Edit tour

Linux Analysis Report
felkawtf.mipsel.elf

Overview

General Information

Sample name:felkawtf.mipsel.elf
Analysis ID:1620313
MD5:76678bcff664a00b3c2bf1fcb26f6f39
SHA1:5a7c3aa434fee7c7189df7f1798a7fb81afbaf59
SHA256:0383b4942b3ac84082423eec521d1ae720dcabcae04130bd03da5bbe3bcb110e
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt
Score:100
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Gafgyt
Opens /proc/net/* files useful for finding connected devices and routers
Detected TCP or UDP traffic on non-standard ports
Sample contains strings that are user agent strings indicative of HTTP manipulation
Suricata IDS alerts with low severity for network traffic
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1620313
Start date and time:2025-02-20 21:12:01 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 59s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:felkawtf.mipsel.elf
Detection:MAL
Classification:mal100.spre.troj.linELF@0/0@2/0
Command:/tmp/felkawtf.mipsel.elf
PID:5531
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
SourceRuleDescriptionAuthorStrings
felkawtf.mipsel.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    felkawtf.mipsel.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x13e64:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    SourceRuleDescriptionAuthorStrings
    5531.1.00007ff034400000.00007ff034416000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
      5531.1.00007ff034400000.00007ff034416000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0x13e64:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      5533.1.00007ff034400000.00007ff034416000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
        5533.1.00007ff034400000.00007ff034416000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
        • 0x13e64:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
        Process Memory Space: felkawtf.mipsel.elf PID: 5531Linux_Trojan_Gafgyt_ea92cca8unknownunknown
        • 0xaa8f:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
        • 0xca78:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
        Click to see the 1 entries
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2025-02-20T21:12:50.231498+010028464071A Network Trojan was detected192.168.2.153865815.204.128.306140TCP
        2025-02-20T21:15:54.736233+010028464071A Network Trojan was detected192.168.2.153866015.204.128.306140TCP
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2025-02-20T21:12:50.236549+010028484481A Network Trojan was detected192.168.2.153865815.204.128.306140TCP
        2025-02-20T21:15:54.741320+010028484481A Network Trojan was detected192.168.2.153866015.204.128.306140TCP

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: felkawtf.mipsel.elfAvira: detected
        Source: felkawtf.mipsel.elfMalware Configuration Extractor: Gafgyt {"C2 url": "15.204.128.30:6140"}
        Source: felkawtf.mipsel.elfReversingLabs: Detection: 52%
        Source: felkawtf.mipsel.elfVirustotal: Detection: 54%Perma Link

        Spreading

        barindex
        Source: /tmp/felkawtf.mipsel.elf (PID: 5531)Opens: /proc/net/routeJump to behavior

        Networking

        barindex
        Source: Network trafficSuricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.15:38658 -> 15.204.128.30:6140
        Source: Network trafficSuricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.15:38660 -> 15.204.128.30:6140
        Source: global trafficTCP traffic: 192.168.2.15:38658 -> 15.204.128.30:6140
        Source: Network trafficSuricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.15:38660 -> 15.204.128.30:6140
        Source: Network trafficSuricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.15:38658 -> 15.204.128.30:6140
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownTCP traffic detected without corresponding DNS query: 15.204.128.30
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

        System Summary

        barindex
        Source: felkawtf.mipsel.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5531.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5533.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: felkawtf.mipsel.elf PID: 5531, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: felkawtf.mipsel.elf PID: 5533, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: felkawtf.mipsel.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5531.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5533.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: felkawtf.mipsel.elf PID: 5531, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: felkawtf.mipsel.elf PID: 5533, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: classification engineClassification label: mal100.spre.troj.linELF@0/0@2/0
        Source: felkawtf.mipsel.elfELF static info symbol of initial sample: libc/string/mips/memcpy.S
        Source: felkawtf.mipsel.elfELF static info symbol of initial sample: libc/string/mips/memset.S
        Source: felkawtf.mipsel.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
        Source: felkawtf.mipsel.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
        Source: felkawtf.mipsel.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
        Source: /tmp/felkawtf.mipsel.elf (PID: 5531)Queries kernel information via 'uname': Jump to behavior
        Source: felkawtf.mipsel.elf, 5531.1.000056383aefc000.000056383af83000.rw-.sdmp, felkawtf.mipsel.elf, 5533.1.000056383aefc000.000056383af83000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
        Source: felkawtf.mipsel.elf, 5531.1.00007ffff738f000.00007ffff73b0000.rw-.sdmp, felkawtf.mipsel.elf, 5533.1.00007ffff738f000.00007ffff73b0000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/felkawtf.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/felkawtf.mipsel.elf
        Source: felkawtf.mipsel.elf, 5531.1.000056383aefc000.000056383af83000.rw-.sdmp, felkawtf.mipsel.elf, 5533.1.000056383aefc000.000056383af83000.rw-.sdmpBinary or memory string: :8V!/etc/qemu-binfmt/mipsel
        Source: felkawtf.mipsel.elf, 5531.1.00007ffff738f000.00007ffff73b0000.rw-.sdmp, felkawtf.mipsel.elf, 5533.1.00007ffff738f000.00007ffff73b0000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: felkawtf.mipsel.elf, type: SAMPLE
        Source: Yara matchFile source: 5531.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5533.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORY
        Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
        Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.0 Mobile/14F89 Safari/602.1
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 5.0.2; HTCONE Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
        Source: Initial sampleUser agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Mobile/14F89
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

        Remote Access Functionality

        barindex
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
        Source: Yara matchFile source: felkawtf.mipsel.elf, type: SAMPLE
        Source: Yara matchFile source: 5531.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5533.1.00007ff034400000.00007ff034416000.r-x.sdmp, type: MEMORY
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Data Obfuscation
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
        Remote System Discovery
        Remote Desktop ProtocolData from Removable Media1
        Non-Standard Port
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Non-Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Application Layer Protocol
        Traffic DuplicationData Destruction
        {
          "C2 url": "15.204.128.30:6140"
        }
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1620313 Sample: felkawtf.mipsel.elf Startdate: 20/02/2025 Architecture: LINUX Score: 100 15 15.204.128.30, 38658, 38660, 6140 HP-INTERNET-ASUS United States 2->15 17 daisy.ubuntu.com 2->17 19 Suricata IDS alerts for network traffic 2->19 21 Found malware configuration 2->21 23 Malicious sample detected (through community Yara rule) 2->23 25 4 other signatures 2->25 8 felkawtf.mipsel.elf 2->8         started        signatures3 process4 signatures5 27 Opens /proc/net/* files useful for finding connected devices and routers 8->27 11 felkawtf.mipsel.elf 8->11         started        process6 process7 13 felkawtf.mipsel.elf 11->13         started       

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        felkawtf.mipsel.elf53%ReversingLabsLinux.Backdoor.Bashlite
        felkawtf.mipsel.elf55%VirustotalBrowse
        felkawtf.mipsel.elf100%AviraEXP/ELF.Mirai.Z
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.24
        truefalse
          high
          NameMaliciousAntivirus DetectionReputation
          15.204.128.30:6140false
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            15.204.128.30
            unknownUnited States
            71HP-INTERNET-ASUStrue
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            15.204.128.30felkawtf.mips.elfGet hashmaliciousMirai, GafgytBrowse
              felkawtf.i686.elfGet hashmaliciousMirai, GafgytBrowse
                felkawtf.armv6l.elfGet hashmaliciousMirai, GafgytBrowse
                  felkawtf.m68k.elfGet hashmaliciousMirai, GafgytBrowse
                    felkawtf.sh4.elfGet hashmaliciousMirai, GafgytBrowse
                      felkawtf.x86.elfGet hashmaliciousMirai, GafgytBrowse
                        felkawtf.armv5l.elfGet hashmaliciousMirai, GafgytBrowse
                          felkawtf.armv7l.elfGet hashmaliciousMirai, GafgytBrowse
                            felkawtf.sparc.elfGet hashmaliciousMirai, GafgytBrowse
                              felkawtf.i586.elfGet hashmaliciousMirai, GafgytBrowse
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                daisy.ubuntu.comfelkawtf.mips.elfGet hashmaliciousMirai, GafgytBrowse
                                • 162.213.35.25
                                am6.nn.elfGet hashmaliciousMirai, MoobotBrowse
                                • 162.213.35.25
                                felkawtf.armv6l.elfGet hashmaliciousMirai, GafgytBrowse
                                • 162.213.35.24
                                felkawtf.m68k.elfGet hashmaliciousMirai, GafgytBrowse
                                • 162.213.35.24
                                felkawtf.sh4.elfGet hashmaliciousMirai, GafgytBrowse
                                • 162.213.35.25
                                felkawtf.armv5l.elfGet hashmaliciousMirai, GafgytBrowse
                                • 162.213.35.24
                                felkawtf.armv7l.elfGet hashmaliciousMirai, GafgytBrowse
                                • 162.213.35.24
                                felkawtf.sparc.elfGet hashmaliciousMirai, GafgytBrowse
                                • 162.213.35.25
                                hidakibest.sparc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 162.213.35.24
                                hidakibest.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 162.213.35.25
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                HP-INTERNET-ASUSfelkawtf.mips.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                felkawtf.i686.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                felkawtf.armv6l.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                felkawtf.m68k.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                felkawtf.sh4.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                felkawtf.x86.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                Orden de compra_xl.exeGet hashmaliciousDarkCloudBrowse
                                • 15.235.119.29
                                felkawtf.armv5l.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                felkawtf.armv7l.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                felkawtf.sparc.elfGet hashmaliciousMirai, GafgytBrowse
                                • 15.204.128.30
                                No context
                                No context
                                No created / dropped files found
                                File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
                                Entropy (8bit):5.4286982572061095
                                TrID:
                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                File name:felkawtf.mipsel.elf
                                File size:121'553 bytes
                                MD5:76678bcff664a00b3c2bf1fcb26f6f39
                                SHA1:5a7c3aa434fee7c7189df7f1798a7fb81afbaf59
                                SHA256:0383b4942b3ac84082423eec521d1ae720dcabcae04130bd03da5bbe3bcb110e
                                SHA512:f5fb359912a9889b3c01939cc8c7a1c5dff1b44cbdb0cb4f2032459548107f58d447d35e4661faced04ed3abe3731cd1128f465587d8d4d4f4857352f5d1e45d
                                SSDEEP:1536:UPeTk+z1T8RoZaM9ZIAZsUEo8IgwagKWqFMtOFqUmkixFxfC7cgjQ:USJZa+zst1wa/ywFqUmkixFxfKcgjQ
                                TLSH:A3C3B516AB65CEBBC81EDD3306AEC601108DA0D606E52B6B7774CA1CE71B8DF09E3D54
                                File Content Preview:.ELF......................@.4...`.......4. ...(........p......@...@...........................@...@..]...]...............`...`E..`E.$...4m..........Q.td..................................................E....<...'!......'.......................<...'!... ..

                                ELF header

                                Class:ELF32
                                Data:2's complement, little endian
                                Version:1 (current)
                                Machine:MIPS R3000
                                Version Number:0x1
                                Type:EXEC (Executable file)
                                OS/ABI:UNIX - System V
                                ABI Version:0
                                Entry Point Address:0x4002a0
                                Flags:0x1007
                                ELF Header Size:52
                                Program Header Offset:52
                                Program Header Size:32
                                Number of Program Headers:4
                                Section Header Offset:101984
                                Section Header Size:40
                                Number of Section Headers:21
                                Header String Table Index:18
                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                NULL0x00x00x00x00x0000
                                .reginfoMIPS_REGINFO0x4000b40xb40x180x180x2A004
                                .initPROGBITS0x4000cc0xcc0x8c0x00x6AX004
                                .textPROGBITS0x4001600x1600x11cb00x00x6AX0016
                                .finiPROGBITS0x411e100x11e100x5c0x00x6AX004
                                .rodataPROGBITS0x411e700x11e700x3f600x00x2A0016
                                .eh_framePROGBITS0x415dd00x15dd00x40x00x2A004
                                .ctorsPROGBITS0x4560000x160000x80x00x3WA004
                                .dtorsPROGBITS0x4560080x160080x80x00x3WA004
                                .jcrPROGBITS0x4560100x160100x40x00x3WA004
                                .data.rel.roPROGBITS0x4560140x160140x2c0x00x3WA004
                                .dataPROGBITS0x4560400x160400x4900x00x3WA0016
                                .gotPROGBITS0x4564d00x164d00x4540x40x10000003WAp0016
                                .sbssNOBITS0x4569240x169240x180x00x10000003WAp004
                                .bssNOBITS0x4569400x169240x63f40x00x3WA0016
                                .commentPROGBITS0x00x169240xa9e0x00x0001
                                .mdebug.abi32PROGBITS0xa9e0x173c20x00x00x0001
                                .pdrPROGBITS0x00x173c40x1a000x00x0004
                                .shstrtabSTRTAB0x00x18dc40x9a0x00x0001
                                .symtabSYMTAB0x00x191a80x29e00x100x0202854
                                .strtabSTRTAB0x00x1bb880x1f490x00x0001
                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                <unknown>0xb40x4000b40x4000b40x180x180.98340x4R 0x4.reginfo
                                LOAD0x00x4000000x4000000x15dd40x15dd45.47430x5R E0x10000.reginfo .init .text .fini .rodata .eh_frame
                                LOAD0x160000x4560000x4560000x9240x6d344.02800x6RW 0x10000.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
                                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                .symtab0x4000b40SECTION<unknown>DEFAULT1
                                .symtab0x4000cc0SECTION<unknown>DEFAULT2
                                .symtab0x4001600SECTION<unknown>DEFAULT3
                                .symtab0x411e100SECTION<unknown>DEFAULT4
                                .symtab0x411e700SECTION<unknown>DEFAULT5
                                .symtab0x415dd00SECTION<unknown>DEFAULT6
                                .symtab0x4560000SECTION<unknown>DEFAULT7
                                .symtab0x4560080SECTION<unknown>DEFAULT8
                                .symtab0x4560100SECTION<unknown>DEFAULT9
                                .symtab0x4560140SECTION<unknown>DEFAULT10
                                .symtab0x4560400SECTION<unknown>DEFAULT11
                                .symtab0x4564d00SECTION<unknown>DEFAULT12
                                .symtab0x4569240SECTION<unknown>DEFAULT13
                                .symtab0x4569400SECTION<unknown>DEFAULT14
                                .symtab0x00SECTION<unknown>DEFAULT15
                                .symtab0xa9e0SECTION<unknown>DEFAULT16
                                .symtab0x00SECTION<unknown>DEFAULT17
                                .symtab0x00SECTION<unknown>DEFAULT18
                                .symtab0x00SECTION<unknown>DEFAULT19
                                .symtab0x00SECTION<unknown>DEFAULT20
                                C.130.5245.symtab0x45603412OBJECT<unknown>DEFAULT10
                                C.80.4819.symtab0x45601432OBJECT<unknown>DEFAULT10
                                Nulled.symtab0x45cc3080OBJECT<unknown>DEFAULT14
                                Q.symtab0x45697816384OBJECT<unknown>DEFAULT14
                                SendHTTP.symtab0x4043fc624FUNC<unknown>DEFAULT3
                                SendHttpRand.symtab0x40466c836FUNC<unknown>DEFAULT3
                                SendSTDHEX.symtab0x402b00892FUNC<unknown>DEFAULT3
                                _GLOBAL_OFFSET_TABLE_.symtab0x4564d00OBJECT<unknown>DEFAULT12
                                _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __CTOR_END__.symtab0x4560040OBJECT<unknown>DEFAULT7
                                __CTOR_LIST__.symtab0x4560000OBJECT<unknown>DEFAULT7
                                __C_ctype_b.symtab0x4560f04OBJECT<unknown>DEFAULT11
                                __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __C_ctype_b_data.symtab0x414630768OBJECT<unknown>DEFAULT5
                                __C_ctype_tolower.symtab0x4564c04OBJECT<unknown>DEFAULT11
                                __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __C_ctype_tolower_data.symtab0x415ad0768OBJECT<unknown>DEFAULT5
                                __C_ctype_toupper.symtab0x4561004OBJECT<unknown>DEFAULT11
                                __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __C_ctype_toupper_data.symtab0x414930768OBJECT<unknown>DEFAULT5
                                __DTOR_END__.symtab0x45600c0OBJECT<unknown>DEFAULT8
                                __DTOR_LIST__.symtab0x4560080OBJECT<unknown>DEFAULT8
                                __EH_FRAME_BEGIN__.symtab0x415dd00OBJECT<unknown>DEFAULT6
                                __FRAME_END__.symtab0x415dd00OBJECT<unknown>DEFAULT6
                                __GI___C_ctype_b.symtab0x4560f04OBJECT<unknown>HIDDEN11
                                __GI___C_ctype_b_data.symtab0x414630768OBJECT<unknown>HIDDEN5
                                __GI___C_ctype_tolower.symtab0x4564c04OBJECT<unknown>HIDDEN11
                                __GI___C_ctype_tolower_data.symtab0x415ad0768OBJECT<unknown>HIDDEN5
                                __GI___C_ctype_toupper.symtab0x4561004OBJECT<unknown>HIDDEN11
                                __GI___C_ctype_toupper_data.symtab0x414930768OBJECT<unknown>HIDDEN5
                                __GI___ctype_b.symtab0x4560f44OBJECT<unknown>HIDDEN11
                                __GI___ctype_tolower.symtab0x4564c44OBJECT<unknown>HIDDEN11
                                __GI___ctype_toupper.symtab0x4561044OBJECT<unknown>HIDDEN11
                                __GI___errno_location.symtab0x407ce024FUNC<unknown>HIDDEN3
                                __GI___fgetc_unlocked.symtab0x4116f0388FUNC<unknown>HIDDEN3
                                __GI___glibc_strerror_r.symtab0x409b4068FUNC<unknown>HIDDEN3
                                __GI___h_errno_location.symtab0x40c7f024FUNC<unknown>HIDDEN3
                                __GI___libc_fcntl.symtab0x4075b0136FUNC<unknown>HIDDEN3
                                __GI___libc_fcntl64.symtab0x407640104FUNC<unknown>HIDDEN3
                                __GI___libc_open.symtab0x4079b0124FUNC<unknown>HIDDEN3
                                __GI___uClibc_fini.symtab0x40bde0196FUNC<unknown>HIDDEN3
                                __GI___uClibc_init.symtab0x40bf3c140FUNC<unknown>HIDDEN3
                                __GI___xpg_strerror_r.symtab0x409b90392FUNC<unknown>HIDDEN3
                                __GI__exit.symtab0x4076b080FUNC<unknown>HIDDEN3
                                __GI_abort.symtab0x40ef70428FUNC<unknown>HIDDEN3
                                __GI_atoi.symtab0x40b79028FUNC<unknown>HIDDEN3
                                __GI_atol.symtab0x40b79028FUNC<unknown>HIDDEN3
                                __GI_brk.symtab0x40f150112FUNC<unknown>HIDDEN3
                                __GI_chdir.symtab0x40776088FUNC<unknown>HIDDEN3
                                __GI_close.symtab0x4077c084FUNC<unknown>HIDDEN3
                                __GI_connect.symtab0x40a50084FUNC<unknown>HIDDEN3
                                __GI_errno.symtab0x45cbe04OBJECT<unknown>HIDDEN14
                                __GI_exit.symtab0x40ba20236FUNC<unknown>HIDDEN3
                                __GI_fclose.symtab0x40f220512FUNC<unknown>HIDDEN3
                                __GI_fcntl.symtab0x4075b0136FUNC<unknown>HIDDEN3
                                __GI_fcntl64.symtab0x407640104FUNC<unknown>HIDDEN3
                                __GI_fflush_unlocked.symtab0x40fdb0628FUNC<unknown>HIDDEN3
                                __GI_fgetc_unlocked.symtab0x4116f0388FUNC<unknown>HIDDEN3
                                __GI_fgets.symtab0x40fb40216FUNC<unknown>HIDDEN3
                                __GI_fgets_unlocked.symtab0x410030268FUNC<unknown>HIDDEN3
                                __GI_fopen.symtab0x40f42028FUNC<unknown>HIDDEN3
                                __GI_fork.symtab0x40782084FUNC<unknown>HIDDEN3
                                __GI_fputs_unlocked.symtab0x4093b0128FUNC<unknown>HIDDEN3
                                __GI_fseek.symtab0x40f44068FUNC<unknown>HIDDEN3
                                __GI_fseeko64.symtab0x40f490388FUNC<unknown>HIDDEN3
                                __GI_fwrite_unlocked.symtab0x409430280FUNC<unknown>HIDDEN3
                                __GI_getc_unlocked.symtab0x4116f0388FUNC<unknown>HIDDEN3
                                __GI_getegid.symtab0x40c48088FUNC<unknown>HIDDEN3
                                __GI_geteuid.symtab0x40c4e088FUNC<unknown>HIDDEN3
                                __GI_getgid.symtab0x40c54084FUNC<unknown>HIDDEN3
                                __GI_gethostbyname.symtab0x40a020116FUNC<unknown>HIDDEN3
                                __GI_gethostbyname_r.symtab0x40a0a01108FUNC<unknown>HIDDEN3
                                __GI_getpid.symtab0x40788084FUNC<unknown>HIDDEN3
                                __GI_getsockname.symtab0x40a56084FUNC<unknown>HIDDEN3
                                __GI_getuid.symtab0x40c5a084FUNC<unknown>HIDDEN3
                                __GI_h_errno.symtab0x45cbe44OBJECT<unknown>HIDDEN14
                                __GI_inet_addr.symtab0x409fd072FUNC<unknown>HIDDEN3
                                __GI_inet_aton.symtab0x40dff0280FUNC<unknown>HIDDEN3
                                __GI_inet_ntoa.symtab0x409fac32FUNC<unknown>HIDDEN3
                                __GI_inet_ntoa_r.symtab0x409ef0188FUNC<unknown>HIDDEN3
                                __GI_inet_ntop.symtab0x410950852FUNC<unknown>HIDDEN3
                                __GI_inet_pton.symtab0x4104a0700FUNC<unknown>HIDDEN3
                                __GI_initstate_r.symtab0x40b640328FUNC<unknown>HIDDEN3
                                __GI_ioctl.symtab0x4078e0104FUNC<unknown>HIDDEN3
                                __GI_isatty.symtab0x409d8060FUNC<unknown>HIDDEN3
                                __GI_kill.symtab0x40795088FUNC<unknown>HIDDEN3
                                __GI_lseek64.symtab0x411600164FUNC<unknown>HIDDEN3
                                __GI_memchr.symtab0x40d880264FUNC<unknown>HIDDEN3
                                __GI_memcpy.symtab0x409550308FUNC<unknown>HIDDEN3
                                __GI_memmove.symtab0x40d990816FUNC<unknown>HIDDEN3
                                __GI_mempcpy.symtab0x40dcc076FUNC<unknown>HIDDEN3
                                __GI_memrchr.symtab0x40dd10272FUNC<unknown>HIDDEN3
                                __GI_memset.symtab0x409690144FUNC<unknown>HIDDEN3
                                __GI_nanosleep.symtab0x40c60084FUNC<unknown>HIDDEN3
                                __GI_open.symtab0x4079b0124FUNC<unknown>HIDDEN3
                                __GI_poll.symtab0x40f1c084FUNC<unknown>HIDDEN3
                                __GI_raise.symtab0x4115b076FUNC<unknown>HIDDEN3
                                __GI_random.symtab0x40b010164FUNC<unknown>HIDDEN3
                                __GI_random_r.symtab0x40b41c176FUNC<unknown>HIDDEN3
                                __GI_rawmemchr.symtab0x410140200FUNC<unknown>HIDDEN3
                                __GI_read.symtab0x407a5084FUNC<unknown>HIDDEN3
                                __GI_recv.symtab0x40a64084FUNC<unknown>HIDDEN3
                                __GI_sbrk.symtab0x40c660144FUNC<unknown>HIDDEN3
                                __GI_select.symtab0x407ab0120FUNC<unknown>HIDDEN3
                                __GI_send.symtab0x40a6a084FUNC<unknown>HIDDEN3
                                __GI_sendto.symtab0x40a700128FUNC<unknown>HIDDEN3
                                __GI_setsid.symtab0x407b3084FUNC<unknown>HIDDEN3
                                __GI_setsockopt.symtab0x40a780120FUNC<unknown>HIDDEN3
                                __GI_setstate_r.symtab0x40b2e0316FUNC<unknown>HIDDEN3
                                __GI_sigaction.symtab0x40c330232FUNC<unknown>HIDDEN3
                                __GI_signal.symtab0x40a860252FUNC<unknown>HIDDEN3
                                __GI_sigprocmask.symtab0x40c6f0148FUNC<unknown>HIDDEN3
                                __GI_sleep.symtab0x40bb10564FUNC<unknown>HIDDEN3
                                __GI_socket.symtab0x40a80084FUNC<unknown>HIDDEN3
                                __GI_sprintf.symtab0x407d0080FUNC<unknown>HIDDEN3
                                __GI_srandom_r.symtab0x40b4cc372FUNC<unknown>HIDDEN3
                                __GI_strcasecmp.symtab0x411880108FUNC<unknown>HIDDEN3
                                __GI_strchr.symtab0x409720256FUNC<unknown>HIDDEN3
                                __GI_strcmp.symtab0x40982044FUNC<unknown>HIDDEN3
                                __GI_strcoll.symtab0x40982044FUNC<unknown>HIDDEN3
                                __GI_strcpy.symtab0x40985036FUNC<unknown>HIDDEN3
                                __GI_strdup.symtab0x410320144FUNC<unknown>HIDDEN3
                                __GI_strlen.symtab0x409880184FUNC<unknown>HIDDEN3
                                __GI_strncat.symtab0x410210180FUNC<unknown>HIDDEN3
                                __GI_strncpy.symtab0x40de20188FUNC<unknown>HIDDEN3
                                __GI_strnlen.symtab0x409940256FUNC<unknown>HIDDEN3
                                __GI_strpbrk.symtab0x40dfb064FUNC<unknown>HIDDEN3
                                __GI_strspn.symtab0x4102d076FUNC<unknown>HIDDEN3
                                __GI_strstr.symtab0x409a40256FUNC<unknown>HIDDEN3
                                __GI_strtok.symtab0x409d6032FUNC<unknown>HIDDEN3
                                __GI_strtok_r.symtab0x40dee0204FUNC<unknown>HIDDEN3
                                __GI_strtol.symtab0x40b7b028FUNC<unknown>HIDDEN3
                                __GI_tcgetattr.symtab0x409dc0176FUNC<unknown>HIDDEN3
                                __GI_time.symtab0x407b9084FUNC<unknown>HIDDEN3
                                __GI_tolower.symtab0x4116b060FUNC<unknown>HIDDEN3
                                __GI_toupper.symtab0x407ca060FUNC<unknown>HIDDEN3
                                __GI_vsnprintf.symtab0x407d50260FUNC<unknown>HIDDEN3
                                __GI_wait4.symtab0x40c79088FUNC<unknown>HIDDEN3
                                __GI_waitpid.symtab0x407bf028FUNC<unknown>HIDDEN3
                                __GI_wcrtomb.symtab0x40c810112FUNC<unknown>HIDDEN3
                                __GI_wcsnrtombs.symtab0x40c8c0228FUNC<unknown>HIDDEN3
                                __GI_wcsrtombs.symtab0x40c88064FUNC<unknown>HIDDEN3
                                __GI_write.symtab0x407c1084FUNC<unknown>HIDDEN3
                                __JCR_END__.symtab0x4560100OBJECT<unknown>DEFAULT9
                                __JCR_LIST__.symtab0x4560100OBJECT<unknown>DEFAULT9
                                __app_fini.symtab0x45cbcc4OBJECT<unknown>HIDDEN14
                                __atexit_lock.symtab0x45644024OBJECT<unknown>DEFAULT11
                                __bsd_signal.symtab0x40a860252FUNC<unknown>HIDDEN3
                                __bss_start.symtab0x4569240NOTYPE<unknown>DEFAULTSHN_ABS
                                __check_one_fd.symtab0x40beb4136FUNC<unknown>DEFAULT3
                                __ctype_b.symtab0x4560f44OBJECT<unknown>DEFAULT11
                                __ctype_tolower.symtab0x4564c44OBJECT<unknown>DEFAULT11
                                __ctype_toupper.symtab0x4561044OBJECT<unknown>DEFAULT11
                                __curbrk.symtab0x45cc204OBJECT<unknown>HIDDEN14
                                __data_start.symtab0x4560600OBJECT<unknown>DEFAULT11
                                __decode_answer.symtab0x410fb0340FUNC<unknown>HIDDEN3
                                __decode_dotted.symtab0x411a10340FUNC<unknown>HIDDEN3
                                __decode_header.symtab0x410dc0228FUNC<unknown>HIDDEN3
                                __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                __dns_lookup.symtab0x40e1102568FUNC<unknown>HIDDEN3
                                __do_global_ctors_aux.symtab0x411da00FUNC<unknown>DEFAULT3
                                __do_global_dtors_aux.symtab0x4001600FUNC<unknown>DEFAULT3
                                __dso_handle.symtab0x4560400OBJECT<unknown>HIDDEN11
                                __encode_dotted.symtab0x4118f0280FUNC<unknown>HIDDEN3
                                __encode_header.symtab0x410cb0272FUNC<unknown>HIDDEN3
                                __encode_question.symtab0x410eb0172FUNC<unknown>HIDDEN3
                                __environ.symtab0x45cbc44OBJECT<unknown>DEFAULT14
                                __errno_location.symtab0x407ce024FUNC<unknown>DEFAULT3
                                __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __exit_cleanup.symtab0x45cbb04OBJECT<unknown>HIDDEN14
                                __fgetc_unlocked.symtab0x4116f0388FUNC<unknown>DEFAULT3
                                __fini_array_end.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                __fini_array_start.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                __get_hosts_byname_r.symtab0x40ef00104FUNC<unknown>HIDDEN3
                                __glibc_strerror_r.symtab0x409b4068FUNC<unknown>DEFAULT3
                                __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __h_errno_location.symtab0x40c7f024FUNC<unknown>DEFAULT3
                                __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __heap_alloc.symtab0x40ad70188FUNC<unknown>DEFAULT3
                                __heap_free.symtab0x40ae78364FUNC<unknown>DEFAULT3
                                __heap_link_free_area.symtab0x40ae3044FUNC<unknown>DEFAULT3
                                __heap_link_free_area_after.symtab0x40ae5c28FUNC<unknown>DEFAULT3
                                __init_array_end.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                __init_array_start.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                __length_dotted.symtab0x411b7072FUNC<unknown>HIDDEN3
                                __length_question.symtab0x410f6072FUNC<unknown>HIDDEN3
                                __libc_close.symtab0x4077c084FUNC<unknown>DEFAULT3
                                __libc_connect.symtab0x40a50084FUNC<unknown>DEFAULT3
                                __libc_creat.symtab0x407a2c28FUNC<unknown>DEFAULT3
                                __libc_fcntl.symtab0x4075b0136FUNC<unknown>DEFAULT3
                                __libc_fcntl64.symtab0x407640104FUNC<unknown>DEFAULT3
                                __libc_fork.symtab0x40782084FUNC<unknown>DEFAULT3
                                __libc_getpid.symtab0x40788084FUNC<unknown>DEFAULT3
                                __libc_lseek64.symtab0x411600164FUNC<unknown>DEFAULT3
                                __libc_nanosleep.symtab0x40c60084FUNC<unknown>DEFAULT3
                                __libc_open.symtab0x4079b0124FUNC<unknown>DEFAULT3
                                __libc_poll.symtab0x40f1c084FUNC<unknown>DEFAULT3
                                __libc_read.symtab0x407a5084FUNC<unknown>DEFAULT3
                                __libc_recv.symtab0x40a64084FUNC<unknown>DEFAULT3
                                __libc_select.symtab0x407ab0120FUNC<unknown>DEFAULT3
                                __libc_send.symtab0x40a6a084FUNC<unknown>DEFAULT3
                                __libc_sendto.symtab0x40a700128FUNC<unknown>DEFAULT3
                                __libc_sigaction.symtab0x40c330232FUNC<unknown>DEFAULT3
                                __libc_stack_end.symtab0x45cbc04OBJECT<unknown>DEFAULT14
                                __libc_waitpid.symtab0x407bf028FUNC<unknown>DEFAULT3
                                __libc_write.symtab0x407c1084FUNC<unknown>DEFAULT3
                                __malloc_heap.symtab0x4563704OBJECT<unknown>DEFAULT11
                                __malloc_heap_lock.symtab0x45cb9024OBJECT<unknown>DEFAULT14
                                __malloc_sbrk_lock.symtab0x45cd0024OBJECT<unknown>DEFAULT14
                                __nameserver.symtab0x45cd2812OBJECT<unknown>HIDDEN14
                                __nameservers.symtab0x45692c4OBJECT<unknown>HIDDEN13
                                __open_etc_hosts.symtab0x411110108FUNC<unknown>HIDDEN3
                                __open_nameservers.symtab0x40eb20984FUNC<unknown>HIDDEN3
                                __pagesize.symtab0x45cbc84OBJECT<unknown>DEFAULT14
                                __preinit_array_end.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                __preinit_array_start.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                __pthread_initialize_minimal.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                __pthread_mutex_init.symtab0x40bea48FUNC<unknown>DEFAULT3
                                __pthread_mutex_lock.symtab0x40bea48FUNC<unknown>DEFAULT3
                                __pthread_mutex_trylock.symtab0x40bea48FUNC<unknown>DEFAULT3
                                __pthread_mutex_unlock.symtab0x40bea48FUNC<unknown>DEFAULT3
                                __pthread_return_0.symtab0x40bea48FUNC<unknown>DEFAULT3
                                __pthread_return_void.symtab0x40beac8FUNC<unknown>DEFAULT3
                                __raise.symtab0x4115b076FUNC<unknown>HIDDEN3
                                __read_etc_hosts_r.symtab0x41117c1076FUNC<unknown>HIDDEN3
                                __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                __resolv_lock.symtab0x45648024OBJECT<unknown>DEFAULT11
                                __rtld_fini.symtab0x45cbd04OBJECT<unknown>HIDDEN14
                                __searchdomain.symtab0x45cd1816OBJECT<unknown>HIDDEN14
                                __searchdomains.symtab0x4569304OBJECT<unknown>HIDDEN13
                                __sigaddset.symtab0x40a98844FUNC<unknown>DEFAULT3
                                __sigdelset.symtab0x40a9b448FUNC<unknown>DEFAULT3
                                __sigismember.symtab0x40a96040FUNC<unknown>DEFAULT3
                                __start.symtab0x4002a0100FUNC<unknown>DEFAULT3
                                __stdin.symtab0x45615c4OBJECT<unknown>DEFAULT11
                                __stdio_READ.symtab0x411bc0140FUNC<unknown>HIDDEN3
                                __stdio_WRITE.symtab0x40c9b0280FUNC<unknown>HIDDEN3
                                __stdio_adjust_position.symtab0x40f620320FUNC<unknown>HIDDEN3
                                __stdio_fwrite.symtab0x40cad0472FUNC<unknown>HIDDEN3
                                __stdio_init_mutex.symtab0x407f1832FUNC<unknown>HIDDEN3
                                __stdio_mutex_initializer.3833.symtab0x414c3024OBJECT<unknown>DEFAULT5
                                __stdio_rfill.symtab0x411c5088FUNC<unknown>HIDDEN3
                                __stdio_seek.symtab0x40fad0112FUNC<unknown>HIDDEN3
                                __stdio_trans2r_o.symtab0x411cb0228FUNC<unknown>HIDDEN3
                                __stdio_trans2w_o.symtab0x40ccb0308FUNC<unknown>HIDDEN3
                                __stdio_wcommit.symtab0x408060100FUNC<unknown>HIDDEN3
                                __stdout.symtab0x4561604OBJECT<unknown>DEFAULT11
                                __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __syscall_rt_sigaction.symtab0x40c42084FUNC<unknown>HIDDEN3
                                __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __uClibc_fini.symtab0x40bde0196FUNC<unknown>DEFAULT3
                                __uClibc_init.symtab0x40bf3c140FUNC<unknown>DEFAULT3
                                __uClibc_main.symtab0x40bfc8864FUNC<unknown>DEFAULT3
                                __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                __uclibc_progname.symtab0x4564604OBJECT<unknown>HIDDEN11
                                __xpg_strerror_r.symtab0x409b90392FUNC<unknown>DEFAULT3
                                __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _charpad.symtab0x4080d0128FUNC<unknown>DEFAULT3
                                _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _dl_aux_init.symtab0x40f12044FUNC<unknown>DEFAULT3
                                _dl_phdr.symtab0x4569344OBJECT<unknown>DEFAULT13
                                _dl_phnum.symtab0x4569384OBJECT<unknown>DEFAULT13
                                _edata.symtab0x4569240NOTYPE<unknown>DEFAULTSHN_ABS
                                _end.symtab0x45cd340NOTYPE<unknown>DEFAULTSHN_ABS
                                _errno.symtab0x45cbe04OBJECT<unknown>DEFAULT14
                                _exit.symtab0x4076b080FUNC<unknown>DEFAULT3
                                _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _fbss.symtab0x4569240NOTYPE<unknown>DEFAULTSHN_ABS
                                _fdata.symtab0x4560400NOTYPE<unknown>DEFAULT11
                                _fini.symtab0x411e1028FUNC<unknown>DEFAULT4
                                _fixed_buffers.symtab0x45a9888192OBJECT<unknown>DEFAULT14
                                _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _fp_out_narrow.symtab0x408150228FUNC<unknown>DEFAULT3
                                _fpmaxtostr.symtab0x40d0302120FUNC<unknown>HIDDEN3
                                _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _ftext.symtab0x4001600NOTYPE<unknown>DEFAULT3
                                _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _gp.symtab0x45e4c00NOTYPE<unknown>DEFAULTSHN_ABS
                                _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                _h_errno.symtab0x45cbe44OBJECT<unknown>DEFAULT14
                                _init.symtab0x4000cc28FUNC<unknown>DEFAULT2
                                _load_inttype.symtab0x40cdf0136FUNC<unknown>HIDDEN3
                                _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _ppfs_init.symtab0x4089e0220FUNC<unknown>HIDDEN3
                                _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _ppfs_parsespec.symtab0x408dbc1512FUNC<unknown>HIDDEN3
                                _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _ppfs_prepargs.symtab0x408ac0100FUNC<unknown>HIDDEN3
                                _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _ppfs_setargs.symtab0x408b30544FUNC<unknown>HIDDEN3
                                _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _promoted_size.symtab0x408d50108FUNC<unknown>DEFAULT3
                                _pthread_cleanup_pop_restore.symtab0x40beac8FUNC<unknown>DEFAULT3
                                _pthread_cleanup_push_defer.symtab0x40beac8FUNC<unknown>DEFAULT3
                                _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _sigintr.symtab0x45cc80128OBJECT<unknown>HIDDEN14
                                _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _stdio_fopen.symtab0x40f760880FUNC<unknown>HIDDEN3
                                _stdio_init.symtab0x407e60184FUNC<unknown>HIDDEN3
                                _stdio_openlist.symtab0x4561644OBJECT<unknown>DEFAULT11
                                _stdio_openlist_add_lock.symtab0x45611024OBJECT<unknown>DEFAULT11
                                _stdio_openlist_dec_use.symtab0x40fc20400FUNC<unknown>DEFAULT3
                                _stdio_openlist_del_count.symtab0x45a9844OBJECT<unknown>DEFAULT14
                                _stdio_openlist_del_lock.symtab0x45612824OBJECT<unknown>DEFAULT11
                                _stdio_openlist_use_count.symtab0x45a9804OBJECT<unknown>DEFAULT14
                                _stdio_streams.symtab0x456168240OBJECT<unknown>DEFAULT11
                                _stdio_term.symtab0x407f38284FUNC<unknown>HIDDEN3
                                _stdio_user_locking.symtab0x4561404OBJECT<unknown>DEFAULT11
                                _stdlib_strto_l.symtab0x40b7d0592FUNC<unknown>HIDDEN3
                                _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _store_inttype.symtab0x40ce8068FUNC<unknown>HIDDEN3
                                _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _string_syserrmsgs.symtab0x414da02934OBJECT<unknown>HIDDEN5
                                _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _uintmaxtostr.symtab0x40ced0340FUNC<unknown>HIDDEN3
                                _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _vfprintf_internal.symtab0x4082341960FUNC<unknown>HIDDEN3
                                _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                abort.symtab0x40ef70428FUNC<unknown>DEFAULT3
                                abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                access.symtab0x40770084FUNC<unknown>DEFAULT3
                                access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                atoi.symtab0x40b79028FUNC<unknown>DEFAULT3
                                atol.symtab0x40b79028FUNC<unknown>DEFAULT3
                                atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                bcopy.symtab0x409d2032FUNC<unknown>DEFAULT3
                                bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                been_there_done_that.symtab0x45cc104OBJECT<unknown>DEFAULT14
                                been_there_done_that.2792.symtab0x45cbd44OBJECT<unknown>DEFAULT14
                                bot.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                brk.symtab0x40f150112FUNC<unknown>DEFAULT3
                                brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                bsd_signal.symtab0x40a860252FUNC<unknown>DEFAULT3
                                buf.2613.symtab0x45c9a016OBJECT<unknown>DEFAULT14
                                buf.4833.symtab0x45c9b0460OBJECT<unknown>DEFAULT14
                                bzero.symtab0x409d4028FUNC<unknown>DEFAULT3
                                bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                c.symtab0x4560744OBJECT<unknown>DEFAULT11
                                cck.symtab0x4028e8536FUNC<unknown>DEFAULT3
                                chdir.symtab0x40776088FUNC<unknown>DEFAULT3
                                chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                close.symtab0x4077c084FUNC<unknown>DEFAULT3
                                close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                commServer.symtab0x4560804OBJECT<unknown>DEFAULT11
                                completed.2296.symtab0x4569401OBJECT<unknown>DEFAULT14
                                connect.symtab0x40a50084FUNC<unknown>DEFAULT3
                                connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                connectTimeout.symtab0x401edc828FUNC<unknown>DEFAULT3
                                creat.symtab0x407a2c28FUNC<unknown>DEFAULT3
                                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                csum.symtab0x4025b8460FUNC<unknown>DEFAULT3
                                currentServer.symtab0x4560704OBJECT<unknown>DEFAULT11
                                data_start.symtab0x4560600OBJECT<unknown>DEFAULT11
                                decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                environ.symtab0x45cbc44OBJECT<unknown>DEFAULT14
                                errno.symtab0x45cbe04OBJECT<unknown>DEFAULT14
                                errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                estridx.symtab0x414d10126OBJECT<unknown>DEFAULT5
                                exit.symtab0x40ba20236FUNC<unknown>DEFAULT3
                                exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                exp10_table.symtab0x4159b872OBJECT<unknown>DEFAULT5
                                fclose.symtab0x40f220512FUNC<unknown>DEFAULT3
                                fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fcntl.symtab0x4075b0136FUNC<unknown>DEFAULT3
                                fcntl64.symtab0x407640104FUNC<unknown>DEFAULT3
                                fdgets.symtab0x4006c0292FUNC<unknown>DEFAULT3
                                fflush_unlocked.symtab0x40fdb0628FUNC<unknown>DEFAULT3
                                fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fgetc_unlocked.symtab0x4116f0388FUNC<unknown>DEFAULT3
                                fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fgets.symtab0x40fb40216FUNC<unknown>DEFAULT3
                                fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fgets_unlocked.symtab0x410030268FUNC<unknown>DEFAULT3
                                fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fmt.symtab0x4159a020OBJECT<unknown>DEFAULT5
                                fopen.symtab0x40f42028FUNC<unknown>DEFAULT3
                                fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fork.symtab0x40782084FUNC<unknown>DEFAULT3
                                fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fputs_unlocked.symtab0x4093b0128FUNC<unknown>DEFAULT3
                                fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                frame_dummy.symtab0x40021c0FUNC<unknown>DEFAULT3
                                free.symtab0x40abe0396FUNC<unknown>DEFAULT3
                                free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fseek.symtab0x40f44068FUNC<unknown>DEFAULT3
                                fseeko.symtab0x40f44068FUNC<unknown>DEFAULT3
                                fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fseeko64.symtab0x40f490388FUNC<unknown>DEFAULT3
                                fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                fwrite_unlocked.symtab0x409430280FUNC<unknown>DEFAULT3
                                fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                getArch.symtab0x4049b056FUNC<unknown>DEFAULT3
                                getHost.symtab0x4019c4160FUNC<unknown>DEFAULT3
                                getOurIP.symtab0x4007e4896FUNC<unknown>DEFAULT3
                                getRandomIP.symtab0x400614172FUNC<unknown>DEFAULT3
                                getSoftware.symtab0x4063e4760FUNC<unknown>DEFAULT3
                                get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                getc_unlocked.symtab0x4116f0388FUNC<unknown>DEFAULT3
                                getegid.symtab0x40c48088FUNC<unknown>DEFAULT3
                                getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                geteuid.symtab0x40c4e088FUNC<unknown>DEFAULT3
                                geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                getgid.symtab0x40c54084FUNC<unknown>DEFAULT3
                                getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                gethostbyname.symtab0x40a020116FUNC<unknown>DEFAULT3
                                gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                gethostbyname_r.symtab0x40a0a01108FUNC<unknown>DEFAULT3
                                gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                getpid.symtab0x40788084FUNC<unknown>DEFAULT3
                                getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                getsockname.symtab0x40a56084FUNC<unknown>DEFAULT3
                                getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                getsockopt.symtab0x40a5c0120FUNC<unknown>DEFAULT3
                                getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                getuid.symtab0x40c5a084FUNC<unknown>DEFAULT3
                                getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                gotIP.symtab0x4569644OBJECT<unknown>DEFAULT14
                                h.4832.symtab0x45cb7c20OBJECT<unknown>DEFAULT14
                                h_errno.symtab0x45cbe44OBJECT<unknown>DEFAULT14
                                heap_alloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                heap_free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                hlt.symtab0x4002fc0NOTYPE<unknown>DEFAULT3
                                htonl.symtab0x409eb040FUNC<unknown>DEFAULT3
                                htons.symtab0x409ed824FUNC<unknown>DEFAULT3
                                i.4127.symtab0x4560784OBJECT<unknown>DEFAULT11
                                index.symtab0x409720256FUNC<unknown>DEFAULT3
                                inet_addr.symtab0x409fd072FUNC<unknown>DEFAULT3
                                inet_aton.symtab0x40dff0280FUNC<unknown>DEFAULT3
                                inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                inet_ntoa.symtab0x409fac32FUNC<unknown>DEFAULT3
                                inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                inet_ntoa_r.symtab0x409ef0188FUNC<unknown>DEFAULT3
                                inet_ntop.symtab0x410950852FUNC<unknown>DEFAULT3
                                inet_ntop4.symtab0x41075c500FUNC<unknown>DEFAULT3
                                inet_pton.symtab0x4104a0700FUNC<unknown>DEFAULT3
                                inet_pton4.symtab0x4103b0240FUNC<unknown>DEFAULT3
                                initConnection.symtab0x4066dc592FUNC<unknown>DEFAULT3
                                init_rand.symtab0x400310300FUNC<unknown>DEFAULT3
                                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                initial_fa.symtab0x456260264OBJECT<unknown>DEFAULT11
                                initstate.symtab0x40b164208FUNC<unknown>DEFAULT3
                                initstate_r.symtab0x40b640328FUNC<unknown>DEFAULT3
                                ioctl.symtab0x4078e0104FUNC<unknown>DEFAULT3
                                ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                isatty.symtab0x409d8060FUNC<unknown>DEFAULT3
                                isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                isspace.symtab0x407c7044FUNC<unknown>DEFAULT3
                                isspace.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                kill.symtab0x40795088FUNC<unknown>DEFAULT3
                                kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                libc/string/mips/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                libc/string/mips/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                libc/sysdeps/linux/mips/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                libc/sysdeps/linux/mips/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                libc/sysdeps/linux/mips/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                listFork.symtab0x402218632FUNC<unknown>DEFAULT3
                                llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                lseek64.symtab0x411600164FUNC<unknown>DEFAULT3
                                macAddress.symtab0x4569706OBJECT<unknown>DEFAULT14
                                main.symtab0x40692c3204FUNC<unknown>DEFAULT3
                                mainCommSock.symtab0x4569604OBJECT<unknown>DEFAULT14
                                makeIPPacket.symtab0x402490296FUNC<unknown>DEFAULT3
                                makeRandomStr.symtab0x401a64268FUNC<unknown>DEFAULT3
                                malloc.symtab0x40a9f0492FUNC<unknown>DEFAULT3
                                malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                memchr.symtab0x40d880264FUNC<unknown>DEFAULT3
                                memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                memcpy.symtab0x409550308FUNC<unknown>DEFAULT3
                                memmove.symtab0x40d990816FUNC<unknown>DEFAULT3
                                memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                mempcpy.symtab0x40dcc076FUNC<unknown>DEFAULT3
                                mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                memrchr.symtab0x40dd10272FUNC<unknown>DEFAULT3
                                memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                memset.symtab0x409690144FUNC<unknown>DEFAULT3
                                mylock.symtab0x45638024OBJECT<unknown>DEFAULT11
                                mylock.symtab0x45cbf024OBJECT<unknown>DEFAULT14
                                mylock.symtab0x4564a024OBJECT<unknown>DEFAULT11
                                nanosleep.symtab0x40c60084FUNC<unknown>DEFAULT3
                                nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                next_start.1065.symtab0x45c9904OBJECT<unknown>DEFAULT14
                                ntohl.symtab0x409e7040FUNC<unknown>DEFAULT3
                                ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                ntohs.symtab0x409e9824FUNC<unknown>DEFAULT3
                                ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                numpids.symtab0x4569688OBJECT<unknown>DEFAULT14
                                object.2349.symtab0x45694424OBJECT<unknown>DEFAULT14
                                open.symtab0x4079b0124FUNC<unknown>DEFAULT3
                                open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                ourIP.symtab0x4569244OBJECT<unknown>DEFAULT13
                                p.2294.symtab0x4560500OBJECT<unknown>DEFAULT11
                                pids.symtab0x4569284OBJECT<unknown>DEFAULT13
                                poll.symtab0x40f1c084FUNC<unknown>DEFAULT3
                                poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                prefix.4045.symtab0x414c6012OBJECT<unknown>DEFAULT5
                                print.symtab0x4012bc1456FUNC<unknown>DEFAULT3
                                printchar.symtab0x400d30184FUNC<unknown>DEFAULT3
                                printi.symtab0x401024664FUNC<unknown>DEFAULT3
                                prints.symtab0x400de8572FUNC<unknown>DEFAULT3
                                processCmd.symtab0x4049e86652FUNC<unknown>DEFAULT3
                                qual_chars.4050.symtab0x414c8020OBJECT<unknown>DEFAULT5
                                raise.symtab0x4115b076FUNC<unknown>DEFAULT3
                                raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                rand.symtab0x40aff028FUNC<unknown>DEFAULT3
                                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                rand_cmwc.symtab0x40043c472FUNC<unknown>DEFAULT3
                                random.symtab0x40b010164FUNC<unknown>DEFAULT3
                                random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                random_poly_info.symtab0x41592040OBJECT<unknown>DEFAULT5
                                random_r.symtab0x40b41c176FUNC<unknown>DEFAULT3
                                random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                randtbl.symtab0x456398128OBJECT<unknown>DEFAULT11
                                rawmemchr.symtab0x410140200FUNC<unknown>DEFAULT3
                                rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                read.symtab0x407a5084FUNC<unknown>DEFAULT3
                                read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                recv.symtab0x40a64084FUNC<unknown>DEFAULT3
                                recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                recvLine.symtab0x401b70876FUNC<unknown>DEFAULT3
                                sbrk.symtab0x40c660144FUNC<unknown>DEFAULT3
                                sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                select.symtab0x407ab0120FUNC<unknown>DEFAULT3
                                select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                send.symtab0x40a6a084FUNC<unknown>DEFAULT3
                                send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                sendTCP.symtab0x4030382492FUNC<unknown>DEFAULT3
                                sendUDP.symtab0x4039f42568FUNC<unknown>DEFAULT3
                                sendto.symtab0x40a700128FUNC<unknown>DEFAULT3
                                sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                setsid.symtab0x407b3084FUNC<unknown>DEFAULT3
                                setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                setsockopt.symtab0x40a780120FUNC<unknown>DEFAULT3
                                setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                setstate.symtab0x40b0b4176FUNC<unknown>DEFAULT3
                                setstate_r.symtab0x40b2e0316FUNC<unknown>DEFAULT3
                                sigaction.symtab0x40c330232FUNC<unknown>DEFAULT3
                                sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                signal.symtab0x40a860252FUNC<unknown>DEFAULT3
                                signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                sigprocmask.symtab0x40c6f0148FUNC<unknown>DEFAULT3
                                sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                sleep.symtab0x40bb10564FUNC<unknown>DEFAULT3
                                sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                socket.symtab0x40a80084FUNC<unknown>DEFAULT3
                                socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                socket_connect.symtab0x402e7c444FUNC<unknown>DEFAULT3
                                sockprintf.symtab0x40186c344FUNC<unknown>DEFAULT3
                                spec_and_mask.4049.symtab0x414c9416OBJECT<unknown>DEFAULT5
                                spec_base.4044.symtab0x414c6c7OBJECT<unknown>DEFAULT5
                                spec_chars.4046.symtab0x414cc021OBJECT<unknown>DEFAULT5
                                spec_flags.4045.symtab0x414cd88OBJECT<unknown>DEFAULT5
                                spec_or_mask.4048.symtab0x414ca416OBJECT<unknown>DEFAULT5
                                spec_ranges.4047.symtab0x414cb49OBJECT<unknown>DEFAULT5
                                sprintf.symtab0x407d0080FUNC<unknown>DEFAULT3
                                sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                srand.symtab0x40b234172FUNC<unknown>DEFAULT3
                                srandom.symtab0x40b234172FUNC<unknown>DEFAULT3
                                srandom_r.symtab0x40b4cc372FUNC<unknown>DEFAULT3
                                static_id.symtab0x4564702OBJECT<unknown>DEFAULT11
                                static_ns.symtab0x45cc084OBJECT<unknown>DEFAULT14
                                stderr.symtab0x4561584OBJECT<unknown>DEFAULT11
                                stdin.symtab0x4561504OBJECT<unknown>DEFAULT11
                                stdout.symtab0x4561544OBJECT<unknown>DEFAULT11
                                strcasecmp.symtab0x411880108FUNC<unknown>DEFAULT3
                                strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strchr.symtab0x409720256FUNC<unknown>DEFAULT3
                                strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strcmp.symtab0x40982044FUNC<unknown>DEFAULT3
                                strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strcoll.symtab0x40982044FUNC<unknown>DEFAULT3
                                strcpy.symtab0x40985036FUNC<unknown>DEFAULT3
                                strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strdup.symtab0x410320144FUNC<unknown>DEFAULT3
                                strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strerror_r.symtab0x409b90392FUNC<unknown>DEFAULT3
                                strlen.symtab0x409880184FUNC<unknown>DEFAULT3
                                strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strncat.symtab0x410210180FUNC<unknown>DEFAULT3
                                strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strncpy.symtab0x40de20188FUNC<unknown>DEFAULT3
                                strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strnlen.symtab0x409940256FUNC<unknown>DEFAULT3
                                strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strpbrk.symtab0x40dfb064FUNC<unknown>DEFAULT3
                                strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strspn.symtab0x4102d076FUNC<unknown>DEFAULT3
                                strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strstr.symtab0x409a40256FUNC<unknown>DEFAULT3
                                strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strtok.symtab0x409d6032FUNC<unknown>DEFAULT3
                                strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strtok_r.symtab0x40dee0204FUNC<unknown>DEFAULT3
                                strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                strtol.symtab0x40b7b028FUNC<unknown>DEFAULT3
                                strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                tcgetattr.symtab0x409dc0176FUNC<unknown>DEFAULT3
                                tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                tcpcsum.symtab0x402784356FUNC<unknown>DEFAULT3
                                time.symtab0x407b9084FUNC<unknown>DEFAULT3
                                time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                tolower.symtab0x4116b060FUNC<unknown>DEFAULT3
                                tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                toupper.symtab0x407ca060FUNC<unknown>DEFAULT3
                                toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                trim.symtab0x400b64460FUNC<unknown>DEFAULT3
                                type_codes.symtab0x414ce024OBJECT<unknown>DEFAULT5
                                type_sizes.symtab0x414cf812OBJECT<unknown>DEFAULT5
                                unknown.1088.symtab0x414d9014OBJECT<unknown>DEFAULT5
                                unsafe_state.symtab0x45642028OBJECT<unknown>DEFAULT11
                                useragents.symtab0x456084108OBJECT<unknown>DEFAULT11
                                usleep.symtab0x40bd50144FUNC<unknown>DEFAULT3
                                usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                vsnprintf.symtab0x407d50260FUNC<unknown>DEFAULT3
                                vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                wait4.symtab0x40c79088FUNC<unknown>DEFAULT3
                                wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                waitpid.symtab0x407bf028FUNC<unknown>DEFAULT3
                                waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                wcrtomb.symtab0x40c810112FUNC<unknown>DEFAULT3
                                wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                wcsnrtombs.symtab0x40c8c0228FUNC<unknown>DEFAULT3
                                wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                wcsrtombs.symtab0x40c88064FUNC<unknown>DEFAULT3
                                wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                write.symtab0x407c1084FUNC<unknown>DEFAULT3
                                write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                xdigits.3043.symtab0x415a8417OBJECT<unknown>DEFAULT5

                                Download Network PCAP: filteredfull

                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                2025-02-20T21:12:50.231498+01002846407ETPRO MALWARE ELF/Mirai Variant CnC Activity1192.168.2.153865815.204.128.306140TCP
                                2025-02-20T21:12:50.236549+01002848448ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)1192.168.2.153865815.204.128.306140TCP
                                2025-02-20T21:15:54.736233+01002846407ETPRO MALWARE ELF/Mirai Variant CnC Activity1192.168.2.153866015.204.128.306140TCP
                                2025-02-20T21:15:54.741320+01002848448ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)1192.168.2.153866015.204.128.306140TCP
                                • Total Packets: 11
                                • 6140 undefined
                                • 53 (DNS)
                                TimestampSource PortDest PortSource IPDest IP
                                Feb 20, 2025 21:12:50.224529028 CET386586140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:12:50.229736090 CET61403865815.204.128.30192.168.2.15
                                Feb 20, 2025 21:12:50.229803085 CET386586140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:12:50.231498003 CET386586140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:12:50.236510038 CET61403865815.204.128.30192.168.2.15
                                Feb 20, 2025 21:12:50.236548901 CET386586140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:12:50.241584063 CET61403865815.204.128.30192.168.2.15
                                Feb 20, 2025 21:15:54.728883028 CET61403865815.204.128.30192.168.2.15
                                Feb 20, 2025 21:15:54.729825974 CET386586140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:15:54.730941057 CET386606140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:15:54.734844923 CET61403865815.204.128.30192.168.2.15
                                Feb 20, 2025 21:15:54.735975981 CET61403866015.204.128.30192.168.2.15
                                Feb 20, 2025 21:15:54.736042976 CET386606140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:15:54.736232996 CET386606140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:15:54.741234064 CET61403866015.204.128.30192.168.2.15
                                Feb 20, 2025 21:15:54.741319895 CET386606140192.168.2.1515.204.128.30
                                Feb 20, 2025 21:15:54.746376991 CET61403866015.204.128.30192.168.2.15
                                TimestampSource PortDest PortSource IPDest IP
                                Feb 20, 2025 21:15:34.296513081 CET5049253192.168.2.151.1.1.1
                                Feb 20, 2025 21:15:34.296577930 CET5360753192.168.2.151.1.1.1
                                Feb 20, 2025 21:15:34.304233074 CET53536071.1.1.1192.168.2.15
                                Feb 20, 2025 21:15:34.304631948 CET53504921.1.1.1192.168.2.15
                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                Feb 20, 2025 21:15:34.296513081 CET192.168.2.151.1.1.10xa5b0Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                Feb 20, 2025 21:15:34.296577930 CET192.168.2.151.1.1.10xa0feStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                Feb 20, 2025 21:15:34.304631948 CET1.1.1.1192.168.2.150xa5b0No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                Feb 20, 2025 21:15:34.304631948 CET1.1.1.1192.168.2.150xa5b0No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                                System Behavior

                                Start time (UTC):20:12:48
                                Start date (UTC):20/02/2025
                                Path:/tmp/felkawtf.mipsel.elf
                                Arguments:/tmp/felkawtf.mipsel.elf
                                File size:5773336 bytes
                                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                Start time (UTC):20:12:49
                                Start date (UTC):20/02/2025
                                Path:/tmp/felkawtf.mipsel.elf
                                Arguments:-
                                File size:5773336 bytes
                                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                Start time (UTC):20:12:49
                                Start date (UTC):20/02/2025
                                Path:/tmp/felkawtf.mipsel.elf
                                Arguments:-
                                File size:5773336 bytes
                                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9