Edit tour

Linux Analysis Report
ssg.elf

Overview

General Information

Sample name:	ssg.elf
Analysis ID:	1589055
MD5:	d450da464b924a4dedee7ed6149e0770
SHA1:	739726ffe372b1d8c0eeefaedc96052d053bdfc2
SHA256:	ce9988bca518cfc3bdf0458188b00e1e092c6f86e18904b5e294fe1f55505a24
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589055
Start date and time:	2025-01-11 08:55:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ssg.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ssg.elf
PID:	6215
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

ssg.elf (PID: 6215, Parent: 6125, MD5: d450da464b924a4dedee7ed6149e0770) Arguments: /tmp/ssg.elf

ssg.elf New Fork (PID: 6216, Parent: 6215)

ssg.elf New Fork (PID: 6217, Parent: 6216)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ssg.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
ssg.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7da:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
ssg.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x877:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
ssg.elf	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xb79:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
ssg.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x521a:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89

Memory Dumps

Source	Rule	Description	Author	Strings
6216.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7da:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
6216.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x877:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
6216.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xb79:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
6216.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x521a:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
6215.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x7da:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
6215.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x877:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
6215.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0xb79:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
6215.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0x521a:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:56:16.900374+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47620	89.33.192.138	65447	TCP
2025-01-11T08:56:18.342562+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47622	89.33.192.138	65447	TCP
2025-01-11T08:56:19.801289+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47624	89.33.192.138	65447	TCP
2025-01-11T08:56:21.250625+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47626	89.33.192.138	65447	TCP
2025-01-11T08:56:22.702482+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47628	89.33.192.138	65447	TCP
2025-01-11T08:56:24.160732+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47630	89.33.192.138	65447	TCP
2025-01-11T08:56:25.608920+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47632	89.33.192.138	65447	TCP
2025-01-11T08:56:27.046041+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47634	89.33.192.138	65447	TCP
2025-01-11T08:56:28.500551+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47636	89.33.192.138	65447	TCP
2025-01-11T08:56:29.935674+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47638	89.33.192.138	65447	TCP
2025-01-11T08:56:31.375503+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47640	89.33.192.138	65447	TCP
2025-01-11T08:56:32.828997+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47642	89.33.192.138	65447	TCP
2025-01-11T08:56:51.742185+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47644	89.33.192.138	65447	TCP
2025-01-11T08:57:05.168370+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47646	89.33.192.138	65447	TCP
2025-01-11T08:57:09.095467+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47648	89.33.192.138	65447	TCP
2025-01-11T08:57:22.528984+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47650	89.33.192.138	65447	TCP
2025-01-11T08:57:23.988677+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47652	89.33.192.138	65447	TCP
2025-01-11T08:57:25.438736+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47654	89.33.192.138	65447	TCP
2025-01-11T08:57:26.894483+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47656	89.33.192.138	65447	TCP
2025-01-11T08:57:33.831638+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47658	89.33.192.138	65447	TCP
2025-01-11T08:57:47.259188+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47660	89.33.192.138	65447	TCP
2025-01-11T08:57:51.172241+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47662	89.33.192.138	65447	TCP
2025-01-11T08:58:04.587787+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47664	89.33.192.138	65447	TCP
2025-01-11T08:58:06.051097+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47666	89.33.192.138	65447	TCP
2025-01-11T08:58:07.485218+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47668	89.33.192.138	65447	TCP
2025-01-11T08:58:08.922806+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47670	89.33.192.138	65447	TCP
2025-01-11T08:58:10.380577+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47672	89.33.192.138	65447	TCP
2025-01-11T08:58:23.824454+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47674	89.33.192.138	65447	TCP
2025-01-11T08:58:37.295267+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47676	89.33.192.138	65447	TCP
2025-01-11T08:58:44.203064+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47678	89.33.192.138	65447	TCP
2025-01-11T08:58:45.658999+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47680	89.33.192.138	65447	TCP
2025-01-11T08:58:59.091538+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47682	89.33.192.138	65447	TCP
2025-01-11T08:59:00.548583+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47684	89.33.192.138	65447	TCP
2025-01-11T08:59:01.986137+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47686	89.33.192.138	65447	TCP
2025-01-11T08:59:03.424730+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47688	89.33.192.138	65447	TCP
2025-01-11T08:59:04.879333+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47690	89.33.192.138	65447	TCP
2025-01-11T08:59:06.337367+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47692	89.33.192.138	65447	TCP
2025-01-11T08:59:07.784758+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47694	89.33.192.138	65447	TCP
2025-01-11T08:59:09.240393+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47696	89.33.192.138	65447	TCP
2025-01-11T08:59:10.689087+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47698	89.33.192.138	65447	TCP
2025-01-11T08:59:12.142794+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47700	89.33.192.138	65447	TCP
2025-01-11T08:59:13.605779+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47702	89.33.192.138	65447	TCP
2025-01-11T08:59:15.072244+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47704	89.33.192.138	65447	TCP
2025-01-11T08:59:16.550968+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47706	89.33.192.138	65447	TCP
2025-01-11T08:59:18.003711+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47708	89.33.192.138	65447	TCP
2025-01-11T08:59:19.460875+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47710	89.33.192.138	65447	TCP
2025-01-11T08:59:20.908350+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47712	89.33.192.138	65447	TCP
2025-01-11T08:59:22.352473+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47714	89.33.192.138	65447	TCP
2025-01-11T08:59:23.818885+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47716	89.33.192.138	65447	TCP
2025-01-11T08:59:25.269520+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47718	89.33.192.138	65447	TCP
2025-01-11T08:59:26.725402+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47720	89.33.192.138	65447	TCP
2025-01-11T08:59:28.284265+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47722	89.33.192.138	65447	TCP
2025-01-11T08:59:29.740231+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47724	89.33.192.138	65447	TCP
2025-01-11T08:59:31.175271+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47726	89.33.192.138	65447	TCP
2025-01-11T08:59:32.631060+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47728	89.33.192.138	65447	TCP
2025-01-11T08:59:34.098632+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47730	89.33.192.138	65447	TCP
2025-01-11T08:59:35.566457+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47732	89.33.192.138	65447	TCP
2025-01-11T08:59:37.026453+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47734	89.33.192.138	65447	TCP
2025-01-11T08:59:38.472212+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47736	89.33.192.138	65447	TCP
2025-01-11T08:59:39.946696+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47738	89.33.192.138	65447	TCP
2025-01-11T08:59:41.396845+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47740	89.33.192.138	65447	TCP
2025-01-11T08:59:42.849647+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47742	89.33.192.138	65447	TCP
2025-01-11T08:59:44.283354+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47744	89.33.192.138	65447	TCP
2025-01-11T08:59:45.725409+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47746	89.33.192.138	65447	TCP
2025-01-11T08:59:47.178362+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47748	89.33.192.138	65447	TCP
2025-01-11T08:59:48.648584+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47750	89.33.192.138	65447	TCP
2025-01-11T08:59:50.099520+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47752	89.33.192.138	65447	TCP
2025-01-11T08:59:51.570610+0100	2841335	1	Malware Command and Control Activity Detected	192.168.2.23	47754	89.33.192.138	65447	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ssg.elf

Avira: detected

Found malware configuration

Source: ssg.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "89.33.192.138:65447"}

Multi AV Scanner detection for submitted file

Source: ssg.elf	Virustotal: Detection: 58%			Perma Link
Source: ssg.elf	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: ssg.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/ssg.elf (PID: 6215)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47622 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47632 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47636 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47650 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47658 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47644 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47620 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47638 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47626 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47732 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47624 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47666 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47680 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47664 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47646 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47710 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47660 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47672 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47676 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47662 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47630 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47720 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47674 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47642 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47712 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47702 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47706 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47696 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47654 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47670 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47692 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47634 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47694 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47698 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47740 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47656 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47750 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47730 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47684 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47640 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47734 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47746 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47648 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47668 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47688 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47700 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47722 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47690 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47726 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47678 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47718 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47736 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47754 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47716 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47628 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47682 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47744 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47752 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47686 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47738 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47652 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47704 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47728 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47714 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47708 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47742 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47748 -> 89.33.192.138:65447
Source: Network traffic	Suricata IDS: 2841335 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Checkin : 192.168.2.23:47724 -> 89.33.192.138:65447

Source: global traffic

TCP traffic: 192.168.2.23:47620 -> 89.33.192.138:65447

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: ssg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 6216.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@0/0

Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: ssg.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: ssg.elf, type: SAMPLE

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Checkin

Yara detected Gafgyt

Source: Yara match

File source: ssg.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "89.33.192.138:65447"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ssg.elf	59%	Virustotal		Browse
ssg.elf	68%	ReversingLabs	Linux.Trojan.LnxGafgyt
ssg.elf	100%	Avira	EXP/ELF.Mirai.Z
ssg.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.33.192.138:65447	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.33.192.138	unknown	Romania	9009	M247GB	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.33.192.138	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	ssc.elf	Get hash	malicious	Gafgyt	Browse
	ssl.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse
	ssx.elf	Get hash	malicious	Gafgyt	Browse
	ssb.elf	Get hash	malicious	Gafgyt	Browse
	ssy.elf	Get hash	malicious	Gafgyt	Browse
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	sse.elf	Get hash	malicious	Gafgyt	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	I586.elf	Get hash	malicious	Unknown	Browse
	ssl.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse
	ARMV7L.elf	Get hash	malicious	Unknown	Browse
	ssb.elf	Get hash	malicious	Gafgyt	Browse
	ssy.elf	Get hash	malicious	Gafgyt	Browse
	I686.elf	Get hash	malicious	Unknown	Browse
	ARMV5L.elf	Get hash	malicious	Unknown	Browse
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse
91.189.91.42	I586.elf	Get hash	malicious	Unknown	Browse
	ssl.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse
	ARMV7L.elf	Get hash	malicious	Unknown	Browse
	ssb.elf	Get hash	malicious	Gafgyt	Browse
	ssy.elf	Get hash	malicious	Gafgyt	Browse
	I686.elf	Get hash	malicious	Unknown	Browse
	ARMV5L.elf	Get hash	malicious	Unknown	Browse
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	I586.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssc.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	ssl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	sst.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	sss.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssb.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ssy.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	I686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	I586.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssc.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	ssl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	sst.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	sss.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ssb.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	ssy.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	I686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
M247GB	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	89.33.192.138
	ssc.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssl.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sst.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssx.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssb.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssy.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse	89.33.192.138
	sse.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
INIT7CH	I586.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ssl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	sst.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	sss.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	ARMV7L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ssb.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	ssy.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	I686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ARMV5L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ss.elf	Get hash	malicious	Mirai, Gafgyt	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.404018963881222
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ssg.elf
File size:	78'485 bytes
MD5:	d450da464b924a4dedee7ed6149e0770
SHA1:	739726ffe372b1d8c0eeefaedc96052d053bdfc2
SHA256:	ce9988bca518cfc3bdf0458188b00e1e092c6f86e18904b5e294fe1f55505a24
SHA512:	3dbd8070e3023ffaaeb53bdf2ec73279d5631de554004824a931850d2b25ae7a363f3677e1ce14acbda8b9fcb42745f3b86f70cdf5e66efe8bebe8ea2f9e5fc9
SSDEEP:	1536:Q3fotSURUFWDYe3rs0oU/xUtZ6HXn6bz8qmQg26hy9H0Ep:Q3fiSURUFWDprs0oUpUgXns4qmt26M9t
TLSH:	E8735D029791C073C1831B7626E7DB610532FDB71B1A9E66E32C7EF09F02489B16BB65
File Content Preview:	.ELF....................t...4...........4. ...(..............................................P...P......0i..........Q.td............................U..S.......{....x........[]...$.............U......=.R...t..D...................(P.....(P......u........t..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048174
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	57104
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0xa8b4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8052964	0xa964	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8052980	0xa980	0x2384	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8055000	0xd000	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x8055004	0xd004	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x805500c	0xd00c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8055014	0xd014	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8055018	0xd018	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8055024	0xd024	0x298	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x80552c0	0xd2bc	0x6670	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0xd2bc	0xbe2	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xde9e	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xe190	0x2de0	0x10	0x0		15	269	4
.strtab	STRTAB	0x0	0x10f70	0x2325	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xcd04	0xcd04	6.6436	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xd000	0x8055000	0x8055000	0x2bc	0x6930	3.7158	0x6	RW	0x1000	.eh_frame .ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8052964	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8052980	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8055000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8055004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805500c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8055014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8055018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8055024	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x80552c0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.108.5588	.symtab	0x8052e40	96	OBJECT	<unknown>	DEFAULT	4
C.11.3599	.symtab	0x80548b0	24	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x8055300	16384	OBJECT	<unknown>	DEFAULT	11
SendHTTPHex	.symtab	0x804a0dd	386	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8049995	279	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x80491f3	816	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x804b9f8	36	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8055018	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8055008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8055004	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x805505c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8053268	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80552b4	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8054a04	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8055064	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8053568	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8055010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x805500c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8055000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8055000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x805505c	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower	.symtab	0x80552b4	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper	.symtab	0x8055064	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_b	.symtab	0x8055060	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x80552b8	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x8055068	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804ba78	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x804b918	84	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x804fec4	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x804cb10	26	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x804ebf4	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804b8c4	84	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x804cfcc	32	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x804cfec	32	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x804cfa8	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x804e497	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x804e4fb	48	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x804cb5c	190	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804b9f8	36	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x804db5c	191	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x804dfa0	17	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8050914	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804b840	40	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x804e804	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804ba1c	40	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x804e96c	128	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x804ee63	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x804ee8f	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x804ebfc	615	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804cd98	40	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x805b510	4	OBJECT	<unknown>	HIDDEN	11
__GI_exit	.symtab	0x804e0e0	90	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x804ef98	244	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804b8c4	84	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x804fda9	282	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x804fbfc	119	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x804fec4	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x804fc74	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x804ff90	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x804f08c	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804b7a0	32	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804c8c0	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8050cc4	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8050cdc	219	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8050980	67	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804c8f0	110	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x804fec4	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804e888	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x804e830	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x804e838	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x804e880	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x804cd54	14	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x804cd64	50	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8050268	668	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80520cc	666	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x8052398	88	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x804e7e8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804b788	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8050954	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804cdc0	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x804e7fc	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x805b514	4	OBJECT	<unknown>	HIDDEN	11
__GI_htonl	.symtab	0x804ccb8	7	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x804ccac	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x804cd34	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80501d4	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x804cd20	17	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x804ccd4	76	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x80512b5	430	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8050ffb	467	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x804def8	165	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804b9bc	59	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x804cc30	27	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x804ba44	17	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804b898	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8052434	89	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804c9ac	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x804fff0	37	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80500d0	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804c9f4	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x804e76c	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x8050b80	58	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x804e8a8	44	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x804e8d4	44	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x804cccb	7	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x804ccbf	12	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804b744	66	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x804ea74	145	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8052368	48	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8050504	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x804dc24	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x804ddf9	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8050f48	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804b868	48	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x804eb70	129	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804ce20	48	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x804e840	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804b804	58	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804ce50	48	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x804ce80	64	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804b99c	32	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804cec0	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x804dd50	169	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x804e71b	80	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804cf20	135	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804e934	53	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x804e13c	146	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804cef8	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804ba80	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x804de58	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x80523f0	67	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8052868	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804ca28	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x8050034	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x804c974	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x804c974	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804c9d8	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x80500a0	45	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8052490	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804c960	19	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8050f5c	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x804c994	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x80501b0	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x8050018	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8050184	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804ca48	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804cb44	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8050050	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x804dfb4	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x804e294	420	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x804cc4c	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804b790	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804ba58	29	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x8052840	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804baa0	161	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x804e788	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804b7c0	23	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x804eebc	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x804ef18	127	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x804eefc	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804b96c	48	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8055014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8055014	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x805b508	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x8055288	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x80552bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x804e4cf	44	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x8052040	96	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x8055060	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x80552b8	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x8055068	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805b518	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x805502c	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x8051464	259	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8052578	166	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8051568	1815	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8052930	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8055024	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x80528a0	130	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x80524c0	182	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8052620	82	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x805b500	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804ba78	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x805b4f8	4	OBJECT	<unknown>	HIDDEN	11
__fcntl_nocancel	.symtab	0x804b918	84	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x804fec4	204	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8055004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8055004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x80520a0	41	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x8050bbc	264	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x804e7e8	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x804cb10	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x804ebf4	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x8055004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8055004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x804ba1c	40	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804cd98	40	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804b8c4	84	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804b7a0	32	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8052434	89	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x804e8d4	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804b744	66	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804b868	48	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804ce20	48	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804b804	58	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804ce50	48	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x804ce80	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x804e71b	80	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805b4fc	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804b7c0	23	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804b96c	48	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x80549e4	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x804d835	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804d00c	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80551ac	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x805b59c	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x804d7b8	125	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x805b924	4	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x805b928	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8052674	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8051cd3	876	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x805b504	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8055004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8055004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x80552a4	4	OBJECT	<unknown>	DEFAULT	10
__progname_full	.symtab	0x80552a8	4	OBJECT	<unknown>	DEFAULT	10
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x804e46b	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x804e468	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x804e468	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x804e468	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x804e468	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x8052680	446	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x805b91c	4	OBJECT	<unknown>	HIDDEN	11
__resolv_attempts	.symtab	0x80552b1	1	OBJECT	<unknown>	HIDDEN	10
__resolv_lock	.symtab	0x805b520	24	OBJECT	<unknown>	DEFAULT	11
__resolv_timeout	.symtab	0x80552b0	1	OBJECT	<unknown>	HIDDEN	10
__restore	.symtab	0x804e713	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x804e70c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805b50c	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x805b920	4	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x805b92c	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x804cfcc	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804cfec	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804cfa8	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x804e7bc	44	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8055078	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8050db8	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x804f0a4	117	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8050df8	153	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x804f334	232	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804bb44	20	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4711	.symtab	0x8053868	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x8050e94	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8050f18	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8050ebc	91	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x804f41c	153	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804bc08	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x805507c	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x8050940	17	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x804e900	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x804e497	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x804e4fb	48	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x804e52b	480	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80552a0	4	OBJECT	<unknown>	HIDDEN	10
__xpg_strerror_r	.symtab	0x804cb5c	190	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x8050af4	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x80509c4	163	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x8050a67	141	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x805b308	10	OBJECT	<unknown>	DEFAULT	11
_charpad	.symtab	0x804bc30	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x805b544	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_handler	.symtab	0x805b56c	40	OBJECT	<unknown>	HIDDEN	11
_custom_printf_spec	.symtab	0x80551a8	4	OBJECT	<unknown>	HIDDEN	10
_dl_aux_init	.symtab	0x8050900	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x805b914	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x805b918	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80552bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x805b930	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x805b510	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804b9f8	36	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8052964	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8059308	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x804bc65	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x804f634	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x805b514	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x804f4b8	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x804c2cc	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x804c4b1	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x804c334	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x804c370	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x804c488	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x804e480	23	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x804e46e	18	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x805b594	8	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048174	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x804f11c	534	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x804bb58	58	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8055080	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x8055084	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x804fcd8	209	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x8059304	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x805509c	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x8059300	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x80550b8	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804bb92	117	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80550b4	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x804dfcc	276	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x804f510	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8053938	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x804f550	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x804bcc3	1545	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x804db5c	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x804b7d8	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x804dfa0	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x804dfa0	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x804cb2c	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x805b4f4	1	OBJECT	<unknown>	DEFAULT	11
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8050914	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804cf20	135	FUNC	<unknown>	DEFAULT	2
buf.3070	.symtab	0x805b318	16	OBJECT	<unknown>	DEFAULT	11
buf.5561	.symtab	0x805b328	440	OBJECT	<unknown>	DEFAULT	11
bzero	.symtab	0x804cc1c	19	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x8055054	4	OBJECT	<unknown>	DEFAULT	10
calloc	.symtab	0x8050518	235	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x804b840	40	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x804e804	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804ba1c	40	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x804e96c	128	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x8055030	4	OBJECT	<unknown>	DEFAULT	10
completed.4817	.symtab	0x80552c0	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x804cd98	40	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048d45	459	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049022	168	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x8055050	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x805502c	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x805b500	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x805b510	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x804e0e0	90	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80548e0	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x804ef98	244	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804b8c4	84	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x804e9ec	136	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x80482f5	104	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x804eb05	106	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x804fda9	282	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x804fbfc	119	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x804fec4	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x804fc74	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x804ff90	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x80548c8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x804f08c	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804b7a0	32	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804c8c0	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048120	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804d9b0	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8050cc4	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8050cc4	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8050cdc	219	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8050980	67	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x8049523	1138	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x804c8f0	110	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x804a3e1	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048b0f	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804835d	507	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x804a3eb	146	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x80482c5	48	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x804fbfc	119	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x804fec4	204	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x804e888	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x804e830	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x804e838	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x804e880	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x804cd54	14	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x804cd64	50	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8050268	668	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80520cc	666	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x8052398	88	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x804e7e8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804b788	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8050954	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804cdc0	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804cde8	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x804e7fc	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x80552e4	4	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x805b514	4	OBJECT	<unknown>	DEFAULT	11
hoste.5560	.symtab	0x805b4e0	20	OBJECT	<unknown>	DEFAULT	11
htonl	.symtab	0x804ccb8	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x804ccac	12	FUNC	<unknown>	DEFAULT	2
i.4688	.symtab	0x8055058	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x804ca28	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804cd34	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80501d4	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x804cd20	17	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x804ccd4	76	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x80512b5	430	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x80511ce	231	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8050ffb	467	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8050f84	119	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804b07f	306	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8048198	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x804dcbd	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x804def8	165	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804b9bc	59	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x804cc30	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x804ba44	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804b898	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5618	.symtab	0x80552ac	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.5617	.symtab	0x805b51c	4	OBJECT	<unknown>	DEFAULT	11
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8048f10	274	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8052434	89	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x80552f0	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804b1b1	1427	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x80552e0	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x8049175	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8048b4a	106	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x8049b8d	141	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x804d032	1926	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x804db3f	29	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x804c9ac	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x804fff0	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80500d0	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804c9f4	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x804e76c	27	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x8050b80	58	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x804e8a8	44	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80551c4	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80551dc	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x804e8d4	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x805b314	4	OBJECT	<unknown>	DEFAULT	11
nprocessors_onln	.symtab	0x804e1d0	196	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x804cccb	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x804ccbf	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x80552e8	8	OBJECT	<unknown>	DEFAULT	11
object.4829	.symtab	0x80552c4	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804b744	66	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x804ea74	145	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x805b53c	4	OBJECT	<unknown>	DEFAULT	11
p.4815	.symtab	0x8055028	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x805b540	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x8052368	48	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4931	.symtab	0x8053890	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x804882c	581	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x80485f9	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x804870a	290	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8048633	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804a47d	3074	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x80552a8	4	OBJECT	<unknown>	DEFAULT	10
program_invocation_short_name	.symtab	0x80552a4	4	OBJECT	<unknown>	DEFAULT	10
qual_chars.4940	.symtab	0x80538a4	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8050504	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x804dc1c	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x8048207	190	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x804dc24	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8054494	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x804ddf9	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8055208	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8050f48	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804b868	48	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x804eb70	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8050604	762	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x804ce20	48	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048bb4	401	FUNC	<unknown>	DEFAULT	2
resolv_conf_mtime.5603	.symtab	0x805b538	4	OBJECT	<unknown>	DEFAULT	11
rindex	.symtab	0x8050018	26	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x804e840	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x804b804	58	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804ce50	48	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHTTPtwo	.symtab	0x804a25f	386	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x804ce80	64	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804b99c	32	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804cec0	56	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x804dc66	87	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x804dd50	169	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x804e71b	80	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x804cf20	135	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804e934	53	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x8051ca8	43	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x8051c80	40	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x804e13c	146	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804cef8	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049aac	225	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048a71	158	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4939	.symtab	0x80538b8	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4930	.symtab	0x805389c	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4936	.symtab	0x80538e4	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4935	.symtab	0x80538fc	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4938	.symtab	0x80538c8	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4937	.symtab	0x80538d8	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x804ba80	30	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x804dd12	61	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x804dd12	61	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x804de58	160	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x80523f0	67	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stderr	.symtab	0x8055074	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x805506c	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x8055070	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8052868	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x804ca28	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x8050034	25	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x804c974	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x804c974	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x804c9d8	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x80500a0	45	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8052490	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x804cb5c	190	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x804c960	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8050f5c	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x804c994	24	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x80501b0	35	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x8050018	26	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8050184	42	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804ca48	197	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x804cb44	22	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8050050	80	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x804dfb4	23	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x804e294	420	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x804cc4c	96	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x80490ca	171	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804b790	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804ba58	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x8048558	161	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x8053904	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805391c	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x8052840	40	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1473	.symtab	0x8053928	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80551f4	20	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x8055034	28	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x804e438	47	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x8049c1a	1219	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x804baa0	161	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x804e788	52	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804b7c0	23	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x804eebc	63	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x804ef18	127	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x804eefc	27	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x804b96c	48	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3497	.symtab	0x8054990	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:56:16.900374+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47620	89.33.192.138	65447	TCP
2025-01-11T08:56:18.342562+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47622	89.33.192.138	65447	TCP
2025-01-11T08:56:19.801289+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47624	89.33.192.138	65447	TCP
2025-01-11T08:56:21.250625+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47626	89.33.192.138	65447	TCP
2025-01-11T08:56:22.702482+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47628	89.33.192.138	65447	TCP
2025-01-11T08:56:24.160732+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47630	89.33.192.138	65447	TCP
2025-01-11T08:56:25.608920+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47632	89.33.192.138	65447	TCP
2025-01-11T08:56:27.046041+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47634	89.33.192.138	65447	TCP
2025-01-11T08:56:28.500551+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47636	89.33.192.138	65447	TCP
2025-01-11T08:56:29.935674+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47638	89.33.192.138	65447	TCP
2025-01-11T08:56:31.375503+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47640	89.33.192.138	65447	TCP
2025-01-11T08:56:32.828997+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47642	89.33.192.138	65447	TCP
2025-01-11T08:56:51.742185+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47644	89.33.192.138	65447	TCP
2025-01-11T08:57:05.168370+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47646	89.33.192.138	65447	TCP
2025-01-11T08:57:09.095467+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47648	89.33.192.138	65447	TCP
2025-01-11T08:57:22.528984+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47650	89.33.192.138	65447	TCP
2025-01-11T08:57:23.988677+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47652	89.33.192.138	65447	TCP
2025-01-11T08:57:25.438736+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47654	89.33.192.138	65447	TCP
2025-01-11T08:57:26.894483+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47656	89.33.192.138	65447	TCP
2025-01-11T08:57:33.831638+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47658	89.33.192.138	65447	TCP
2025-01-11T08:57:47.259188+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47660	89.33.192.138	65447	TCP
2025-01-11T08:57:51.172241+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47662	89.33.192.138	65447	TCP
2025-01-11T08:58:04.587787+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47664	89.33.192.138	65447	TCP
2025-01-11T08:58:06.051097+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47666	89.33.192.138	65447	TCP
2025-01-11T08:58:07.485218+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47668	89.33.192.138	65447	TCP
2025-01-11T08:58:08.922806+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47670	89.33.192.138	65447	TCP
2025-01-11T08:58:10.380577+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47672	89.33.192.138	65447	TCP
2025-01-11T08:58:23.824454+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47674	89.33.192.138	65447	TCP
2025-01-11T08:58:37.295267+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47676	89.33.192.138	65447	TCP
2025-01-11T08:58:44.203064+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47678	89.33.192.138	65447	TCP
2025-01-11T08:58:45.658999+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47680	89.33.192.138	65447	TCP
2025-01-11T08:58:59.091538+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47682	89.33.192.138	65447	TCP
2025-01-11T08:59:00.548583+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47684	89.33.192.138	65447	TCP
2025-01-11T08:59:01.986137+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47686	89.33.192.138	65447	TCP
2025-01-11T08:59:03.424730+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47688	89.33.192.138	65447	TCP
2025-01-11T08:59:04.879333+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47690	89.33.192.138	65447	TCP
2025-01-11T08:59:06.337367+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47692	89.33.192.138	65447	TCP
2025-01-11T08:59:07.784758+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47694	89.33.192.138	65447	TCP
2025-01-11T08:59:09.240393+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47696	89.33.192.138	65447	TCP
2025-01-11T08:59:10.689087+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47698	89.33.192.138	65447	TCP
2025-01-11T08:59:12.142794+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47700	89.33.192.138	65447	TCP
2025-01-11T08:59:13.605779+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47702	89.33.192.138	65447	TCP
2025-01-11T08:59:15.072244+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47704	89.33.192.138	65447	TCP
2025-01-11T08:59:16.550968+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47706	89.33.192.138	65447	TCP
2025-01-11T08:59:18.003711+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47708	89.33.192.138	65447	TCP
2025-01-11T08:59:19.460875+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47710	89.33.192.138	65447	TCP
2025-01-11T08:59:20.908350+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47712	89.33.192.138	65447	TCP
2025-01-11T08:59:22.352473+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47714	89.33.192.138	65447	TCP
2025-01-11T08:59:23.818885+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47716	89.33.192.138	65447	TCP
2025-01-11T08:59:25.269520+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47718	89.33.192.138	65447	TCP
2025-01-11T08:59:26.725402+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47720	89.33.192.138	65447	TCP
2025-01-11T08:59:28.284265+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47722	89.33.192.138	65447	TCP
2025-01-11T08:59:29.740231+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47724	89.33.192.138	65447	TCP
2025-01-11T08:59:31.175271+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47726	89.33.192.138	65447	TCP
2025-01-11T08:59:32.631060+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47728	89.33.192.138	65447	TCP
2025-01-11T08:59:34.098632+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47730	89.33.192.138	65447	TCP
2025-01-11T08:59:35.566457+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47732	89.33.192.138	65447	TCP
2025-01-11T08:59:37.026453+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47734	89.33.192.138	65447	TCP
2025-01-11T08:59:38.472212+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47736	89.33.192.138	65447	TCP
2025-01-11T08:59:39.946696+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47738	89.33.192.138	65447	TCP
2025-01-11T08:59:41.396845+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47740	89.33.192.138	65447	TCP
2025-01-11T08:59:42.849647+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47742	89.33.192.138	65447	TCP
2025-01-11T08:59:44.283354+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47744	89.33.192.138	65447	TCP
2025-01-11T08:59:45.725409+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47746	89.33.192.138	65447	TCP
2025-01-11T08:59:47.178362+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47748	89.33.192.138	65447	TCP
2025-01-11T08:59:48.648584+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47750	89.33.192.138	65447	TCP
2025-01-11T08:59:50.099520+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47752	89.33.192.138	65447	TCP
2025-01-11T08:59:51.570610+0100	2841335	ETPRO MALWARE ELF/Mirai Variant CnC Checkin	1	192.168.2.23	47754	89.33.192.138	65447	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:56:14.851260900 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 08:56:16.894514084 CET	47620	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:16.900242090 CET	65447	47620	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:16.900311947 CET	47620	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:16.900373936 CET	47620	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:16.905883074 CET	65447	47620	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:18.337133884 CET	65447	47620	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:18.337555885 CET	47620	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:18.337555885 CET	47622	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:18.342451096 CET	65447	47620	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:18.342467070 CET	65447	47622	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:18.342531919 CET	47622	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:18.342561960 CET	47622	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:18.347357988 CET	65447	47622	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:19.795914888 CET	65447	47622	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:19.796252966 CET	47624	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:19.796468973 CET	47622	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:19.801177025 CET	65447	47624	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:19.801254988 CET	47624	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:19.801280975 CET	65447	47622	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:19.801289082 CET	47624	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:19.806086063 CET	65447	47624	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:20.226231098 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 08:56:21.245253086 CET	65447	47624	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:21.245659113 CET	47624	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:21.245659113 CET	47626	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:21.250509024 CET	65447	47624	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:21.250523090 CET	65447	47626	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:21.250582933 CET	47626	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:21.250624895 CET	47626	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:21.255367041 CET	65447	47626	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:21.506115913 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 08:56:22.697139025 CET	65447	47626	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:22.697422028 CET	47628	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:22.697546005 CET	47626	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:22.702334881 CET	65447	47628	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:22.702431917 CET	47628	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:22.702481985 CET	47628	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:22.702529907 CET	65447	47626	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:22.707417011 CET	65447	47628	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:24.155421972 CET	65447	47628	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:24.155708075 CET	47628	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:24.155755997 CET	47630	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:24.160562992 CET	65447	47628	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:24.160578966 CET	65447	47630	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:24.160701990 CET	47630	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:24.160732031 CET	47630	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:24.165484905 CET	65447	47630	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:25.603296995 CET	65447	47630	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:25.603565931 CET	47630	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:25.603621006 CET	47632	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:25.608709097 CET	65447	47630	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:25.608724117 CET	65447	47632	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:25.608830929 CET	47632	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:25.608920097 CET	47632	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:25.614146948 CET	65447	47632	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:27.040652990 CET	65447	47632	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:27.040958881 CET	47632	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:27.041047096 CET	47634	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:27.045818090 CET	65447	47632	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:27.045888901 CET	65447	47634	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:27.045954943 CET	47634	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:27.046041012 CET	47634	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:27.050796986 CET	65447	47634	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:28.495281935 CET	65447	47634	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:28.495508909 CET	47634	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:28.495590925 CET	47636	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:28.500329971 CET	65447	47634	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:28.500397921 CET	65447	47636	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:28.500464916 CET	47636	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:28.500550985 CET	47636	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:28.505283117 CET	65447	47636	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:29.930233002 CET	65447	47636	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:29.930543900 CET	47636	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:29.930598021 CET	47638	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:29.935473919 CET	65447	47636	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:29.935513973 CET	65447	47638	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:29.935590982 CET	47638	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:29.935673952 CET	47638	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:29.940642118 CET	65447	47638	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:31.369391918 CET	65447	47638	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:31.369641066 CET	47640	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:31.369647026 CET	47638	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:31.375395060 CET	65447	47640	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:31.375418901 CET	65447	47638	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:31.375453949 CET	47640	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:31.375503063 CET	47640	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:31.383214951 CET	65447	47640	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:32.823647022 CET	65447	47640	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:32.823952913 CET	47642	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:32.823987961 CET	47640	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:32.828886986 CET	65447	47642	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:32.828901052 CET	65447	47640	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:32.828943014 CET	47642	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:32.828996897 CET	47642	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:32.833823919 CET	65447	47642	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:34.816214085 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 08:56:47.102680922 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 08:56:51.197957039 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 08:56:51.736828089 CET	65447	47642	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:51.737113953 CET	47642	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:51.737166882 CET	47644	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:51.742026091 CET	65447	47642	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:51.742039919 CET	65447	47644	89.33.192.138	192.168.2.23
Jan 11, 2025 08:56:51.742114067 CET	47644	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:51.742185116 CET	47644	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:56:51.746918917 CET	65447	47644	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:05.161796093 CET	65447	47644	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:05.162056923 CET	47644	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:05.162095070 CET	47646	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:05.168201923 CET	65447	47644	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:05.168214083 CET	65447	47646	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:05.168286085 CET	47646	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:05.168370008 CET	47646	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:05.174592972 CET	65447	47646	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:09.089890003 CET	65447	47646	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:09.090169907 CET	47646	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:09.090400934 CET	47648	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:09.095050097 CET	65447	47646	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:09.095222950 CET	65447	47648	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:09.095331907 CET	47648	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:09.095467091 CET	47648	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:09.100182056 CET	65447	47648	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:15.770447969 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 08:57:22.523083925 CET	65447	47648	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:22.523787975 CET	47648	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:22.523787975 CET	47650	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:22.528801918 CET	65447	47648	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:22.528817892 CET	65447	47650	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:22.528944969 CET	47650	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:22.528984070 CET	47650	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:22.533710003 CET	65447	47650	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:23.982619047 CET	65447	47650	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:23.982929945 CET	47650	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:23.982996941 CET	47652	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:23.988487959 CET	65447	47650	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:23.988504887 CET	65447	47652	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:23.988600969 CET	47652	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:23.988677025 CET	47652	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:23.993457079 CET	65447	47652	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:25.433474064 CET	65447	47652	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:25.433732033 CET	47652	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:25.433830976 CET	47654	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:25.438483000 CET	65447	47652	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:25.438590050 CET	65447	47654	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:25.438682079 CET	47654	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:25.438735962 CET	47654	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:25.443926096 CET	65447	47654	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:26.888941050 CET	65447	47654	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:26.889475107 CET	47654	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:26.889477968 CET	47656	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:26.894356966 CET	65447	47654	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:26.894392014 CET	65447	47656	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:26.894445896 CET	47656	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:26.894483089 CET	47656	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:26.899271965 CET	65447	47656	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:33.826101065 CET	65447	47656	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:33.826546907 CET	47656	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:33.826591015 CET	47658	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:33.831449032 CET	65447	47656	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:33.831464052 CET	65447	47658	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:33.831548929 CET	47658	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:33.831638098 CET	47658	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:33.836703062 CET	65447	47658	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:47.253667116 CET	65447	47658	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:47.253971100 CET	47658	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:47.253984928 CET	47660	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:47.258959055 CET	65447	47658	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:47.258980036 CET	65447	47660	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:47.259092093 CET	47660	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:47.259187937 CET	47660	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:47.263926029 CET	65447	47660	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:51.166692019 CET	65447	47660	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:51.167090893 CET	47660	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:51.167164087 CET	47662	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:51.172054052 CET	65447	47660	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:51.172068119 CET	65447	47662	89.33.192.138	192.168.2.23
Jan 11, 2025 08:57:51.172153950 CET	47662	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:51.172240973 CET	47662	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:57:51.177004099 CET	65447	47662	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:04.582408905 CET	65447	47662	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:04.582636118 CET	47662	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:04.582658052 CET	47664	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:04.587601900 CET	65447	47662	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:04.587619066 CET	65447	47664	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:04.587687969 CET	47664	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:04.587786913 CET	47664	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:04.592590094 CET	65447	47664	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:06.045928001 CET	65447	47664	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:06.046113014 CET	47664	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:06.046159029 CET	47666	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:06.050960064 CET	65447	47664	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:06.050976992 CET	65447	47666	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:06.051096916 CET	47666	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:06.051096916 CET	47666	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:06.055890083 CET	65447	47666	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:07.479806900 CET	65447	47666	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:07.480073929 CET	47666	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:07.480129957 CET	47668	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:07.485016108 CET	65447	47666	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:07.485033035 CET	65447	47668	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:07.485132933 CET	47668	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:07.485218048 CET	47668	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:07.490117073 CET	65447	47668	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:08.917135954 CET	65447	47668	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:08.917620897 CET	47668	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:08.917663097 CET	47670	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:08.922665119 CET	65447	47668	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:08.922709942 CET	65447	47670	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:08.922775984 CET	47670	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:08.922806025 CET	47670	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:08.927678108 CET	65447	47670	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:10.374356031 CET	65447	47670	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:10.374747038 CET	47670	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:10.374851942 CET	47672	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:10.380256891 CET	65447	47670	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:10.380425930 CET	65447	47672	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:10.380496025 CET	47672	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:10.380577087 CET	47672	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:10.385458946 CET	65447	47672	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:23.818768978 CET	65447	47672	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:23.818996906 CET	47672	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:23.818996906 CET	47674	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:23.824352026 CET	65447	47672	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:23.824367046 CET	65447	47674	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:23.824414968 CET	47674	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:23.824454069 CET	47674	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:23.830334902 CET	65447	47674	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:37.289818048 CET	65447	47674	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:37.290080070 CET	47674	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:37.290160894 CET	47676	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:37.294939995 CET	65447	47674	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:37.295087099 CET	65447	47676	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:37.295176029 CET	47676	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:37.295267105 CET	47676	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:37.300071001 CET	65447	47676	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:44.197729111 CET	65447	47676	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:44.197961092 CET	47676	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:44.198029041 CET	47678	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:44.202799082 CET	65447	47676	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:44.202812910 CET	65447	47678	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:44.202871084 CET	47678	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:44.203063965 CET	47678	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:44.207850933 CET	65447	47678	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:45.653578997 CET	65447	47678	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:45.653878927 CET	47678	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:45.653933048 CET	47678	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:45.654035091 CET	47680	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:45.658736944 CET	65447	47678	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:45.658835888 CET	65447	47680	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:45.658926010 CET	47680	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:45.658998966 CET	47680	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:45.663722038 CET	65447	47680	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:59.086391926 CET	65447	47680	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:59.086478949 CET	47680	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:59.086519957 CET	47682	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:59.091402054 CET	65447	47680	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:59.091435909 CET	65447	47682	89.33.192.138	192.168.2.23
Jan 11, 2025 08:58:59.091491938 CET	47682	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:59.091537952 CET	47682	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:58:59.096322060 CET	65447	47682	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:00.543399096 CET	65447	47682	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:00.543519020 CET	47684	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:00.543539047 CET	47682	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:00.548496008 CET	65447	47684	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:00.548526049 CET	65447	47682	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:00.548544884 CET	47684	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:00.548583031 CET	47684	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:00.553426981 CET	65447	47684	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:01.980827093 CET	65447	47684	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:01.981093884 CET	47684	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:01.981131077 CET	47686	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:01.986011028 CET	65447	47684	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:01.986047029 CET	65447	47686	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:01.986099005 CET	47686	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:01.986136913 CET	47686	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:01.992439032 CET	65447	47686	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:03.418111086 CET	65447	47686	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:03.418327093 CET	47686	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:03.418375015 CET	47688	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:03.424578905 CET	65447	47686	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:03.424613953 CET	65447	47688	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:03.424681902 CET	47688	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:03.424730062 CET	47688	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:03.429565907 CET	65447	47688	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:04.873893976 CET	65447	47688	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:04.874229908 CET	47690	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:04.874229908 CET	47688	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:04.879170895 CET	65447	47690	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:04.879188061 CET	65447	47688	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:04.879236937 CET	47690	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:04.879333019 CET	47690	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:04.884133101 CET	65447	47690	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:06.332206964 CET	65447	47690	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:06.332465887 CET	47692	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:06.332468987 CET	47690	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:06.337264061 CET	65447	47690	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:06.337276936 CET	65447	47692	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:06.337326050 CET	47692	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:06.337367058 CET	47692	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:06.342127085 CET	65447	47692	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:07.779378891 CET	65447	47692	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:07.779730082 CET	47692	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:07.779730082 CET	47694	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:07.784575939 CET	65447	47692	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:07.784591913 CET	65447	47694	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:07.784734964 CET	47694	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:07.784758091 CET	47694	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:07.790041924 CET	65447	47694	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:09.234862089 CET	65447	47694	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:09.235347033 CET	47694	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:09.235395908 CET	47696	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:09.240268946 CET	65447	47694	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:09.240283012 CET	65447	47696	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:09.240341902 CET	47696	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:09.240392923 CET	47696	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:09.245132923 CET	65447	47696	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:10.683809996 CET	65447	47696	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:10.684097052 CET	47696	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:10.684129953 CET	47698	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:10.688976049 CET	65447	47696	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:10.688987970 CET	65447	47698	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:10.689032078 CET	47698	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:10.689086914 CET	47698	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:10.694000006 CET	65447	47698	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:12.137341022 CET	65447	47698	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:12.137635946 CET	47700	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:12.137649059 CET	47698	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:12.142553091 CET	65447	47700	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:12.142565012 CET	65447	47698	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:12.142606974 CET	47700	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:12.142793894 CET	47700	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:12.147572041 CET	65447	47700	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:13.593158007 CET	65447	47700	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:13.593432903 CET	47700	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:13.593594074 CET	47702	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:13.605549097 CET	65447	47700	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:13.605585098 CET	65447	47702	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:13.605745077 CET	47702	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:13.605778933 CET	47702	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:13.618029118 CET	65447	47702	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:15.060719013 CET	65447	47702	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:15.061009884 CET	47702	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:15.061100006 CET	47704	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:15.072040081 CET	65447	47702	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:15.072056055 CET	65447	47704	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:15.072149038 CET	47704	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:15.072243929 CET	47704	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:15.082099915 CET	65447	47704	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:16.545149088 CET	65447	47704	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:16.545485973 CET	47704	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:16.545595884 CET	47706	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:16.550759077 CET	65447	47704	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:16.550808907 CET	65447	47706	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:16.550895929 CET	47706	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:16.550967932 CET	47706	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:16.556016922 CET	65447	47706	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:17.998143911 CET	65447	47706	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:17.998292923 CET	47706	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:17.998331070 CET	47708	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:18.003586054 CET	65447	47706	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:18.003623009 CET	65447	47708	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:18.003678083 CET	47708	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:18.003710985 CET	47708	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:18.009655952 CET	65447	47708	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:19.455468893 CET	65447	47708	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:19.455734968 CET	47708	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:19.455835104 CET	47710	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:19.460683107 CET	65447	47708	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:19.460746050 CET	65447	47710	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:19.460819006 CET	47710	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:19.460875034 CET	47710	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:19.466387033 CET	65447	47710	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:20.902868032 CET	65447	47710	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:20.903188944 CET	47710	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:20.903201103 CET	47712	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:20.908122063 CET	65447	47710	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:20.908155918 CET	65447	47712	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:20.908296108 CET	47712	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:20.908349991 CET	47712	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:20.913194895 CET	65447	47712	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:22.340236902 CET	65447	47712	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:22.340647936 CET	47712	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:22.340715885 CET	47714	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:22.352282047 CET	65447	47712	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:22.352318048 CET	65447	47714	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:22.352417946 CET	47714	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:22.352473021 CET	47714	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:22.362220049 CET	65447	47714	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:23.813090086 CET	65447	47714	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:23.813239098 CET	47714	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:23.813290119 CET	47716	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:23.818711042 CET	65447	47714	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:23.818723917 CET	65447	47716	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:23.818825006 CET	47716	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:23.818885088 CET	47716	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:23.823715925 CET	65447	47716	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:25.263000965 CET	65447	47716	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:25.263217926 CET	47716	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:25.263304949 CET	47718	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:25.269345045 CET	65447	47716	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:25.269378901 CET	65447	47718	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:25.269449949 CET	47718	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:25.269520044 CET	47718	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:25.274662971 CET	65447	47718	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:26.720124960 CET	65447	47718	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:26.720372915 CET	47720	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:26.720376968 CET	47718	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:26.725265980 CET	65447	47718	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:26.725300074 CET	65447	47720	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:26.725370884 CET	47720	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:26.725402117 CET	47720	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:26.730285883 CET	65447	47720	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:28.275296926 CET	65447	47720	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:28.275573015 CET	47720	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:28.275602102 CET	47722	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:28.284076929 CET	65447	47720	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:28.284094095 CET	65447	47722	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:28.284171104 CET	47722	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:28.284265041 CET	47722	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:28.291778088 CET	65447	47722	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:29.734980106 CET	65447	47722	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:29.735250950 CET	47724	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:29.735249996 CET	47722	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:29.740082979 CET	65447	47722	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:29.740103006 CET	65447	47724	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:29.740178108 CET	47724	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:29.740231037 CET	47724	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:29.744986057 CET	65447	47724	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:31.168734074 CET	65447	47724	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:31.169204950 CET	47724	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:31.169244051 CET	47726	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:31.175132990 CET	65447	47724	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:31.175147057 CET	65447	47726	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:31.175225973 CET	47726	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:31.175271034 CET	47726	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:31.180717945 CET	65447	47726	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:32.625638008 CET	65447	47726	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:32.625994921 CET	47728	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:32.626008034 CET	47726	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:32.630842924 CET	65447	47726	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:32.630896091 CET	65447	47728	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:32.631007910 CET	47728	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:32.631059885 CET	47728	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:32.635822058 CET	65447	47728	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:34.093342066 CET	65447	47728	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:34.093630075 CET	47728	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:34.093630075 CET	47730	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:34.098505974 CET	65447	47728	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:34.098517895 CET	65447	47730	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:34.098592997 CET	47730	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:34.098632097 CET	47730	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:34.104633093 CET	65447	47730	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:35.561053991 CET	65447	47730	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:35.561423063 CET	47730	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:35.561476946 CET	47732	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:35.566220999 CET	65447	47730	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:35.566307068 CET	65447	47732	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:35.566370010 CET	47732	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:35.566457033 CET	47732	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:35.571809053 CET	65447	47732	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:37.021167994 CET	65447	47732	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:37.021450996 CET	47734	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:37.021450996 CET	47732	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:37.026355028 CET	65447	47734	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:37.026367903 CET	65447	47732	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:37.026412010 CET	47734	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:37.026453018 CET	47734	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:37.031240940 CET	65447	47734	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:38.465167999 CET	65447	47734	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:38.465461016 CET	47734	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:38.465523005 CET	47736	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:38.470238924 CET	65447	47734	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:38.470380068 CET	65447	47736	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:38.470455885 CET	47736	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:38.472212076 CET	47736	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:38.477030039 CET	65447	47736	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:39.940767050 CET	65447	47736	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:39.941082001 CET	47736	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:39.941106081 CET	47738	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:39.946448088 CET	65447	47736	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:39.946599007 CET	65447	47738	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:39.946655989 CET	47738	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:39.946696043 CET	47738	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:39.951417923 CET	65447	47738	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:41.391530991 CET	65447	47738	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:41.391767979 CET	47738	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:41.391808033 CET	47740	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:41.396703005 CET	65447	47738	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:41.396737099 CET	65447	47740	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:41.396797895 CET	47740	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:41.396845102 CET	47740	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:41.401633978 CET	65447	47740	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:42.844516039 CET	65447	47740	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:42.844712019 CET	47740	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:42.844758987 CET	47742	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:42.849543095 CET	65447	47740	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:42.849561930 CET	65447	47742	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:42.849601030 CET	47742	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:42.849647045 CET	47742	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:42.855417013 CET	65447	47742	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:44.276822090 CET	65447	47742	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:44.276969910 CET	47742	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:44.277014017 CET	47744	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:44.282493114 CET	65447	47742	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:44.282502890 CET	65447	47744	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:44.282553911 CET	47744	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:44.283354044 CET	47744	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:44.289412975 CET	65447	47744	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:45.716384888 CET	65447	47744	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:45.716613054 CET	47744	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:45.716613054 CET	47746	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:45.725210905 CET	65447	47744	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:45.725240946 CET	65447	47746	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:45.725316048 CET	47746	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:45.725409031 CET	47746	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:45.731446028 CET	65447	47746	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:47.172935963 CET	65447	47746	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:47.173331976 CET	47746	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:47.173424959 CET	47748	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:47.178155899 CET	65447	47746	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:47.178215981 CET	65447	47748	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:47.178294897 CET	47748	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:47.178361893 CET	47748	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:47.183161020 CET	65447	47748	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:48.643368959 CET	65447	47748	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:48.643523932 CET	47748	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:48.643554926 CET	47750	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:48.648375034 CET	65447	47748	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:48.648422956 CET	65447	47750	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:48.648509979 CET	47750	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:48.648583889 CET	47750	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:48.653466940 CET	65447	47750	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:50.092777967 CET	65447	47750	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:50.092969894 CET	47750	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:50.093022108 CET	47752	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:50.098927021 CET	65447	47750	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:50.098942041 CET	65447	47752	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:50.099482059 CET	47752	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:50.099519968 CET	47752	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:50.105123043 CET	65447	47752	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:51.564830065 CET	65447	47752	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:51.565150023 CET	47752	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:51.565150023 CET	47754	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:51.570291996 CET	65447	47752	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:51.570342064 CET	65447	47754	89.33.192.138	192.168.2.23
Jan 11, 2025 08:59:51.570439100 CET	47754	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:51.570610046 CET	47754	65447	192.168.2.23	89.33.192.138
Jan 11, 2025 08:59:51.576478004 CET	65447	47754	89.33.192.138	192.168.2.23

System Behavior

Analysis Process: ssg.elf PID: 6215, Parent PID: 6125

General

Start time (UTC):	07:56:16
Start date (UTC):	11/01/2025
Path:	/tmp/ssg.elf
Arguments:	/tmp/ssg.elf
File size:	78485 bytes
MD5 hash:	d450da464b924a4dedee7ed6149e0770

Chronological Activities

Analysis Process: ssg.elf PID: 6216, Parent PID: 6215

General

Start time (UTC):	07:56:16
Start date (UTC):	11/01/2025
Path:	/tmp/ssg.elf
Arguments:	-
File size:	78485 bytes
MD5 hash:	d450da464b924a4dedee7ed6149e0770

Chronological Activities

Analysis Process: ssg.elf PID: 6217, Parent PID: 6216

General

Start time (UTC):	07:56:16
Start date (UTC):	11/01/2025
Path:	/tmp/ssg.elf
Arguments:	-
File size:	78485 bytes
MD5 hash:	d450da464b924a4dedee7ed6149e0770

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ssg.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ssg.elf PID: 6215, Parent PID: 6125

General

Chronological Activities

Analysis Process: ssg.elf PID: 6216, Parent PID: 6215

General

Chronological Activities

Analysis Process: ssg.elf PID: 6217, Parent PID: 6216

General

Linux Analysis Report
ssg.elf