19.994360+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38108	89.33.192.138	65447	TCP
2025-01-11T08:50:21.450244+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38110	89.33.192.138	65447	TCP
2025-01-11T08:50:22.899262+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38112	89.33.192.138	65447	TCP
2025-01-11T08:50:24.336300+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38114	89.33.192.138	65447	TCP
2025-01-11T08:50:28.242275+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38116	89.33.192.138	65447	TCP
2025-01-11T08:50:29.732280+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38118	89.33.192.138	65447	TCP
2025-01-11T08:50:31.184079+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.13	38120	89.33.192.138	65447	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ssi.elf

Avira: detected

Found malware configuration

Source: ssi.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "89.33.192.138:65447"}

Multi AV Scanner detection for submitted file

Source: ssi.elf	Virustotal: Detection: 61%			Perma Link
Source: ssi.elf	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: ssi.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/ssi.elf (PID: 5438)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38002 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38036 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37982 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38046 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38010 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38068 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38064 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38016 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38028 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38044 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38118 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38012 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37994 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37996 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38076 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37992 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38000 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38110 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38034 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38080 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38084 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37988 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38052 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38108 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38098 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37998 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37990 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38008 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38070 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38048 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38088 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38104 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38114 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37984 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38112 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:37986 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38096 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38020 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38032 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38054 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38004 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38042 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38022 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38066 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38024 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38040 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38038 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38106 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38030 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38078 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38060 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38018 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38086 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38006 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38050 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38074 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38058 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38056 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38100 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38014 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38026 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38120 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38062 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38094 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38072 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38082 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38090 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38092 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38116 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.13:38102 -> 89.33.192.138:65447

Source: global traffic

TCP traffic: 192.168.2.13:37982 -> 89.33.192.138:65447

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5439.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5439.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5439.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5438.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5438.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5438.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: ssi.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5439.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5439.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5439.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5438.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5438.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5438.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: ssi.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: ssi.elf, type: SAMPLE

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match

File source: ssi.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "89.33.192.138:65447"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ssi.elf	61%	Virustotal		Browse
ssi.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
ssi.elf	100%	Avira	EXP/ELF.Mirai.Z
ssi.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.33.192.138:65447	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.33.192.138	unknown	Romania		9009	M247GB	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.33.192.138	ssc.elf	Get hash	malicious	Gafgyt	Browse
	ssl.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse
	ssx.elf	Get hash	malicious	Gafgyt	Browse
	ssb.elf	Get hash	malicious	Gafgyt	Browse
	ssy.elf	Get hash	malicious	Gafgyt	Browse
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	sse.elf	Get hash	malicious	Gafgyt	Browse
	ssp.elf	Get hash	malicious	Gafgyt	Browse
185.125.190.26	ssc.elf	Get hash	malicious	Gafgyt	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm7.elf	Get hash	malicious	Unknown	Browse
	boatnet.m68k.elf	Get hash	malicious	Unknown	Browse
	ssh.elf	Get hash	malicious	Gafgyt	Browse
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse
	Space.arm6.elf	Get hash	malicious	Unknown	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	12.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	ssc.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	2.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	ssx.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	M68K.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	X86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	ARMV6L.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	POWERPC.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	ssc.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssl.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sst.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssx.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssb.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssy.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse	89.33.192.138
	sse.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssp.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
CANONICAL-ASGB	I586.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssc.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	ssl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	sst.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	sss.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssb.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ssy.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	I686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ARMV5L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.2623508943147295
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ssi.elf
File size:	76'668 bytes
MD5:	074033f8d86474698c07cc049b2abef9
SHA1:	80bda8af65af4c2acf99df2ca4cb67f4d0e4a8b2
SHA256:	d7e692e9b170b43d4608d39f6cd9ea2bebdbd151166f572c65496d0df162beaf
SHA512:	c24af4f22f3c3ea0d7742d986ab1f89a786e6f0162d20d96e69f14fa5fe6fd3a507a4afc211451016ae4d7bd8c5751ca1aed35e1adecc489db1e8148f7ffbc91
SSDEEP:	1536:1/PKCSudWp8QqCorO7ph6F9Zu23B7oWt8NsEAbtmLI2VOCjXUfJRk:YCS52/CorONh6Zh1OuntmU2VOCbUfJRk
TLSH:	1B734B02EA52C6B3D8830BF602AB97694631F96A1E1B8F99F31C7CF4AB134C87117755
File Content Preview:	.ELF....................h...4...H.......4. ...(..............................................P...P.......i..........Q.td............................U..S.......w....h........[]...$.............U......=.R...t..1....$P.....$P......u........t...$.G..........R

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	56904
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0xa3e4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8052494	0xa494	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x80524c0	0xa4c0	0x2240	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8054700	0xc700	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8055000	0xd000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8055008	0xd008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8055010	0xd010	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8055014	0xd014	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8055020	0xd020	0x2c0	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x80552e0	0xd2e0	0x66e4	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0xd2e0	0xaf8	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xddd8	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xe0c8	0x2a70	0x10	0x0		15	249	4
.strtab	STRTAB	0x0	0x10b38	0x2044	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xc704	0xc704	6.5495	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0xd000	0x8055000	0x8055000	0x2e0	0x69c4	3.5534	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8052494	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80524c0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8054700	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8055000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8055008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8055010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8055014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8055020	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x80552e0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.111.5152	.symtab	0x8052980	96	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x8055320	16384	OBJECT	<unknown>	DEFAULT	11
SendHTTPHex	.symtab	0x804a3e3	431	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8049c33	324	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x8049362	850	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8055014	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8055004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8055000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8055058	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8052dc0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80552d8	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8054400	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8055060	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x80530c0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x805500c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8055008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8054700	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8054700	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8055058	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x8052dc0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x80552d8	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x8054400	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8055060	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x80530c0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x805505c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x80552dc	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x8055064	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804c080	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x80520a8	220	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x804d0c8	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x804f4c8	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804bcac	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804bd04	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x804bec4	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x804ee4c	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x804eec3	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x804d0e8	182	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804bd44	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x804e4f4	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x804e98c	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x804e98c	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8050b38	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804bda0	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x804f238	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804bdd0	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804d67c	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x805b560	4	OBJECT	<unknown>	HIDDEN	11
__GI_exit	.symtab	0x804eae0	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8050bc0	271	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804bcac	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804bd04	63	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8051250	333	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x80520a8	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8051108	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80513a0	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8050cd0	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804be00	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804cea0	49	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8050ce8	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8050d04	231	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804ced4	120	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x80520a8	220	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804f26c	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x804f294	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x804f2bc	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x804f2e4	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x804d318	48	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x804d348	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x804f30c	17	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804be28	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x804f320	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804d6a8	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x804f354	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x805b564	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x804d2f0	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80500b4	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x804d2db	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x804d28c	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x805188d	465	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x80515b2	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x804e8e1	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804be50	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x804d1d4	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804be90	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8052030	86	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x804fee8	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804cf4c	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x804ff0c	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x804ff5c	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x804ff80	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804cf74	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x804f1ac	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x804f37c	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x804f3b0	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804bec4	75	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8050b88	54	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8050b0c	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x804e610	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x804e7e9	94	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x805145c	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804bf28	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804d710	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x804f3e4	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804bf60	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804d744	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x804d778	67	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804bfa0	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804d7bc	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x804e750	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x804f0cf	218	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804d824	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804f434	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x804eb48	393	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804d7f8	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804c088	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x804e847	154	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8052184	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804cf8c	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x805140c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x805140c	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804cfac	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x80514f4	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804cfc8	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x805142c	46	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x804ff34	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804cfdc	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x805008c	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80514c0	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804cff8	206	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804d1b8	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8050030	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x804e9a0	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x804ecd4	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x804d1f4	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804bfc8	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8052088	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804c060	29	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804c0a8	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x804f48c	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804bff8	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x804f4d0	69	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x804f538	133	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x804f518	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804c014	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8055010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8055010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x805b554	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x80552a0	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x804d824	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80552e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x804ee8f	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x805505c	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x80552dc	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x8055064	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805b584	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x8055028	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x8051c2c	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x805224c	217	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8051b10	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8050148	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8052460	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8055020	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x80521bc	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8051a60	175	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8051bbc	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805b54c	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804c080	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805b544	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x80520a8	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8055000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8055000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x8050ae0	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x804f30c	17	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x804d0c8	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x804f4c8	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8055000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8055000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x8052328	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x8051c10	28	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x804bdd0	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804d67c	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x804bf0f	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804bcac	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804bd04	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804be00	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804be28	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8052030	86	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x804f3b0	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804bec4	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x8050b88	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804bf28	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804d710	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804bf60	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804d744	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x804d778	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x804f0cf	218	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805b548	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804bff8	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804c014	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x804e18d	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804d938	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80551b0	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x805b620	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x804e100	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805b9a8	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x805b9b4	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8051d28	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x805089c	579	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x805b550	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8055000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8055000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x804ee8b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x804ee8b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x804ee8b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x804ee8b	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x804ee8b	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x804ee8e	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8050b0c	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8051d59	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x80552c0	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x804f0c7	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x804f0c0	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805b558	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x805b998	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x805b9b8	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x804d8f8	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804d918	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804d8d4	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x804f1c8	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8055074	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x805236c	79	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x804f5c0	128	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8050dec	164	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x804f640	234	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804c1bb	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4160	.symtab	0x80533c0	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80523bc	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80510d4	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80523e4	110	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x804f72c	167	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804c25c	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8055078	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x8050b70	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x804f1fc	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x804ee4c	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x804eec3	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x804ef03	443	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80552b8	4	OBJECT	<unknown>	HIDDEN	10
__xpg_strerror_r	.symtab	0x804d0e8	182	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x804c288	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8050b24	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x805b9bc	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x805b9c0	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80552e0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805b9c4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x805b560	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804bd44	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8052494	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8059340	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804c2be	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x804f93c	1449	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x805b564	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x804f7d4	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x804c8e0	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804cad1	975	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804c950	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804c994	273	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804caa8	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x804ee8e	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x804ee8e	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x805b5a0	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048168	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8050e90	579	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804c158	99	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x805507c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x8055080	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x805116c	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x8059324	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x8055098	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x8059320	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x80550c0	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804c1d2	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80550b0	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x804e9bc	289	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x804f82c	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x80534a0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x804f86c	207	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804c328	1464	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x804e4f4	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x804bd6c	50	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x804e98c	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x804e98c	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x804d1a0	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805b540	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.3001	.symtab	0x805b55c	1	OBJECT	<unknown>	DEFAULT	11
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8050b38	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804d824	175	FUNC	<unknown>	DEFAULT	2
buf.2827	.symtab	0x805b344	16	OBJECT	<unknown>	DEFAULT	11
buf.5162	.symtab	0x805b360	460	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x8055050	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x804bda0	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x804f238	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804bdd0	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x805502c	4	OBJECT	<unknown>	DEFAULT	10
completed.2429	.symtab	0x80552e0	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x804d67c	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048e77	523	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x804bf0f	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049187	159	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x805504c	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x8055028	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805b54c	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x805b560	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x804eae0	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80542c0	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8050bc0	271	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804bcac	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804bd04	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x80482e7	111	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8051250	333	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x80520a8	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8051108	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80513a0	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x805429c	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8050cd0	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804be00	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804cea0	49	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804e335	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8050ce8	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8050ce8	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8050d04	231	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x80496b4	1407	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x804ced4	120	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x804a741	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048c15	55	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8048356	547	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x804a74b	154	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x80482bb	44	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x80520a8	220	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x804f26c	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x804f294	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x804f2bc	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x804f2e4	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x804d318	48	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x804d348	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x804f30c	17	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804be28	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x804f320	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804d6a8	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804d6d4	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x804f354	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8055304	4	OBJECT	<unknown>	DEFAULT	11
h.5161	.symtab	0x805b52c	20	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x805b564	4	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x804d271	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x804d264	13	FUNC	<unknown>	DEFAULT	2
i.4243	.symtab	0x8055054	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x804cf8c	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804d2f0	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80500b4	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x804d2db	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x804d28c	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x805188d	465	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x805177c	273	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x80515b2	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x805152c	134	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804b578	334	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x804818c	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x804e6b5	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x804e8e1	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804be50	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x804d1d4	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x804c04c	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804be90	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8049082	261	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8052030	86	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8055310	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804b6c6	1507	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x8055300	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x80492de	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8048c4c	106	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x8049e75	151	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x804d95e	1954	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x804e4d1	34	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x804fee8	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x804cf4c	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x804ff0c	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x804ff5c	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x804ff80	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804cf74	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x804f1ac	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x804f37c	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80551c8	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80551e0	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805b568	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x804f3b0	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1278	.symtab	0x805b340	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x804d285	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x804d278	13	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8055308	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x80552e4	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804bec4	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805b588	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x8055024	0	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x805b58c	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x8050b88	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4371	.symtab	0x80533e5	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x804887f	722	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8048624	66	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048740	319	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048666	218	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804a7e5	3475	FUNC	<unknown>	DEFAULT	2
qual_chars.4377	.symtab	0x80533f8	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8050b0c	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x804e608	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80481fb	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x804e610	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8054000	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x804e7e9	94	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8055220	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x805145c	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804bf28	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x804d710	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048cb6	449	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x804f3e4	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x804bf60	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804d744	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHTTPtwo	.symtab	0x804a592	431	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x804d778	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804bfa0	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804d7bc	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x804e658	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x804e750	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x804f0cf	218	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x804d824	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804f434	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x804eb48	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804d7f8	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049d77	254	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048b51	196	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4376	.symtab	0x805340c	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4370	.symtab	0x80533f1	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4373	.symtab	0x8053435	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4372	.symtab	0x805344a	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4375	.symtab	0x805341c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4374	.symtab	0x805342c	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804c088	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x804e70c	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x804e70c	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x804e847	154	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x80552bc	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x805b580	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x8055070	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x8055068	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x805506c	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8052184	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x804cf8c	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x805140c	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x805140c	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804cfac	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x80514f4	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x804d0e8	182	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804cfc8	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x805142c	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x804ff34	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804cfdc	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x805008c	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80514c0	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804cff8	206	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x804d1b8	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8050030	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x804e9a0	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x804ecd4	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x804d1f4	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x8049226	184	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804bfc8	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8052088	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804c060	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x8048579	171	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8053452	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805346a	12	OBJECT	<unknown>	DEFAULT	4
unknown.1330	.symtab	0x8053476	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80551f8	28	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x8055030	28	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x804ee1c	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x8049f0c	1239	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x804c0a8	176	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x804f48c	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804bff8	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x804f4d0	69	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x804f538	133	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x804f518	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x804c014	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3285	.symtab	0x80543b4	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:46:58.722745+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37982	89.33.192.138	65447	TCP
2025-01-11T08:47:05.650725+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37984	89.33.192.138	65447	TCP
2025-01-11T08:47:07.100039+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37986	89.33.192.138	65447	TCP
2025-01-11T08:47:08.553285+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37988	89.33.192.138	65447	TCP
2025-01-11T08:47:10.011141+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37990	89.33.192.138	65447	TCP
2025-01-11T08:47:11.457269+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37992	89.33.192.138	65447	TCP
2025-01-11T08:47:12.912966+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37994	89.33.192.138	65447	TCP
2025-01-11T08:47:14.380851+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37996	89.33.192.138	65447	TCP
2025-01-11T08:47:15.834640+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	37998	89.33.192.138	65447	TCP
2025-01-11T08:47:17.269706+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38000	89.33.192.138	65447	TCP
2025-01-11T08:47:18.709147+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38002	89.33.192.138	65447	TCP
2025-01-11T08:47:20.181775+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38004	89.33.192.138	65447	TCP
2025-01-11T08:47:21.633896+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38006	89.33.192.138	65447	TCP
2025-01-11T08:47:25.551912+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38008	89.33.192.138	65447	TCP
2025-01-11T08:47:27.007163+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38010	89.33.192.138	65447	TCP
2025-01-11T08:47:28.441916+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38012	89.33.192.138	65447	TCP
2025-01-11T08:47:35.364812+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38014	89.33.192.138	65447	TCP
2025-01-11T08:47:48.780248+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38016	89.33.192.138	65447	TCP
2025-01-11T08:48:02.206070+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38018	89.33.192.138	65447	TCP
2025-01-11T08:48:03.664894+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38020	89.33.192.138	65447	TCP
2025-01-11T08:48:17.077941+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38022	89.33.192.138	65447	TCP
2025-01-11T08:48:21.041848+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38024	89.33.192.138	65447	TCP
2025-01-11T08:48:39.937015+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38026	89.33.192.138	65447	TCP
2025-01-11T08:48:43.834838+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38028	89.33.192.138	65447	TCP
2025-01-11T08:48:57.285529+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38030	89.33.192.138	65447	TCP
2025-01-11T08:49:04.215629+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38032	89.33.192.138	65447	TCP
2025-01-11T08:49:05.664198+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38034	89.33.192.138	65447	TCP
2025-01-11T08:49:07.294676+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38036	89.33.192.138	65447	TCP
2025-01-11T08:49:08.759778+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38038	89.33.192.138	65447	TCP
2025-01-11T08:49:10.211524+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38040	89.33.192.138	65447	TCP
2025-01-11T08:49:11.665665+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38042	89.33.192.138	65447	TCP
2025-01-11T08:49:18.588756+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38044	89.33.192.138	65447	TCP
2025-01-11T08:49:20.022871+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38046	89.33.192.138	65447	TCP
2025-01-11T08:49:23.965973+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38048	89.33.192.138	65447	TCP
2025-01-11T08:49:25.615062+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38050	89.33.192.138	65447	TCP
2025-01-11T08:49:27.090987+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38052	89.33.192.138	65447	TCP
2025-01-11T08:49:28.539984+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38054	89.33.192.138	65447	TCP
2025-01-11T08:49:29.995244+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38056	89.33.192.138	65447	TCP
2025-01-11T08:49:31.449164+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38058	89.33.192.138	65447	TCP
2025-01-11T08:49:32.898108+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38060	89.33.192.138	65447	TCP
2025-01-11T08:49:34.370250+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38062	89.33.192.138	65447	TCP
2025-01-11T08:49:35.803825+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38064	89.33.192.138	65447	TCP
2025-01-11T08:49:37.278625+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38066	89.33.192.138	65447	TCP
2025-01-11T08:49:38.730173+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38068	89.33.192.138	65447	TCP
2025-01-11T08:49:52.161051+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38070	89.33.192.138	65447	TCP
2025-01-11T08:49:53.602871+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38072	89.33.192.138	65447	TCP
2025-01-11T08:49:55.173530+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38074	89.33.192.138	65447	TCP
2025-01-11T08:49:56.616664+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38076	89.33.192.138	65447	TCP
2025-01-11T08:49:58.072879+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38078	89.33.192.138	65447	TCP
2025-01-11T08:49:59.526698+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38080	89.33.192.138	65447	TCP
2025-01-11T08:50:00.995530+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38082	89.33.192.138	65447	TCP
2025-01-11T08:50:02.448420+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38084	89.33.192.138	65447	TCP
2025-01-11T08:50:03.986301+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38086	89.33.192.138	65447	TCP
2025-01-11T08:50:05.428933+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38088	89.33.192.138	65447	TCP
2025-01-11T08:50:06.866972+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38090	89.33.192.138	65447	TCP
2025-01-11T08:50:08.324366+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38092	89.33.192.138	65447	TCP
2025-01-11T08:50:09.785604+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38094	89.33.192.138	65447	TCP
2025-01-11T08:50:11.277634+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38096	89.33.192.138	65447	TCP
2025-01-11T08:50:12.728421+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38098	89.33.192.138	65447	TCP
2025-01-11T08:50:14.183730+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38100	89.33.192.138	65447	TCP
2025-01-11T08:50:15.633696+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38102	89.33.192.138	65447	TCP
2025-01-11T08:50:17.091486+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38104	89.33.192.138	65447	TCP
2025-01-11T08:50:18.544090+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38106	89.33.192.138	65447	TCP
2025-01-11T08:50:19.994360+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38108	89.33.192.138	65447	TCP
2025-01-11T08:50:21.450244+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38110	89.33.192.138	65447	TCP
2025-01-11T08:50:22.899262+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38112	89.33.192.138	65447	TCP
2025-01-11T08:50:24.336300+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38114	89.33.192.138	65447	TCP
2025-01-11T08:50:28.242275+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38116	89.33.192.138	65447	TCP
2025-01-11T08:50:29.732280+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38118	89.33.192.138	65447	TCP
2025-01-11T08:50:31.184079+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.13	38120	89.33.192.138	65447	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:46:58.717483044 CET	37982	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:46:58.722527981 CET	65447	37982	89.33.192.138	192.168.2.13
Jan 11, 2025 08:46:58.722603083 CET	37982	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:46:58.722744942 CET	37982	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:46:58.727595091 CET	65447	37982	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:05.644771099 CET	65447	37982	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:05.645106077 CET	37982	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:05.645184994 CET	37984	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:05.650165081 CET	65447	37982	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:05.650270939 CET	65447	37984	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:05.650724888 CET	37984	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:05.650724888 CET	37984	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:05.655689955 CET	65447	37984	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:07.095017910 CET	65447	37984	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:07.095160961 CET	37984	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:07.095216036 CET	37986	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:07.099914074 CET	65447	37984	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:07.099960089 CET	65447	37986	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:07.100012064 CET	37986	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:07.100039005 CET	37986	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:07.104789972 CET	65447	37986	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:08.230448008 CET	48202	443	192.168.2.13	185.125.190.26
Jan 11, 2025 08:47:08.548068047 CET	65447	37986	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:08.548275948 CET	37986	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:08.548358917 CET	37988	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:08.553114891 CET	65447	37986	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:08.553163052 CET	65447	37988	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:08.553224087 CET	37988	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:08.553284883 CET	37988	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:08.558013916 CET	65447	37988	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:10.005244970 CET	65447	37988	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:10.005644083 CET	37988	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:10.005696058 CET	37990	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:10.010869026 CET	65447	37988	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:10.010906935 CET	65447	37990	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:10.011008978 CET	37990	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:10.011141062 CET	37990	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:10.016007900 CET	65447	37990	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:11.451997042 CET	65447	37990	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:11.452240944 CET	37992	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:11.452256918 CET	37990	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:11.457144976 CET	65447	37992	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:11.457156897 CET	65447	37990	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:11.457209110 CET	37992	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:11.457268953 CET	37992	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:11.462097883 CET	65447	37992	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:12.907613039 CET	65447	37992	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:12.907881021 CET	37992	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:12.907881021 CET	37994	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:12.912803888 CET	65447	37992	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:12.912816048 CET	65447	37994	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:12.912930965 CET	37994	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:12.912966013 CET	37994	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:12.917798996 CET	65447	37994	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:14.375109911 CET	65447	37994	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:14.375591040 CET	37994	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:14.375658035 CET	37996	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:14.380613089 CET	65447	37994	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:14.380650043 CET	65447	37996	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:14.380765915 CET	37996	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:14.380851030 CET	37996	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:14.385948896 CET	65447	37996	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:15.829380035 CET	65447	37996	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:15.829577923 CET	37996	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:15.829579115 CET	37998	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:15.834503889 CET	65447	37996	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:15.834515095 CET	65447	37998	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:15.834640026 CET	37998	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:15.834640026 CET	37998	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:15.839498043 CET	65447	37998	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:17.264513969 CET	65447	37998	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:17.264650106 CET	37998	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:17.264699936 CET	38000	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:17.269520044 CET	65447	37998	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:17.269546032 CET	65447	38000	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:17.269653082 CET	38000	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:17.269706011 CET	38000	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:17.274548054 CET	65447	38000	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:18.703540087 CET	65447	38000	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:18.703942060 CET	38000	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:18.704031944 CET	38002	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:18.708911896 CET	65447	38000	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:18.708926916 CET	65447	38002	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:18.709074974 CET	38002	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:18.709146976 CET	38002	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:18.713936090 CET	65447	38002	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:20.176435947 CET	65447	38002	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:20.176631927 CET	38002	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:20.176650047 CET	38004	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:20.181605101 CET	65447	38002	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:20.181622028 CET	65447	38004	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:20.181737900 CET	38004	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:20.181775093 CET	38004	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:20.186621904 CET	65447	38004	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:21.628262997 CET	65447	38004	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:21.628770113 CET	38004	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:21.628825903 CET	38006	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:21.633687019 CET	65447	38004	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:21.633701086 CET	65447	38006	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:21.633821964 CET	38006	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:21.633896112 CET	38006	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:21.638618946 CET	65447	38006	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:25.546463966 CET	65447	38006	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:25.546713114 CET	38006	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:25.546730995 CET	38008	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:25.551745892 CET	65447	38006	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:25.551758051 CET	65447	38008	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:25.551840067 CET	38008	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:25.551912069 CET	38008	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:25.556765079 CET	65447	38008	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:27.001411915 CET	65447	38008	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:27.001713037 CET	38008	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:27.001743078 CET	38010	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:27.006972075 CET	65447	38008	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:27.006984949 CET	65447	38010	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:27.007076979 CET	38010	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:27.007163048 CET	38010	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:27.011899948 CET	65447	38010	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:28.436458111 CET	65447	38010	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:28.436758995 CET	38010	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:28.436861038 CET	38012	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:28.441587925 CET	65447	38010	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:28.441710949 CET	65447	38012	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:28.441800117 CET	38012	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:28.441915989 CET	38012	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:28.446696043 CET	65447	38012	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:35.359250069 CET	65447	38012	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:35.359663010 CET	38012	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:35.359709978 CET	38014	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:35.364599943 CET	65447	38012	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:35.364615917 CET	65447	38014	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:35.364716053 CET	38014	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:35.364811897 CET	38014	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:35.369641066 CET	65447	38014	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:38.694441080 CET	48202	443	192.168.2.13	185.125.190.26
Jan 11, 2025 08:47:48.774610996 CET	65447	38014	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:48.775037050 CET	38014	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:48.775087118 CET	38016	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:48.780050993 CET	65447	38014	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:48.780097008 CET	65447	38016	89.33.192.138	192.168.2.13
Jan 11, 2025 08:47:48.780194044 CET	38016	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:48.780247927 CET	38016	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:47:48.785152912 CET	65447	38016	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:02.199436903 CET	65447	38016	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:02.199858904 CET	38016	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:02.199925900 CET	38018	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:02.205857992 CET	65447	38016	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:02.205904961 CET	65447	38018	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:02.205997944 CET	38018	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:02.206069946 CET	38018	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:02.211925983 CET	65447	38018	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:03.659410000 CET	65447	38018	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:03.659755945 CET	38018	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:03.659791946 CET	38020	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:03.664741039 CET	65447	38018	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:03.664783955 CET	65447	38020	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:03.664860010 CET	38020	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:03.664894104 CET	38020	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:03.669779062 CET	65447	38020	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:17.072338104 CET	65447	38020	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:17.072799921 CET	38020	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:17.072926044 CET	38022	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:17.077744007 CET	65447	38020	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:17.077788115 CET	65447	38022	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:17.077856064 CET	38022	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:17.077940941 CET	38022	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:17.082734108 CET	65447	38022	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:21.036092997 CET	65447	38022	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:21.036715984 CET	38022	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:21.036722898 CET	38024	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:21.041636944 CET	65447	38022	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:21.041650057 CET	65447	38024	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:21.041754007 CET	38024	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:21.041847944 CET	38024	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:21.046648026 CET	65447	38024	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:39.931817055 CET	65447	38024	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:39.932079077 CET	38024	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:39.932113886 CET	38026	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:39.936908007 CET	65447	38024	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:39.936919928 CET	65447	38026	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:39.936984062 CET	38026	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:39.937015057 CET	38026	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:39.941771984 CET	65447	38026	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:43.829180002 CET	65447	38026	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:43.829670906 CET	38028	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:43.829724073 CET	38026	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:43.834649086 CET	65447	38028	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:43.834682941 CET	65447	38026	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:43.834794998 CET	38028	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:43.834837914 CET	38028	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:43.839688063 CET	65447	38028	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:57.279870033 CET	65447	38028	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:57.280366898 CET	38028	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:57.280518055 CET	38030	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:57.285264015 CET	65447	38028	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:57.285365105 CET	65447	38030	89.33.192.138	192.168.2.13
Jan 11, 2025 08:48:57.285475016 CET	38030	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:57.285528898 CET	38030	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:48:57.290327072 CET	65447	38030	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:04.210128069 CET	65447	38030	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:04.210398912 CET	38030	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:04.210475922 CET	38032	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:04.215456963 CET	65447	38030	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:04.215473890 CET	65447	38032	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:04.215565920 CET	38032	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:04.215629101 CET	38032	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:04.220396042 CET	65447	38032	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:05.658755064 CET	65447	38032	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:05.659115076 CET	38032	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:05.659190893 CET	38034	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:05.664009094 CET	65447	38032	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:05.664083004 CET	65447	38034	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:05.664196968 CET	38034	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:05.664197922 CET	38034	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:05.668967962 CET	65447	38034	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:07.289272070 CET	65447	38034	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:07.289530039 CET	38034	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:07.289627075 CET	38036	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:07.294461012 CET	65447	38034	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:07.294480085 CET	65447	38036	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:07.294617891 CET	38036	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:07.294676065 CET	38036	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:07.301456928 CET	65447	38036	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:08.754388094 CET	65447	38036	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:08.754705906 CET	38036	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:08.754770994 CET	38038	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:08.759619951 CET	65447	38036	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:08.759632111 CET	65447	38038	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:08.759728909 CET	38038	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:08.759778023 CET	38038	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:08.764564037 CET	65447	38038	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:10.206156969 CET	65447	38038	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:10.206475019 CET	38038	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:10.206501961 CET	38040	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:10.211344004 CET	65447	38038	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:10.211355925 CET	65447	38040	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:10.211463928 CET	38040	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:10.211524010 CET	38040	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:10.216314077 CET	65447	38040	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:11.660569906 CET	65447	38040	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:11.660737038 CET	38040	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:11.660770893 CET	38042	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:11.665564060 CET	65447	38040	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:11.665575027 CET	65447	38042	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:11.665647030 CET	38042	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:11.665664911 CET	38042	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:11.670455933 CET	65447	38042	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:18.583172083 CET	65447	38042	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:18.583520889 CET	38042	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:18.583539963 CET	38044	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:18.588534117 CET	65447	38042	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:18.588565111 CET	65447	38044	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:18.588717937 CET	38044	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:18.588756084 CET	38044	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:18.593555927 CET	65447	38044	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:20.017219067 CET	65447	38044	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:20.017596960 CET	38044	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:20.017689943 CET	38046	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:20.022658110 CET	65447	38044	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:20.022699118 CET	65447	38046	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:20.022824049 CET	38046	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:20.022871017 CET	38046	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:20.027694941 CET	65447	38046	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:23.960352898 CET	65447	38046	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:23.960597038 CET	38046	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:23.960766077 CET	38048	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:23.965492964 CET	65447	38046	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:23.965812922 CET	65447	38048	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:23.965925932 CET	38048	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:23.965972900 CET	38048	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:23.970766068 CET	65447	38048	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:25.609555960 CET	65447	38048	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:25.609811068 CET	38048	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:25.609865904 CET	38050	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:25.614831924 CET	65447	38048	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:25.614873886 CET	65447	38050	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:25.615061998 CET	38050	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:25.615061998 CET	38050	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:25.619961977 CET	65447	38050	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:27.085340977 CET	65447	38050	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:27.085700035 CET	38050	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:27.085746050 CET	38052	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:27.090764046 CET	65447	38050	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:27.090796947 CET	65447	38052	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:27.090948105 CET	38052	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:27.090986967 CET	38052	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:27.095973015 CET	65447	38052	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:28.534760952 CET	65447	38052	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:28.534964085 CET	38052	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:28.535015106 CET	38054	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:28.539834976 CET	65447	38052	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:28.539849997 CET	65447	38054	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:28.539920092 CET	38054	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:28.539983988 CET	38054	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:28.544826984 CET	65447	38054	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:29.988879919 CET	65447	38054	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:29.989257097 CET	38054	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:29.989357948 CET	38056	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:29.995076895 CET	65447	38054	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:29.995085001 CET	65447	38056	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:29.995244026 CET	38056	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:29.995244026 CET	38056	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:30.000628948 CET	65447	38056	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:31.443329096 CET	65447	38056	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:31.443572044 CET	38056	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:31.443619967 CET	38058	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:31.449012995 CET	65447	38056	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:31.449043036 CET	65447	38058	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:31.449110031 CET	38058	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:31.449163914 CET	38058	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:31.453942060 CET	65447	38058	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:32.892771006 CET	65447	38058	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:32.892997026 CET	38060	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:32.893043995 CET	38058	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:32.897937059 CET	65447	38060	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:32.897977114 CET	65447	38058	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:32.898071051 CET	38060	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:32.898108006 CET	38060	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:32.902941942 CET	65447	38060	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:34.364993095 CET	65447	38060	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:34.365267992 CET	38060	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:34.365297079 CET	38062	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:34.370095968 CET	65447	38060	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:34.370129108 CET	65447	38062	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:34.370218992 CET	38062	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:34.370249987 CET	38062	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:34.375037909 CET	65447	38062	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:35.798360109 CET	65447	38062	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:35.798765898 CET	38062	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:35.798852921 CET	38064	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:35.803596020 CET	65447	38062	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:35.803688049 CET	65447	38064	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:35.803771973 CET	38064	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:35.803824902 CET	38064	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:35.819885969 CET	65447	38064	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:37.272459030 CET	65447	38064	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:37.272631884 CET	38064	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:37.272692919 CET	38066	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:37.278496981 CET	65447	38064	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:37.278508902 CET	65447	38066	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:37.278583050 CET	38066	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:37.278625011 CET	38066	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:37.284346104 CET	65447	38066	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:38.724724054 CET	65447	38066	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:38.725020885 CET	38066	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:38.725089073 CET	38068	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:38.729933023 CET	65447	38066	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:38.729945898 CET	65447	38068	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:38.730092049 CET	38068	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:38.730173111 CET	38068	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:38.735246897 CET	65447	38068	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:52.155328035 CET	65447	38068	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:52.155960083 CET	38068	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:52.155960083 CET	38070	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:52.160815954 CET	65447	38068	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:52.160867929 CET	65447	38070	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:52.160991907 CET	38070	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:52.161051035 CET	38070	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:52.167804003 CET	65447	38070	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:53.597683907 CET	65447	38070	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:53.597994089 CET	38072	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:53.598994970 CET	38070	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:53.602726936 CET	65447	38072	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:53.602826118 CET	38072	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:53.602870941 CET	38072	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:53.603740931 CET	65447	38070	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:53.607604980 CET	65447	38072	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:55.168095112 CET	65447	38072	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:55.168380022 CET	38072	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:55.168426037 CET	38074	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:55.173403025 CET	65447	38072	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:55.173408985 CET	65447	38074	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:55.173490047 CET	38074	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:55.173530102 CET	38074	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:55.178256035 CET	65447	38074	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:56.611213923 CET	65447	38074	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:56.611473083 CET	38074	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:56.611597061 CET	38076	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:56.616319895 CET	65447	38074	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:56.616446018 CET	65447	38076	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:56.616581917 CET	38076	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:56.616663933 CET	38076	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:56.621419907 CET	65447	38076	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:58.067550898 CET	65447	38076	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:58.067889929 CET	38076	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:58.067975998 CET	38078	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:58.072675943 CET	65447	38076	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:58.072736979 CET	65447	38078	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:58.072839975 CET	38078	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:58.072879076 CET	38078	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:58.077774048 CET	65447	38078	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:59.521336079 CET	65447	38078	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:59.521545887 CET	38078	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:59.521588087 CET	38080	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:59.526401043 CET	65447	38078	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:59.526413918 CET	65447	38080	89.33.192.138	192.168.2.13
Jan 11, 2025 08:49:59.526563883 CET	38080	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:59.526698112 CET	38080	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:49:59.531481981 CET	65447	38080	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:00.990346909 CET	65447	38080	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:00.990546942 CET	38080	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:00.990602016 CET	38082	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:00.995362997 CET	65447	38080	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:00.995374918 CET	65447	38082	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:00.995507956 CET	38082	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:00.995529890 CET	38082	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:01.000447989 CET	65447	38082	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:02.441708088 CET	65447	38082	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:02.442047119 CET	38082	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:02.442102909 CET	38084	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:02.448208094 CET	65447	38082	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:02.448230028 CET	65447	38084	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:02.448344946 CET	38084	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:02.448420048 CET	38084	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:02.454087973 CET	65447	38084	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:03.980102062 CET	65447	38084	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:03.980496883 CET	38084	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:03.980496883 CET	38086	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:03.986076117 CET	65447	38084	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:03.986088037 CET	65447	38086	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:03.986236095 CET	38086	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:03.986300945 CET	38086	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:03.991426945 CET	65447	38086	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:05.423731089 CET	65447	38086	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:05.423914909 CET	38086	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:05.423975945 CET	38088	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:05.428766966 CET	65447	38086	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:05.428809881 CET	65447	38088	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:05.428890944 CET	38088	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:05.428932905 CET	38088	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:05.433737040 CET	65447	38088	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:06.861588955 CET	65447	38088	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:06.861828089 CET	38088	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:06.861984015 CET	38090	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:06.866791964 CET	65447	38088	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:06.866805077 CET	65447	38090	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:06.866879940 CET	38090	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:06.866971970 CET	38090	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:06.871750116 CET	65447	38090	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:08.318552017 CET	65447	38090	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:08.318793058 CET	38090	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:08.318896055 CET	38092	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:08.324167967 CET	65447	38090	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:08.324174881 CET	65447	38092	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:08.324315071 CET	38092	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:08.324366093 CET	38092	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:08.329601049 CET	65447	38092	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:09.779640913 CET	65447	38092	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:09.780018091 CET	38092	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:09.780420065 CET	38094	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:09.784990072 CET	65447	38092	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:09.785317898 CET	65447	38094	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:09.785484076 CET	38094	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:09.785604000 CET	38094	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:09.790950060 CET	65447	38094	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:11.272414923 CET	65447	38094	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:11.272564888 CET	38094	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:11.272703886 CET	38096	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:11.277314901 CET	65447	38094	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:11.277538061 CET	65447	38096	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:11.277633905 CET	38096	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:11.277633905 CET	38096	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:11.282473087 CET	65447	38096	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:12.722086906 CET	65447	38096	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:12.722315073 CET	38096	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:12.722315073 CET	38098	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:12.728256941 CET	65447	38096	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:12.728276968 CET	65447	38098	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:12.728373051 CET	38098	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:12.728420973 CET	38098	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:12.734173059 CET	65447	38098	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:14.178267002 CET	65447	38098	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:14.178563118 CET	38098	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:14.178685904 CET	38100	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:14.183417082 CET	65447	38098	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:14.183571100 CET	65447	38100	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:14.183659077 CET	38100	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:14.183729887 CET	38100	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:14.188565969 CET	65447	38100	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:15.628540993 CET	65447	38100	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:15.628716946 CET	38100	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:15.628752947 CET	38102	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:15.633580923 CET	65447	38100	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:15.633595943 CET	65447	38102	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:15.633666039 CET	38102	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:15.633696079 CET	38102	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:15.638437986 CET	65447	38102	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:17.086220980 CET	65447	38102	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:17.086462975 CET	38102	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:17.086561918 CET	38104	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:17.091335058 CET	65447	38102	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:17.091347933 CET	65447	38104	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:17.091420889 CET	38104	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:17.091485977 CET	38104	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:17.096282959 CET	65447	38104	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:18.538049936 CET	65447	38104	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:18.538954020 CET	38104	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:18.539000988 CET	38106	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:18.543889046 CET	65447	38104	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:18.543904066 CET	65447	38106	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:18.543982029 CET	38106	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:18.544090033 CET	38106	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:18.548978090 CET	65447	38106	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:19.988785982 CET	65447	38106	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:19.989041090 CET	38106	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:19.989257097 CET	38108	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:19.993961096 CET	65447	38106	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:19.994174004 CET	65447	38108	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:19.994306087 CET	38108	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:19.994359970 CET	38108	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:19.999128103 CET	65447	38108	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:21.444048882 CET	65447	38108	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:21.444291115 CET	38108	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:21.444323063 CET	38110	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:21.450123072 CET	65447	38108	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:21.450140953 CET	65447	38110	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:21.450217962 CET	38110	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:21.450243950 CET	38110	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:21.456149101 CET	65447	38110	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:22.893821001 CET	65447	38110	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:22.894109011 CET	38110	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:22.894118071 CET	38112	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:22.898989916 CET	65447	38110	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:22.899029016 CET	65447	38112	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:22.899080992 CET	38112	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:22.899261951 CET	38112	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:22.904055119 CET	65447	38112	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:24.330925941 CET	65447	38112	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:24.331167936 CET	38112	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:24.331167936 CET	38114	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:24.336071968 CET	65447	38112	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:24.336083889 CET	65447	38114	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:24.336190939 CET	38114	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:24.336299896 CET	38114	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:24.341130972 CET	65447	38114	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:28.236973047 CET	65447	38114	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:28.237179041 CET	38114	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:28.237250090 CET	38116	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:28.242062092 CET	65447	38114	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:28.242109060 CET	65447	38116	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:28.242180109 CET	38116	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:28.242275000 CET	38116	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:28.247155905 CET	65447	38116	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:29.727068901 CET	65447	38116	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:29.727273941 CET	38116	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:29.727356911 CET	38118	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:29.732134104 CET	65447	38116	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:29.732145071 CET	65447	38118	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:29.732225895 CET	38118	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:29.732280016 CET	38118	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:29.737076044 CET	65447	38118	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:31.178354979 CET	65447	38118	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:31.178771019 CET	38118	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:31.178796053 CET	38120	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:31.183839083 CET	65447	38118	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:31.183860064 CET	65447	38120	89.33.192.138	192.168.2.13
Jan 11, 2025 08:50:31.183969021 CET	38120	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:31.184078932 CET	38120	65447	192.168.2.13	89.33.192.138
Jan 11, 2025 08:50:31.188833952 CET	65447	38120	89.33.192.138	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:49:42.891483068 CET	41858	53	192.168.2.13	8.8.8.8
Jan 11, 2025 08:49:42.891566992 CET	55561	53	192.168.2.13	8.8.8.8
Jan 11, 2025 08:49:42.898145914 CET	53	41858	8.8.8.8	192.168.2.13
Jan 11, 2025 08:49:42.898154020 CET	53	55561	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:49:42.891483068 CET	192.168.2.13	8.8.8.8	0xa4ac	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:49:42.891566992 CET	192.168.2.13	8.8.8.8	0x620c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:49:42.898145914 CET	8.8.8.8	192.168.2.13	0xa4ac	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:49:42.898145914 CET	8.8.8.8	192.168.2.13	0xa4ac	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ssi.elf PID: 5438, Parent PID: 5357

General

Start time (UTC):	07:46:57
Start date (UTC):	11/01/2025
Path:	/tmp/ssi.elf
Arguments:	/tmp/ssi.elf
File size:	76668 bytes
MD5 hash:	074033f8d86474698c07cc049b2abef9

Chronological Activities

Analysis Process: ssi.elf PID: 5439, Parent PID: 5438

General

Start time (UTC):	07:46:57
Start date (UTC):	11/01/2025
Path:	/tmp/ssi.elf
Arguments:	-
File size:	76668 bytes
MD5 hash:	074033f8d86474698c07cc049b2abef9

Chronological Activities

Analysis Process: ssi.elf PID: 5440, Parent PID: 5439

General

Start time (UTC):	07:46:57
Start date (UTC):	11/01/2025
Path:	/tmp/ssi.elf
Arguments:	-
File size:	76668 bytes
MD5 hash:	074033f8d86474698c07cc049b2abef9

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ssi.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ssi.elf PID: 5438, Parent PID: 5357

General

Chronological Activities

Analysis Process: ssi.elf PID: 5439, Parent PID: 5438

General

Chronological Activities

Analysis Process: ssi.elf PID: 5440, Parent PID: 5439

General

Linux Analysis Report
ssi.elf