Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:	arm7.elf
Analysis ID:	1589174
MD5:	f4f82a821b615c12fcc7948f8e0730bf
SHA1:	d6cc7dc47e893d60136cf5ea511a93a83f1248d0
SHA256:	8c1a5337553dbebf72f54462ac7bfeebc1630ad0b1002b98cac9c4be9523af56
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Yara detected Moobot

Contains symbols with names commonly found in malware

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589174
Start date and time:	2025-01-11 14:49:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm7.elf
Detection:	MAL
Classification:	mal100.troj.evad.linELF@0/0@5/0

Runtime Messages

Command:	/tmp/arm7.elf
PID:	6252
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

arm7.elf (PID: 6252, Parent: 6176, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf

arm7.elf New Fork (PID: 6254, Parent: 6252)

arm7.elf New Fork (PID: 6256, Parent: 6254)

arm7.elf New Fork (PID: 6258, Parent: 6254)

arm7.elf New Fork (PID: 6260, Parent: 6258)

dash New Fork (PID: 6267, Parent: 4332)

rm (PID: 6267, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.mdDI1Gkhbv /tmp/tmp.x5yAkBliTL /tmp/tmp.WeyjTc5cUQ

dash New Fork (PID: 6268, Parent: 4332)

rm (PID: 6268, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.mdDI1Gkhbv /tmp/tmp.x5yAkBliTL /tmp/tmp.WeyjTc5cUQ

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm7.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
arm7.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x129bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12afc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x129bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12afc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm7.elf PID: 6252	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: arm7.elf PID: 6252	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: arm7.elf PID: 6252	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x36df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x36f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x371b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x372f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x376b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x377f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x380b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x381f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3833:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3847:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x385b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x386f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 1 entries

Suricata Signatures

ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T14:50:48.399946+0100	2030491	1	Malware Command and Control Activity Detected	192.168.2.23	49684	154.213.187.118	1314	TCP
2025-01-11T14:51:16.043810+0100	2030491	1	Malware Command and Control Activity Detected	192.168.2.23	49686	154.213.187.118	1314	TCP
2025-01-11T14:51:42.688267+0100	2030491	1	Malware Command and Control Activity Detected	192.168.2.23	49688	154.213.187.118	1314	TCP
2025-01-11T14:52:07.302985+0100	2030491	1	Malware Command and Control Activity Detected	192.168.2.23	49690	154.213.187.118	1314	TCP
2025-01-11T14:52:33.696135+0100	2030491	1	Malware Command and Control Activity Detected	192.168.2.23	49692	154.213.187.118	1314	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm7.elf	Virustotal: Detection: 48%			Perma Link
Source: arm7.elf	ReversingLabs: Detection: 60%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.23:49688 -> 154.213.187.118:1314
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.23:49686 -> 154.213.187.118:1314
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.23:49684 -> 154.213.187.118:1314
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.23:49692 -> 154.213.187.118:1314
Source: Network traffic	Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.23:49690 -> 154.213.187.118:1314

Source: global traffic

TCP traffic: 192.168.2.23:49684 -> 154.213.187.118:1314

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: webhorizon.icu

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39254
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39254 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_raw
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_ongoing

Source: arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@5/0

Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/6269/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6256)	File opened: /proc/1494/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6267)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mdDI1Gkhbv /tmp/tmp.x5yAkBliTL /tmp/tmp.WeyjTc5cUQ			Jump to behavior
Source: /usr/bin/dash (PID: 6268)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mdDI1Gkhbv /tmp/tmp.x5yAkBliTL /tmp/tmp.WeyjTc5cUQ			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/arm7.elf (PID: 6252)

File: /tmp/arm7.elf

Jump to behavior

Source: /tmp/arm7.elf (PID: 6252)

Queries kernel information via 'uname':

Jump to behavior

Source: arm7.elf, 6252.1.000055b1f6856000.000055b1f69a5000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm7.elf, 6252.1.00007ffc3ff28000.00007ffc3ff49000.rw-.sdmp	Binary or memory string: @x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
Source: arm7.elf, 6252.1.000055b1f6856000.000055b1f69a5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 6252.1.00007ffc3ff28000.00007ffc3ff49000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)

Yara detected Mirai

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007f9d68017000.00007f9d6802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm7.elf	49%	Virustotal		Browse
arm7.elf	61%	ReversingLabs	Linux.Backdoor.Mirai
arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
webhorizon.icu	154.213.187.118	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.213.187.118	webhorizon.icu	Seychelles	22769	DDOSING-BGP-NETWORKUS	false
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.213.187.118	spc.elf	Get hash	malicious	Mirai, Moobot	Browse
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
34.249.145.219	spc.elf	Get hash	malicious	Mirai, Moobot	Browse
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse
	i586.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.42	spc.elf	Get hash	malicious	Mirai, Moobot	Browse
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse
	ARMV6L.elf	Get hash	malicious	Unknown	Browse
	I586.elf	Get hash	malicious	Unknown	Browse
	POWERPC.elf	Get hash	malicious	Unknown	Browse
	SH4.elf	Get hash	malicious	Unknown	Browse
	sss.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
webhorizon.icu	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	38.55.246.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	ARMV6L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	I586.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	POWERPC.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SH4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sst.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
DDOSING-BGP-NETWORKUS	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	154.213.187.118
	4.elf	Get hash	malicious	Unknown	Browse	41.93.138.131
INIT7CH	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	ARMV6L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	I586.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	POWERPC.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SH4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sss.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
AMAZON-02US	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	34.249.145.219
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	34.249.145.219
	res.x86.elf	Get hash	malicious	Unknown	Browse	18.134.184.155
	Space.mips.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	QsBdpe1gK5.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	54.67.42.145
	HN1GiQ5tF7.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	qbSIgCrCgw.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	8L6MBxaJ2m.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	6.elf	Get hash	malicious	Unknown	Browse	54.122.159.233
	SH4.elf	Get hash	malicious	Unknown	Browse	54.171.230.55

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.981105473170913
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm7.elf
File size:	141'770 bytes
MD5:	f4f82a821b615c12fcc7948f8e0730bf
SHA1:	d6cc7dc47e893d60136cf5ea511a93a83f1248d0
SHA256:	8c1a5337553dbebf72f54462ac7bfeebc1630ad0b1002b98cac9c4be9523af56
SHA512:	081ade831fe68b026a832bb8606dfcb7eeb383d492f3ef7d686fe197b31ac335172817fd819f94c6691cef002457a744d9b7e677e784b5c69ff8f7dcd81aa93d
SSDEEP:	3072:vIWGv+D+KJarvJJpDYjln8wNpYipn0+HutbM/9N8:vIWG0HJarvJJpcBn8Zan0+HuJM/9N8
TLSH:	E5D32A56E7418B53C0D61775B6EF42453323ABA493DB73069928AFF43F8279E0E23A05
File Content Preview:	.ELF..............(.........4...p.......4. ...(........p.C..........................................(D..(D..............(D..(D..(D......\|2..............,D..,D..,D..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	110192
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x127e0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1a8d0	0x128d0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1a8e0	0x128e0	0x1a18	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1c2f8	0x142f8	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1c310	0x14310	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x24428	0x14428	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2442c	0x1442c	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2442c	0x1442c	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x24430	0x14430	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x24434	0x14434	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x24438	0x14438	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x244e0	0x144e0	0x208	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x246e8	0x146e8	0x2fbc	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x146e8	0xafc	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x151e8	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x15328	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1553b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1757e	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x17c60	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x18ad8	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x18d90	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1965a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1a7e9	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1ad41	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1ad57	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1b2f8	0x4ea0	0x10	0x0		28	713	4
.strtab	STRTAB	0x0	0x20198	0x2832	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x14310	0x1c310	0x1c310	0x118	0x118	4.4970	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x14428	0x14428	6.1372	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x14428	0x24428	0x24428	0x2c0	0x327c	3.9573	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1442c	0x2442c	0x2442c	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1a8d0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1a8e0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1c2f8	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1c310	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x24428	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2442c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2442c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x24430	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x24434	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x24438	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x244e0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x246e8	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a8d0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a8dc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x871c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x986c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe54c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeafc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf40c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf42c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfdd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1085c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13be4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13db8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1451c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1475c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1479c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14acc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1795c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1846c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x186e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1941c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1946c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1968c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1997c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1999c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a89c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24430	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2442c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb4e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc31c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc89c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcecc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x244e0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xd040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd0a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd2c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd2e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x244e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x244e8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x244ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xdcc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe6dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x244f0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xeba0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xecfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf1a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf31c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b29c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf3f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf428	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf45c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf55c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfd0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xffc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1000c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10558	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x244f4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b2e4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10678	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b368	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x109e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10be0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10da8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10eec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10fcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1109c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x244f8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11fa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1249c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24510	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1266c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x127e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12888	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24528	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x245c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12930	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12af4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12be4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bed4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12c94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x245d4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12ddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x133f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x139b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13af0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x245ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x14460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14510	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1458c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14690	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1471c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14758	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14798	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1508c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1580c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24604	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x24600	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15c3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16640	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2b0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17954	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ca4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ee0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ff0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18228	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1860c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x186e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x19670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x245f8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1bf62	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x1bf40	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1b29c	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x1bf4c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x1b2b4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1c288	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1c264	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1c27c	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1c270	12	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x27228	1	OBJECT	<unknown>	DEFAULT	14
LOCAL_ADDR	.symtab	0x27224	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x10758	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10774	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0xec9c	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x24438	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x19424	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x19428	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1a0d8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1941c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x19460	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1a0fc	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1a89c	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x19454	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1a06c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1a090	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1a0b4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x19384	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1999c	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x193d0	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x245f8	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1bf62	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x24428	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x24428	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x245f8	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x13b10	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x13af4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x245fc	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0xf40c	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xeb10	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x16f1c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1085c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x13b10	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xeba8	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x13ba0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x13cc0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x13c30	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x13ba0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x13b84	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x13cc0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x13ca4	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x110cc	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x110f0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x110a8	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x13ed8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x13fa8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x13c30	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x13c14	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x10874	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xec9c	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x124a4	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x109ec	116	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x10a60	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17fa4	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xed04	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x13b10	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0xefd0	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x14ee0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x14f14	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x14bb8	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10ae8	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x12bf0	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x15090	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xeba8	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16b70	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x16660	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x16f1c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x167a4	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x17048	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x153c0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x13424	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10588	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x18230	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x18254	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x14590	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x105c0	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x16f1c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x14694	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x146c0	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x146d4	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x146e8	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x146fc	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x13888	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14724	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x10b5c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1475c	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1479c	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x10980	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x17adc	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x12a0c	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x18008	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x17a3c	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xed50	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18784	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x175b0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10680	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17580	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x18720	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x176a0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10690	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x143ec	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x147b0	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x147f4	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14874	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x13ba0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0xf1b0	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x138d0	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x125e4	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x128a4	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x13cc0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0xf324	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x14acc	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x10c2c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x10ce4	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x148d4	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xee10	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x10db0	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x10e6c	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xee94	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10ef4	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x12b04	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x14494	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x10f80	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x10fd0	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10fe4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0xeed4	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x139c0	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x10f3c	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xf460	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x12934	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x17780	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x17870	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x17590	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x17590	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1795c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10730	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x10790	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x179a0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x179f0	76	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x12e00	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17a60	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xef60	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x14940	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0xef90	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xf494	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x14f5c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x14fd4	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x14fb0	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x13c30	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x24434	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x24434	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1a0d8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1a06c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1a090	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1a0b4	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x18944	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x192a0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x192a0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x19284	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x19330	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x18944	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x192b8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x19300	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x19318	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x192e8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x192d0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x18fe4	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x18d54	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x18938	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x18940	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x18ca0	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x18c78	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x187f4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x18920	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x18cf4	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x14540	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x18c54	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xe9e8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xeae4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x18ce0	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1a038	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1a030	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1a028	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x24cbc	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x245d4	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x276a4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x246e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x246e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x13f54	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x13b10	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x13af4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x19200	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x245fc	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x27220	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x244e0	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x14534	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x14528	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xeafc	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x18fe4	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x187f4	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x24430	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x276a4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x24cb4	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x19200	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xf40c	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1c428	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1c310	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x24764	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x18ca0	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xeb10	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x16f1c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x24434	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x24430	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x19330	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x18cf4	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x18c78	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x18ce0	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x18c54	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x13424	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x27670	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x27674	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x24768	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2442c	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x191f0	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x145f4	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x180e8	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x146fc	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x13888	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1085c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x197dc	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x198c4	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1a05c	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x19858	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1997c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1a064	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1a140	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1a854	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x19ae0	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x191f0	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x24430	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2442c	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x191f8	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x109ec	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x13b10	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10ae8	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x13d30	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x13db8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0xeba8	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x13424	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x27678	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x14874	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x13ba0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x13cc0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x10c2c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x10ce4	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xee10	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x10db0	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x10e6c	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x17cd8	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x14494	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x24cb0	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x13c30	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x137f0	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x191f8	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x12074	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x11114	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x244f8	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x272f8	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x11fc4	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x18d54	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x19200	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x13ba0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x13b84	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x24cb8	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2442c	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2442c	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x245f0	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x245f4	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x17f08	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x13e9c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x13e94	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x13e94	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x13e94	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x13e94	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x13cc0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x13ca4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1a040	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x24cc0	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x110cc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x110f0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x110a8	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x18744	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x17ffc	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x24610	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x18414	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1846c	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x18548	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x15840	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x18610	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x186e4	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x18640	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15b64	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x15c40	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x24614	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x18940	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x109a8	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x10aa4	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x10be8	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x10c9c	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x10d6c	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x10e20	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x14468	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x14834	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x14550	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0xedcc	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x17cb4	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x13ed8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x13fa8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14000	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x245ec	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0xe9e8	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x13c30	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x13c14	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x10874	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x14a20	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x14954	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x24754	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x276a4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xf564	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x272a0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x272c8	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x244f4	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x17f14	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x17f4c	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2769c	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x276a0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x27690	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2768c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x27694	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x27684	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x17c4c	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x27680	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x27698	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x27688	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2767c	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x246e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x276a4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0xec9c	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1a8d0	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x24ce4	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xf5b8	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x15e6c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15c70	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x170f0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xfd30	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x10018	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xfdd0	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xfe14	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xffc4	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x13eac	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x13ea4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1451c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x272f0	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x153e0	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x15980	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x24618	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x24cc4	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x168c0	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x24ce0	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x24cd0	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x24cdc	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x2461c	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x15a00	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x24600	4	OBJECT	<unknown>	DEFAULT	13
_store_inttype	.symtab	0x15ce4	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1b378	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x15d10	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xf63c	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x124a4	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x109ec	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0xd2d0	24	FUNC	<unknown>	DEFAULT	2
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x86ac	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x8640	108	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x871c	988	FUNC	<unknown>	DEFAULT	2
attack_kill_all	.symtab	0x82cc	344	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0xc8a0	1668	FUNC	<unknown>	DEFAULT	2
attack_method_raw	.symtab	0xbc8c	1684	FUNC	<unknown>	DEFAULT	2
attack_method_stdhex	.symtab	0xc5c0	736	FUNC	<unknown>	DEFAULT	2
attack_method_tcp	.symtab	0x91c0	1708	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x2470c	32	OBJECT	<unknown>	DEFAULT	14
attack_parse	.symtab	0x8424	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x81d0	252	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0xa718	1788	FUNC	<unknown>	DEFAULT	2
attack_tcp_null	.symtab	0xb4ec	1948	FUNC	<unknown>	DEFAULT	2
attack_tcp_sack2	.symtab	0x986c	1776	FUNC	<unknown>	DEFAULT	2
attack_tcp_stomp	.symtab	0x9f5c	1980	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0x8af8	1736	FUNC	<unknown>	DEFAULT	2
attack_tcp_syndata	.symtab	0xae14	1752	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_plain	.symtab	0xc320	672	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x24760	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x10a60	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x17fa4	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x10fe4	196	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x11ac4	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0xed04	56	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xcf24	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xcf74	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0xf42c	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x13b10	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0xefd0	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x246e8	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x10ae8	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
entries	.symtab	0x27250	4	OBJECT	<unknown>	DEFAULT	14
environ	.symtab	0x24cb4	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x12bf0	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1c2b0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x15090	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xeba8	244	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x244e4	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x244e8	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0xf0e0	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0xf274	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x16b70	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x16660	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x16f1c	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x167a4	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x17048	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1c298	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x153c0	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x13424	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x2476c	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0x10588	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x12228	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x18230	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x18230	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x18254	448	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x14590	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x105c0	188	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_eit_entry	.symtab	0x1946c	544	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x16660	324	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x16f1c	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x14694	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x146c0	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x146d4	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x146e8	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x146fc	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x13888	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0xed3c	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x14724	56	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x10b5c	68	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T14:50:48.399946+0100	2030491	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)	1	192.168.2.23	49684	154.213.187.118	1314	TCP
2025-01-11T14:51:16.043810+0100	2030491	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)	1	192.168.2.23	49686	154.213.187.118	1314	TCP
2025-01-11T14:51:42.688267+0100	2030491	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)	1	192.168.2.23	49688	154.213.187.118	1314	TCP
2025-01-11T14:52:07.302985+0100	2030491	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)	1	192.168.2.23	49690	154.213.187.118	1314	TCP
2025-01-11T14:52:33.696135+0100	2030491	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)	1	192.168.2.23	49692	154.213.187.118	1314	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 14:50:47.340732098 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 14:50:48.392971039 CET	49684	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:50:48.397814989 CET	1314	49684	154.213.187.118	192.168.2.23
Jan 11, 2025 14:50:48.397880077 CET	49684	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:50:48.399945974 CET	49684	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:50:48.404716015 CET	1314	49684	154.213.187.118	192.168.2.23
Jan 11, 2025 14:50:58.155664921 CET	443	39254	34.249.145.219	192.168.2.23
Jan 11, 2025 14:50:58.156007051 CET	39254	443	192.168.2.23	34.249.145.219
Jan 11, 2025 14:50:58.160810947 CET	443	39254	34.249.145.219	192.168.2.23
Jan 11, 2025 14:50:58.409213066 CET	49684	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:50:58.414135933 CET	1314	49684	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:02.186624050 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 14:51:08.329828024 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 14:51:09.781847000 CET	1314	49684	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:09.782140970 CET	49684	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:09.787034035 CET	1314	49684	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:16.037375927 CET	49686	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:16.042361021 CET	1314	49686	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:16.042429924 CET	49686	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:16.043809891 CET	49686	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:16.048656940 CET	1314	49686	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:37.406797886 CET	1314	49686	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:37.407363892 CET	49686	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:37.412388086 CET	1314	49686	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:42.681629896 CET	49688	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:42.686719894 CET	1314	49688	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:42.686789989 CET	49688	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:42.688266993 CET	49688	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:51:42.693186045 CET	1314	49688	154.213.187.118	192.168.2.23
Jan 11, 2025 14:51:49.284138918 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 14:52:04.110218048 CET	1314	49688	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:04.110742092 CET	49688	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:04.115704060 CET	1314	49688	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:07.296379089 CET	49690	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:07.301404953 CET	1314	49690	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:07.301498890 CET	49690	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:07.302984953 CET	49690	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:07.307859898 CET	1314	49690	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:17.311893940 CET	49690	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:17.317044020 CET	1314	49690	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:28.677057028 CET	1314	49690	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:28.677498102 CET	49690	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:28.684838057 CET	1314	49690	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:33.689519882 CET	49692	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:33.694511890 CET	1314	49692	154.213.187.118	192.168.2.23
Jan 11, 2025 14:52:33.694602966 CET	49692	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:33.696135044 CET	49692	1314	192.168.2.23	154.213.187.118
Jan 11, 2025 14:52:33.700990915 CET	1314	49692	154.213.187.118	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 14:50:48.209831953 CET	56784	53	192.168.2.23	8.8.8.8
Jan 11, 2025 14:50:48.391279936 CET	53	56784	8.8.8.8	192.168.2.23
Jan 11, 2025 14:51:15.784490108 CET	37590	53	192.168.2.23	8.8.8.8
Jan 11, 2025 14:51:16.036019087 CET	53	37590	8.8.8.8	192.168.2.23
Jan 11, 2025 14:51:42.410378933 CET	38799	53	192.168.2.23	8.8.8.8
Jan 11, 2025 14:51:42.680072069 CET	53	38799	8.8.8.8	192.168.2.23
Jan 11, 2025 14:52:07.114440918 CET	46773	53	192.168.2.23	8.8.8.8
Jan 11, 2025 14:52:07.294985056 CET	53	46773	8.8.8.8	192.168.2.23
Jan 11, 2025 14:52:33.681438923 CET	43379	53	192.168.2.23	8.8.8.8
Jan 11, 2025 14:52:33.688725948 CET	53	43379	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 14:50:48.209831953 CET	192.168.2.23	8.8.8.8	0xd3f5	Standard query (0)	webhorizon.icu	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:51:15.784490108 CET	192.168.2.23	8.8.8.8	0xc803	Standard query (0)	webhorizon.icu	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:51:42.410378933 CET	192.168.2.23	8.8.8.8	0x3a98	Standard query (0)	webhorizon.icu	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:52:07.114440918 CET	192.168.2.23	8.8.8.8	0xf7d	Standard query (0)	webhorizon.icu	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:52:33.681438923 CET	192.168.2.23	8.8.8.8	0x440d	Standard query (0)	webhorizon.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 14:50:48.391279936 CET	8.8.8.8	192.168.2.23	0xd3f5	No error (0)	webhorizon.icu	154.213.187.118	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:51:16.036019087 CET	8.8.8.8	192.168.2.23	0xc803	No error (0)	webhorizon.icu	154.213.187.118	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:51:42.680072069 CET	8.8.8.8	192.168.2.23	0x3a98	No error (0)	webhorizon.icu	154.213.187.118	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:52:07.294985056 CET	8.8.8.8	192.168.2.23	0xf7d	No error (0)	webhorizon.icu	154.213.187.118	A (IP address)	IN (0x0001)	false
Jan 11, 2025 14:52:33.688725948 CET	8.8.8.8	192.168.2.23	0x440d	No error (0)	webhorizon.icu	154.213.187.118	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: arm7.elf PID: 6252, Parent PID: 6176

General

Start time (UTC):	13:50:47
Start date (UTC):	11/01/2025
Path:	/tmp/arm7.elf
Arguments:	/tmp/arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6254, Parent PID: 6252

General

Start time (UTC):	13:50:47
Start date (UTC):	11/01/2025
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6256, Parent PID: 6254

General

Start time (UTC):	13:50:47
Start date (UTC):	11/01/2025
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6258, Parent PID: 6254

General

Start time (UTC):	13:50:47
Start date (UTC):	11/01/2025
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6260, Parent PID: 6258

General

Start time (UTC):	13:50:47
Start date (UTC):	11/01/2025
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dash PID: 6267, Parent PID: 4332

General

Start time (UTC):	13:50:57
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6267, Parent PID: 4332

General

Start time (UTC):	13:50:57
Start date (UTC):	11/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.mdDI1Gkhbv /tmp/tmp.x5yAkBliTL /tmp/tmp.WeyjTc5cUQ
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6268, Parent PID: 4332

General

Start time (UTC):	13:50:57
Start date (UTC):	11/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6268, Parent PID: 4332

General

Start time (UTC):	13:50:57
Start date (UTC):	11/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.mdDI1Gkhbv /tmp/tmp.x5yAkBliTL /tmp/tmp.WeyjTc5cUQ
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: arm7.elf PID: 6252, Parent PID: 6176

General

Chronological Activities

Analysis Process: arm7.elf PID: 6254, Parent PID: 6252

General

Chronological Activities

Analysis Process: arm7.elf PID: 6256, Parent PID: 6254

General

Chronological Activities

Analysis Process: arm7.elf PID: 6258, Parent PID: 6254

General

Chronological Activities

Analysis Process: arm7.elf PID: 6260, Parent PID: 6258

General

Chronological Activities

Analysis Process: dash PID: 6267, Parent PID: 4332

Linux Analysis Report
arm7.elf