Edit tour

Linux Analysis Report
networkrip.armv7l.elf

Overview

General Information

Sample name:	networkrip.armv7l.elf
Analysis ID:	1601054
MD5:	e278b4a3b03161d85a20e1e746a60035
SHA1:	0738776caadd85decfc9e15d5138d3b9ebd9886a
SHA256:	8726f5cdaa2bc056e924c3d8b90188a0ecceb67020861899b3d35b7d808c71cf
Tags:	elfMiraiuser-lontze7
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1601054
Start date and time:	2025-01-28 09:38:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	networkrip.armv7l.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 45.135.194.61:6606
VT rate limit hit for: http://45.135.194.61/networkrip.sh;

Runtime Messages

Command:	/tmp/networkrip.armv7l.elf
PID:	5576
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

networkrip.armv7l.elf (PID: 5576, Parent: 5496, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/networkrip.armv7l.elf

networkrip.armv7l.elf New Fork (PID: 5578, Parent: 5576)

networkrip.armv7l.elf New Fork (PID: 5580, Parent: 5578)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
networkrip.armv7l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
networkrip.armv7l.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
networkrip.armv7l.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1448c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1452c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1457c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5578.1.00007fec68017000.00007fec6802e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5578.1.00007fec68017000.00007fec6802e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1448c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1452c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1457c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5576.1.00007fec68017000.00007fec6802e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5576.1.00007fec68017000.00007fec6802e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1448c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1452c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1457c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: networkrip.armv7l.elf PID: 5576	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: networkrip.armv7l.elf PID: 5576	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16e57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ea7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ebb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ecf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ee3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ef7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fe7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: networkrip.armv7l.elf PID: 5578	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: networkrip.armv7l.elf PID: 5578	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16da2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16db6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16dca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16dde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16df2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ea6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16eba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ece:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ee2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ef6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-28T09:39:17.921760+0100	2847037	1	A Network Trojan was detected	192.168.2.14	47852	45.135.194.61	6606	TCP

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: networkrip.armv7l.elf

Avira: detected

Found malware configuration

Source: networkrip.armv7l.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "45.135.194.61:6606"}

Multi AV Scanner detection for submitted file

Source: networkrip.armv7l.elf	Virustotal: Detection: 60%			Perma Link
Source: networkrip.armv7l.elf	ReversingLabs: Detection: 71%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/networkrip.armv7l.elf (PID: 5576)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2847037 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.14:47852 -> 45.135.194.61:6606

Source: global traffic

TCP traffic: 192.168.2.14:47852 -> 45.135.194.61:6606

Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.61
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.61
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.61

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: networkrip.armv7l.elf

String found in binary or memory: http://45.135.194.61/networkrip.sh;

System Summary

Malicious sample detected (through community Yara rule)

Source: networkrip.armv7l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5578.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5576.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: networkrip.armv7l.elf PID: 5576, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: networkrip.armv7l.elf PID: 5578, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: networkrip.armv7l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5578.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5576.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: networkrip.armv7l.elf PID: 5576, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: networkrip.armv7l.elf PID: 5578, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/bzero.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: networkrip.armv7l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/networkrip.armv7l.elf (PID: 5576)

Queries kernel information via 'uname':

Jump to behavior

Source: networkrip.armv7l.elf, 5576.1.000055e63cb17000.000055e63cc45000.rw-.sdmp, networkrip.armv7l.elf, 5578.1.000055e63cb17000.000055e63cc45000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: networkrip.armv7l.elf, 5576.1.000055e63cb17000.000055e63cc45000.rw-.sdmp, networkrip.armv7l.elf, 5578.1.000055e63cb17000.000055e63cc45000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: networkrip.armv7l.elf, 5576.1.00007fffc162e000.00007fffc164f000.rw-.sdmp, networkrip.armv7l.elf, 5578.1.00007fffc162e000.00007fffc164f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: networkrip.armv7l.elf, 5576.1.00007fffc162e000.00007fffc164f000.rw-.sdmp, networkrip.armv7l.elf, 5578.1.00007fffc162e000.00007fffc164f000.rw-.sdmp	Binary or memory string: dx86_64/usr/bin/qemu-arm/tmp/networkrip.armv7l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/networkrip.armv7l.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: networkrip.armv7l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: networkrip.armv7l.elf, type: SAMPLE
Source: Yara match	File source: 5578.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5576.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: networkrip.armv7l.elf PID: 5576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: networkrip.armv7l.elf PID: 5578, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic

Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity

Yara detected Gafgyt

Source: Yara match

File source: networkrip.armv7l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: networkrip.armv7l.elf, type: SAMPLE
Source: Yara match	File source: 5578.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5576.1.00007fec68017000.00007fec6802e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: networkrip.armv7l.elf PID: 5576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: networkrip.armv7l.elf PID: 5578, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "45.135.194.61:6606"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
networkrip.armv7l.elf	60%	Virustotal		Browse
networkrip.armv7l.elf	71%	ReversingLabs	Linux.Trojan.Gafgyt
networkrip.armv7l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.135.194.61:6606	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.135.194.61/networkrip.sh;	networkrip.armv7l.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.135.194.61	unknown	Germany		213030	SKYLINKCZ	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.135.194.61	networkrip.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	networkrip.arm4.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	networkrip.ppc.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	networkrip.arm5.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	networkrip.mpsl.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	networkrip.sparc.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	networkrip.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	networkrip.ppc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	networkrip.arm5.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	networkrip.mpsl.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	wanna.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	12.apk.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYLINKCZ	networkrip.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.135.194.61
	networkrip.arm4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.135.194.61
	networkrip.ppc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.135.194.61
	networkrip.arm5.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.135.194.61
	networkrip.mpsl.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.135.194.61
	networkrip.sparc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	45.135.194.61

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.075424873777999
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	networkrip.armv7l.elf
File size:	133'080 bytes
MD5:	e278b4a3b03161d85a20e1e746a60035
SHA1:	0738776caadd85decfc9e15d5138d3b9ebd9886a
SHA256:	8726f5cdaa2bc056e924c3d8b90188a0ecceb67020861899b3d35b7d808c71cf
SHA512:	adddb02f3493eb392e07cb1500d6175978cfc9bdc8b523e724450e40fa0f2d6a6453a977c360771365ebd5d60f9853b1095ee9052095404e6b31d8d56d056d9a
SSDEEP:	3072:gydFKxawsbqtKJpzAHR+zMwE/4nRPYOAucjmWQ9AKXNY8:gCFKxabqtYMwE/S8XjmWQ9A8NY8
TLSH:	34D32A02F4504757C2D2177AB79F520D37236BB987DB33129A346EB42FC179A1E3A9A0
File Content Preview:	.ELF..............(.........4...........4. ...(........plj..l...l...................................\|j..\|j...............p...p...p...... k..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	102100
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x11b54	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19c24	0x11c24	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19c38	0x11c38	0x4e1c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1ea54	0x16a54	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1ea6c	0x16a6c	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x27000	0x17000	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x27004	0x17004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x27008	0x17008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2700c	0x1700c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x27010	0x17010	0x7c	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2708c	0x1708c	0x428	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x274b8	0x174b4	0x6668	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x174b4	0xc64	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x18118	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x181f8	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x186a8	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x18734	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x18d8c	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x18de4	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x18df4	0xdd	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x19294	0x4c70	0x10	0x0		23	665	4
.strtab	STRTAB	0x0	0x1df04	0x28d4	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x16a6c	0x1ea6c	0x1ea6c	0x10	0x10	2.4056	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x16a7c	0x16a7c	6.2906	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x17000	0x27000	0x27000	0x4b4	0x6b20	4.3924	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19c24	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19c38	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1ea54	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1ea6c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x27000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x27004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x27008	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2700c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x27010	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2708c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x274b8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19c24	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19c30	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x846c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x92f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x99e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa82c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb17c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc17c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc6d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdbd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe50c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe94c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeaf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf61c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfdc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1059c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1076c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1210c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1313c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1322c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1328c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1332c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1419c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1441c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15acc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1688c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1702c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1779c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1807c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1861c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27008	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27004	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x27090	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27094	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x82bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x92f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x95c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x99e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa94c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca58	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xb174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc308	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc43c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc68c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd72c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdbc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe96c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe99c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27258	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x27260	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0xe9b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeb54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeb88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2729c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x27268	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1d9a0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xed64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfd60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x273a4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x10190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10594	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1063c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1067c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x106b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x106f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10768	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x107a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x107ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x273a8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x11784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x273c0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x119a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x273d8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x27470	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x11cbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5cc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27484	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1226c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12398	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x129e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12af0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12df8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2749c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x12f84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1359c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e658	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d700	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13738	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13adc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13da0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e688	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1508c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x162fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1676c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16df8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1853c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18604	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x274ac	0	NOTYPE	<unknown>	DEFAULT	12
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x1e658	24	OBJECT	<unknown>	DEFAULT	4
C.133.5434	.symtab	0x1ca58	72	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0xff48	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xff64	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x274f0	16384	OBJECT	<unknown>	DEFAULT	13
SendHTTP	.symtab	0xc17c	408	FUNC	<unknown>	DEFAULT	2
UpdateBins	.symtab	0xc6d8	100	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0xe8ec	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x27010	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x27258	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1d3a0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x274ac	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1e754	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x27260	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1d6a0	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x27000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x27000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x27258	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x274ac	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x27260	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_b	.symtab	0x2725c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x274b0	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x27264	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0xe9a4	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xe7c4	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x152c4	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x102ac	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x13724	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xe758	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x10920	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x10944	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x108fc	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x12a28	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x12af8	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x102f4	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xe8ec	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x117e0	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x11f10	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x167ac	76	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xe688	52	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x13150	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xe918	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1332c	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x13a68	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x13a9c	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x13740	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10648	56	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2d700	4	OBJECT	<unknown>	HIDDEN	13
__GI_execl	.symtab	0x166c8	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x16824	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1210c	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x13c0c	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xe758	108	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x150b8	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x14d98	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x152c4	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x14e74	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x153f0	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x13dc0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xe5c4	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0xfd90	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x16c98	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x16cbc	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1688c	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0xfdc8	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x152c4	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1322c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x13184	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x13198	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x13218	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x105c4	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x105e0	104	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x15f40	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x18668	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x18994	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x13114	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xe580	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x16858	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x10680	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0xe724	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1313c	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2d704	4	OBJECT	<unknown>	HIDDEN	13
__GI_htonl	.symtab	0x104a4	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x10494	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1059c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x15e48	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x10580	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x104f4	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x17518	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x171b8	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x11e2c	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xe898	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x103f4	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0xe94c	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xe6f0	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18a64	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x15920	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xffb0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x18ad0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x15cf8	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x15b7c	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xfe80	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x12f94	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x16b14	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x13258	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1328c	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x104d4	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x104c4	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xe520	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x134f4	172	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x18960	52	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0xe9c0	76	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10828	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x11920	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x11cc4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x15acc	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xe6bc	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x13638	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x106fc	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x131ac	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xe648	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x10734	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1076c	64	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xe864	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x107ac	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x11be0	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x12ffc	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10844	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x132f4	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x121c4	172	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x107f0	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xea0c	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x11d54	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x18a0c	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x18f7c	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x101bc	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x15d1c	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xff90	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xff90	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10198	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x15a88	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x18ae0	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xff20	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1702c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x100cc	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x15e08	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x15ca8	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x15c5c	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xffd0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x102c4	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x15a10	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x11f30	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x123bc	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10418	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xe594	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xe974	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x18f48	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x130a0	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0xec94	228	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xea40	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x130e0	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xe5f8	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x13ae4	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x13b5c	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x13b38	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xe830	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2700c	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x2700c	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x191e4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x19b40	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x19b40	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x19b24	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x19bd0	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x191e4	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x19b58	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x19ba0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x19bb8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x19b88	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x19b70	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x19884	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x195f4	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x191d8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x191e0	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x19540	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x19518	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x19094	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x191c0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x19594	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x194f4	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xe3f8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xe4f4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x19580	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x16818	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x1681c	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x16820	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2d6f8	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x27484	24	OBJECT	<unknown>	DEFAULT	12
__bss_end__	.symtab	0x2db20	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x274b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x274b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x12aa4	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x18584	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x19aa0	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2725c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x274b0	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x27264	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x2d708	4	OBJECT	<unknown>	HIDDEN	13
__data_start	.symtab	0x2708c	0	NOTYPE	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x1779c	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18c00	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x13094	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13088	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xe50c	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x19884	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x19094	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x17894	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x27008	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x2708c	0	OBJECT	<unknown>	HIDDEN	12
__encode_dotted	.symtab	0x18fe8	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x18b14	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x18cb4	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2db20	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2d6f0	4	OBJECT	<unknown>	DEFAULT	13
__eqdf2	.symtab	0x19aa0	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xe9a4	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x130dc	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x1ea7c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1ea6c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2d6e8	4	OBJECT	<unknown>	HIDDEN	13
__extendsfdf2	.symtab	0x19540	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xe7c4	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x152c4	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2700c	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x27008	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x19bd0	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x19594	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x19518	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x19580	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x194f4	36	FUNC	<unknown>	HIDDEN	2
__frame_dummy_init_array_entry	.symtab	0x27004	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x19a90	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1861c	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x16b54	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x13114	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x102ac	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x19a90	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x13724	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x27008	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x27004	0	NOTYPE	<unknown>	HIDDEN	8
__ledf2	.symtab	0x19a98	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xe918	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10648	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xe758	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xe5c4	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x18a64	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1328c	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xe520	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xe6bc	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x106fc	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xe648	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x10734	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1076c	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x12ffc	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2d6ec	4	OBJECT	<unknown>	DEFAULT	13
__libc_system	.symtab	0x12e38	348	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0xe5f8	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xe830	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x1e734	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x19a98	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x113b0	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x10968	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x273a8	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x2d78c	888	OBJECT	<unknown>	DEFAULT	13
__malloc_trim	.symtab	0x11300	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x195f4	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x2db14	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x2db18	4	OBJECT	<unknown>	HIDDEN	13
__nedf2	.symtab	0x19aa0	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x18d14	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x18128	1116	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2d6f4	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x27004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x27004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x274a0	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x274a4	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x129ec	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x129e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x129e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x129e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x129e4	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x18d44	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x2db0c	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x274ab	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x2d710	24	OBJECT	<unknown>	DEFAULT	13
__resolv_timeout	.symtab	0x274aa	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x2d6fc	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x2db10	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x2db1c	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x10920	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10944	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x108fc	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x272a8	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x16e0c	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x13de0	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x16e64	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1419c	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0xeb5c	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x1d9a0	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x16f28	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x16ff0	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x16f58	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x142dc	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xec64	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x272ac	4	OBJECT	<unknown>	DEFAULT	12
__subdf3	.symtab	0x191e0	788	FUNC	<unknown>	HIDDEN	2
__syscall_error	.symtab	0x167f8	32	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x132c0	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x12a28	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x12af8	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x12b64	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2749c	4	OBJECT	<unknown>	HIDDEN	12
__udivsi3	.symtab	0xe3f8	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x130a0	64	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x102f4	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x169b0	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x168e4	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x16a5c	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2d4f8	10	OBJECT	<unknown>	DEFAULT	13
_bss_end__	.symtab	0x2db20	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0xed78	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2d734	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_handler	.symtab	0x2d75c	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_spec	.symtab	0x273a4	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x16774	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2db04	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x2db08	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x274b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2db20	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2d700	4	OBJECT	<unknown>	DEFAULT	13
_exit	.symtab	0xe8ec	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19c24	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2b4f8	8192	OBJECT	<unknown>	DEFAULT	13
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xedcc	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x145a4	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2d704	4	OBJECT	<unknown>	DEFAULT	13
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x143ac	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x15490	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xf538	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0xf820	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xf5d8	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xf61c	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xf7cc	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x129fc	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x129f4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2d784	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x13e94	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xeaf4	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x272b0	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x27268	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x14f30	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2b4f4	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x27280	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x2b4f0	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x272b4	240	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0xeb90	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x27298	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x11f4c	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1441c	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1da70	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x14448	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xee50	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x117e0	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xe614	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atcp	.symtab	0xa16c	1728	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x11f10	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x11f10	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x9d10	1116	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0xff80	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2d6e4	4	OBJECT	<unknown>	DEFAULT	13
brk	.symtab	0x167ac	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x10844	184	FUNC	<unknown>	DEFAULT	2
buf.2975	.symtab	0x2d508	16	OBJECT	<unknown>	DEFAULT	13
buf.5444	.symtab	0x2d518	440	OBJECT	<unknown>	DEFAULT	13
bzero	.symtab	0xffc0	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x27250	4	OBJECT	<unknown>	DEFAULT	12
calloc	.symtab	0x161e0	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0xe688	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x13150	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xe918	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x1332c	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x27094	4	OBJECT	<unknown>	DEFAULT	12
completed.4959	.symtab	0x274b8	1	OBJECT	<unknown>	DEFAULT	13
connect	.symtab	0x10648	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x95cc	628	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x99e8	340	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x2724c	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x27090	0	NOTYPE	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2d6f0	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x2d700	4	OBJECT	<unknown>	DEFAULT	13
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x166c8	172	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x16824	52	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1210c	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1e688	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x13c0c	436	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xe758	108	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x13424	208	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x846c	212	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x135a0	152	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x150b8	524	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x14d98	220	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x152c4	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x14e74	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x153f0	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1e670	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x13dc0	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0xe5c4	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0xfd90	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x11564	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x16c98	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x16c98	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x16cbc	336	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1688c	88	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0xfdc8	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0xc314	36	FUNC	<unknown>	DEFAULT	2
getDevice	.symtab	0xc3ec	92	FUNC	<unknown>	DEFAULT	2
getDistro	.symtab	0xc51c	444	FUNC	<unknown>	DEFAULT	2
getFiles	.symtab	0xc338	180	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x91d4	104	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8540	700	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0xc448	212	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x8408	100	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x14d98	220	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x152c4	300	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1322c	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x13184	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x13198	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x13218	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x105c4	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x105e0	104	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x15f40	672	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x18668	760	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x18994	120	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x13114	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xe580	20	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x16858	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x10680	56	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x106b8	68	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0xe724	52	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1313c	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x274dc	4	OBJECT	<unknown>	DEFAULT	13
h_errno	.symtab	0x2d704	4	OBJECT	<unknown>	DEFAULT	13
hoste.5443	.symtab	0x2d6d0	20	OBJECT	<unknown>	DEFAULT	13
htonl	.symtab	0x104a4	32	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x10494	16	FUNC	<unknown>	DEFAULT	2
i.4327	.symtab	0x27254	4	OBJECT	<unknown>	DEFAULT	12
index	.symtab	0x101bc	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1059c	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x15e48	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x10580	28	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x104f4	140	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x17518	644	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x173d4	324	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x171b8	540	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x170e8	208	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xda40	400	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81ec	216	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x11a7c	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x11e2c	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0xe898	84	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x103f4	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xe94c	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xe6f0	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5501	.symtab	0x274a8	2	OBJECT	<unknown>	DEFAULT	12
last_ns_num.5500	.symtab	0x2d70c	4	OBJECT	<unknown>	DEFAULT	13
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bzero.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9840	424	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x18a64	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x274e8	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0xdbd0	2088	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x274d8	4	OBJECT	<unknown>	DEFAULT	13
makeIPPacket	.symtab	0x9c10	256	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x923c	184	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0xa82c	292	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x109e0	2336	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-28T09:39:17.921760+0100	2847037	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.14	47852	45.135.194.61	6606	TCP

Network Port Distribution

Total Packets: 10
• 6606 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2025 09:39:17.914908886 CET	47852	6606	192.168.2.14	45.135.194.61
Jan 28, 2025 09:39:17.920084000 CET	6606	47852	45.135.194.61	192.168.2.14
Jan 28, 2025 09:39:17.920160055 CET	47852	6606	192.168.2.14	45.135.194.61
Jan 28, 2025 09:39:17.921760082 CET	47852	6606	192.168.2.14	45.135.194.61
Jan 28, 2025 09:39:17.927416086 CET	6606	47852	45.135.194.61	192.168.2.14
Jan 28, 2025 09:42:03.055550098 CET	45160	53	192.168.2.14	8.8.8.8
Jan 28, 2025 09:42:03.060838938 CET	53	45160	8.8.8.8	192.168.2.14
Jan 28, 2025 09:42:03.060939074 CET	45160	53	192.168.2.14	8.8.8.8
Jan 28, 2025 09:42:03.061000109 CET	45160	53	192.168.2.14	8.8.8.8
Jan 28, 2025 09:42:03.061001062 CET	45160	53	192.168.2.14	8.8.8.8
Jan 28, 2025 09:42:03.065921068 CET	53	45160	8.8.8.8	192.168.2.14
Jan 28, 2025 09:42:03.065934896 CET	53	45160	8.8.8.8	192.168.2.14
Jan 28, 2025 09:42:03.517771006 CET	53	45160	8.8.8.8	192.168.2.14
Jan 28, 2025 09:42:03.517896891 CET	45160	53	192.168.2.14	8.8.8.8
Jan 28, 2025 09:42:03.824114084 CET	53	45160	8.8.8.8	192.168.2.14
Jan 28, 2025 09:42:03.824249983 CET	45160	53	192.168.2.14	8.8.8.8
Jan 28, 2025 09:42:05.515513897 CET	53	45160	8.8.8.8	192.168.2.14
Jan 28, 2025 09:42:05.515887022 CET	45160	53	192.168.2.14	8.8.8.8
Jan 28, 2025 09:42:05.520808935 CET	53	45160	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 28, 2025 09:42:03.061000109 CET	192.168.2.14	8.8.8.8	0x5dbd	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 28, 2025 09:42:03.061001062 CET	192.168.2.14	8.8.8.8	0xd1a7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 28, 2025 09:42:03.824114084 CET	8.8.8.8	192.168.2.14	0x5dbd	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 28, 2025 09:42:03.824114084 CET	8.8.8.8	192.168.2.14	0x5dbd	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: networkrip.armv7l.elf PID: 5576, Parent PID: 5496

General

Start time (UTC):	08:39:17
Start date (UTC):	28/01/2025
Path:	/tmp/networkrip.armv7l.elf
Arguments:	/tmp/networkrip.armv7l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: networkrip.armv7l.elf PID: 5578, Parent PID: 5576

General

Start time (UTC):	08:39:17
Start date (UTC):	28/01/2025
Path:	/tmp/networkrip.armv7l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: networkrip.armv7l.elf PID: 5580, Parent PID: 5578

General

Start time (UTC):	08:39:17
Start date (UTC):	28/01/2025
Path:	/tmp/networkrip.armv7l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report networkrip.armv7l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: networkrip.armv7l.elf PID: 5576, Parent PID: 5496

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: networkrip.armv7l.elf PID: 5578, Parent PID: 5576

Linux Analysis Report
networkrip.armv7l.elf