Edit tour

Linux Analysis Report
felkawtf.armv4l.elf

Overview

General Information

Sample name:	felkawtf.armv4l.elf
Analysis ID:	1620315
MD5:	65e82ae08897c4aa2fabd0fbdf03e517
SHA1:	103458b043607d921cfc6ee9bc9fd3151f73e9c2
SHA256:	7691bc26f63eba56f496d5e610ab9cbbfd1b1b39f27b5571dd59a799c3334b72
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Suricata IDS alerts with low severity for network traffic

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1620315
Start date and time:	2025-02-20 21:16:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	felkawtf.armv4l.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/felkawtf.armv4l.elf
PID:	5504
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

felkawtf.armv4l.elf (PID: 5504, Parent: 5427, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/felkawtf.armv4l.elf

felkawtf.armv4l.elf New Fork (PID: 5506, Parent: 5504)

felkawtf.armv4l.elf New Fork (PID: 5508, Parent: 5506)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
felkawtf.armv4l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
felkawtf.armv4l.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf6cc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5506.1.00007efb48017000.00007efb48029000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5506.1.00007efb48017000.00007efb48029000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf6cc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5504.1.00007efb48017000.00007efb48029000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5504.1.00007efb48017000.00007efb48029000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf6cc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: felkawtf.armv4l.elf PID: 5504	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x110f4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x130dc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: felkawtf.armv4l.elf PID: 5506	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x12d27:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x14d0f:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-20T21:17:51.724191+0100	2846407	1	A Network Trojan was detected	192.168.2.13	33642	15.204.128.30	6140	TCP
2025-02-20T21:20:56.306480+0100	2846407	1	A Network Trojan was detected	192.168.2.13	33644	15.204.128.30	6140	TCP

ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-20T21:17:51.729561+0100	2848448	1	A Network Trojan was detected	192.168.2.13	33642	15.204.128.30	6140	TCP
2025-02-20T21:20:56.311618+0100	2848448	1	A Network Trojan was detected	192.168.2.13	33644	15.204.128.30	6140	TCP

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: felkawtf.armv4l.elf

Avira: detected

Found malware configuration

Source: felkawtf.armv4l.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "15.204.128.30:6140"}

Multi AV Scanner detection for submitted file

Source: felkawtf.armv4l.elf	Virustotal: Detection: 57%			Perma Link
Source: felkawtf.armv4l.elf	ReversingLabs: Detection: 63%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/felkawtf.armv4l.elf (PID: 5504)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.13:33644 -> 15.204.128.30:6140
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.13:33642 -> 15.204.128.30:6140

Source: global traffic

TCP traffic: 192.168.2.13:33642 -> 15.204.128.30:6140

Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.13:33644 -> 15.204.128.30:6140
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.13:33642 -> 15.204.128.30:6140

Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: felkawtf.armv4l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5506.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5504.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: felkawtf.armv4l.elf PID: 5504, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: felkawtf.armv4l.elf PID: 5506, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: felkawtf.armv4l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5506.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5504.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: felkawtf.armv4l.elf PID: 5504, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: felkawtf.armv4l.elf PID: 5506, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: felkawtf.armv4l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S

Source: /tmp/felkawtf.armv4l.elf (PID: 5504)

Queries kernel information via 'uname':

Jump to behavior

Source: felkawtf.armv4l.elf, 5504.1.00007ffc39e70000.00007ffc39e91000.rw-.sdmp, felkawtf.armv4l.elf, 5506.1.00007ffc39e70000.00007ffc39e91000.rw-.sdmp	Binary or memory string: bKmNB?x86_64/usr/bin/qemu-arm/tmp/felkawtf.armv4l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/felkawtf.armv4l.elf
Source: felkawtf.armv4l.elf, 5504.1.00005581f0da4000.00005581f0ed2000.rw-.sdmp, felkawtf.armv4l.elf, 5506.1.00005581f0da4000.00005581f0ed2000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: felkawtf.armv4l.elf, 5504.1.00005581f0da4000.00005581f0ed2000.rw-.sdmp, felkawtf.armv4l.elf, 5506.1.00005581f0da4000.00005581f0ed2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: felkawtf.armv4l.elf, 5504.1.00007ffc39e70000.00007ffc39e91000.rw-.sdmp, felkawtf.armv4l.elf, 5506.1.00007ffc39e70000.00007ffc39e91000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: felkawtf.armv4l.elf, type: SAMPLE
Source: Yara match	File source: 5506.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5504.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.0 Mobile/14F89 Safari/602.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 5.0.2; HTCONE Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Mobile/14F89
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity

Yara detected Gafgyt

Source: Yara match	File source: felkawtf.armv4l.elf, type: SAMPLE
Source: Yara match	File source: 5506.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5504.1.00007efb48017000.00007efb48029000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "15.204.128.30:6140"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
felkawtf.armv4l.elf	57%	Virustotal		Browse
felkawtf.armv4l.elf	63%	ReversingLabs	Linux.Backdoor.Gafgyt
felkawtf.armv4l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
15.204.128.30:6140	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
15.204.128.30	unknown	United States		71	HP-INTERNET-ASUS	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
15.204.128.30	felkawtf.powerpc-440fp.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.mipsel.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.armv6l.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.armv7l.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	felkawtf.mipsel.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	am6.nn.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	felkawtf.armv6l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	felkawtf.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.armv7l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.sparc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HP-INTERNET-ASUS	felkawtf.powerpc-440fp.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.mipsel.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.armv6l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	Orden de compra_xl.exe	Get hash	malicious	DarkCloud	Browse	15.235.119.29
	felkawtf.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	6.066952442220152
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	felkawtf.armv4l.elf
File size:	105'476 bytes
MD5:	65e82ae08897c4aa2fabd0fbdf03e517
SHA1:	103458b043607d921cfc6ee9bc9fd3151f73e9c2
SHA256:	7691bc26f63eba56f496d5e610ab9cbbfd1b1b39f27b5571dd59a799c3334b72
SHA512:	3405418e789d1362344bb636f60cd223e8460328949cec5f02935136002a4afeef66ac4dd959dd9f35310e2a0012f2077466ce5e8919de96d3f56d006db463fe
SSDEEP:	1536:Z0550bcQpUP4418vfpSTY+gA0BOLNv2xP3P/P3OjkypFmCKrQAFW9LhZaQ:dcnP43rA32xPvOnFmCKrQAFiLhZaQ
TLSH:	5CA30A01E9488B2BC1D227B7A29EC399773D15D45BD733015B38BEB427C67F91A26D20
File Content Preview:	.ELF...a..........(.........4....4......4. ...(..........................................................g..........Q.td..................................-...L."...w5..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	79100
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0xd614	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x156c4	0xd6c4	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x156d8	0xd6d8	0x3e38	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x19510	0x11510	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x21514	0x11514	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x2151c	0x1151c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x21524	0x11524	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x21528	0x11528	0x3f0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x21918	0x11918	0x63ac	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x11918	0xa90	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x123a8	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x124c8	0x578	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x12a40	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x12af4	0x8bd	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x133b4	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x13454	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1381c	0x4110	0x10	0x0		19	573	4
.strtab	STRTAB	0x0	0x1792c	0x22d8	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x11514	0x11514	6.2412	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x11514	0x21514	0x21514	0x404	0x67b0	2.9817	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x156c4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x156d8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x19510	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21514	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2151c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x21524	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x21528	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x21918	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x156c4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156d0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x15688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x156d4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x956c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa88c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb0f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd22c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd284	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd44c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd684	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd74c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd77c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xded8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeaf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xece0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf25c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1020c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1069c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1074c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1087c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1410c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1479c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1495c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1550c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15634	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21514	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x2151c	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x21530	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x156b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21534	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21538	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x997c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xa078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb0f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc584	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd3ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd4ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x215b4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x215bc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xd52c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd680	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd690	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd73c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x215c4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x184b8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xde2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe8e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe9dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf12c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21700	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21808	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfb2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21820	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xfc00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfd54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190e4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xffd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1004c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x218d4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x10208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10354	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1057c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x218ec	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1068c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x107f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27b80	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x10884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1166c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1912c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11c34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x218f4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12af4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12cc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x133cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13720	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13cac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14554	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2190c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1471c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14798	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.130.5267	.symtab	0x17c2c	12	OBJECT	<unknown>	DEFAULT	4
C.80.4835	.symtab	0x179c8	32	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0xe7a8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xe7c4	0	NOTYPE	<unknown>	DEFAULT	2
Nulled	.symtab	0x27bac	80	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x2194c	16384	OBJECT	<unknown>	DEFAULT	10
SendHTTP	.symtab	0xaf94	356	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0xb0f8	472	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x9e64	536	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x21518	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x21514	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x215b4	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x17eb8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2190c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x19210	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x215bc	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x181b8	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x21520	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x2151c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x19510	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x19510	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x215b4	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x17eb8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x2190c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x19210	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x215bc	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x181b8	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x215b8	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x21910	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x215c0	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0xd524	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x145f0	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0xeadc	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x1087c	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xd140	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0xd1b4	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0xd384	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x10258	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10308	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0xeaf0	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xd204	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0xf7dc	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0xfe28	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0xfe28	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x12afc	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xd258	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xd284	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0xf148	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x27b80	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0xffd4	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x12b64	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xd140	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0xd1b4	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x133f4	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x145f0	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x13220	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x135d8	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x12ce4	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xd2b0	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0xe5bc	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x12cf0	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x12cfc	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0xe5f0	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x145f0	304	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x106c8	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x106f4	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x10720	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0xed90	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0xedd4	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xd2dc	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0xf174	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1074c	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x27b84	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0xed6c	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x11eac	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0xed60	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0xece0	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x13cb0	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1393c	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0xfd60	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xd308	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0xebe4	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xd358	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x14558	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x11b40	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xe6b0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x11b30	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x11c3c	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x11c54	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xe6c0	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x10778	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xd384	92	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x12b38	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x12ac0	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0xf928	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0xfc04	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x13670	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xd3f0	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0xf1d0	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x107a4	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xd41c	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0xf1fc	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0xf228	52	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xd44c	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0xf25c	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0xfb44	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x105b0	228	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0xf2b8	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x107fc	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10068	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0xf28c	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xd530	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0xfc94	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x14720	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0xe7e0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xe760	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xe760	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0xe8e8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x13840	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xe780	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x13728	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x11d40	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0xe904	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x11e6c	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x137f0	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xe9e4	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0xebd8	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x11df8	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0xfe34	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0xec04	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xd478	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x145bc	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xd4f0	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xd564	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x10850	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xd4a4	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x10888	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x108f8	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x108d8	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xd4ac	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x21524	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x21524	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x14bec	736	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmpeq	.symtab	0x155bc	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmple	.symtab	0x155bc	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdrcmple	.symtab	0x155a0	48	FUNC	<unknown>	DEFAULT	2
__aeabi_d2uiz	.symtab	0x15634	84	FUNC	<unknown>	DEFAULT	2
__aeabi_dadd	.symtab	0x14bec	736	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpeq	.symtab	0x155d0	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpge	.symtab	0x1560c	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpgt	.symtab	0x15620	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmple	.symtab	0x155f8	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmplt	.symtab	0x155e4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_ddiv	.symtab	0x15308	516	FUNC	<unknown>	DEFAULT	2
__aeabi_dmul	.symtab	0x14fe0	808	FUNC	<unknown>	DEFAULT	2
__aeabi_drsub	.symtab	0x14be0	0	FUNC	<unknown>	DEFAULT	2
__aeabi_dsub	.symtab	0x14be8	740	FUNC	<unknown>	DEFAULT	2
__aeabi_f2d	.symtab	0x14f20	64	FUNC	<unknown>	DEFAULT	2
__aeabi_i2d	.symtab	0x14ef4	44	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv	.symtab	0x14aa0	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0xd0ec	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x14bc8	24	FUNC	<unknown>	DEFAULT	2
__aeabi_l2d	.symtab	0x14f74	108	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0xd0ec	4	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x14ecc	40	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0xce2c	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0xcf24	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ul2d	.symtab	0x14f60	128	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x27b74	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x218d4	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0xf2b8	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x27cc4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x21918	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x21918	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x102d0	56	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1551c	132	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x215b8	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x21910	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x215c0	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x27ba4	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x21528	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x14120	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x14844	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x13ff8	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x10698	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x10694	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xd0ec	4	FUNC	<unknown>	DEFAULT	2
__divdf3	.symtab	0x15308	516	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x14aa0	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x11f98	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x15688	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x2152c	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x1479c	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x13f10	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x140b0	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x27cc4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x27b6c	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x1551c	132	FUNC	<unknown>	DEFAULT	2
__errno_location	.symtab	0xd524	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x27b64	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x14f20	64	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x145f0	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x21514	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x21514	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fixunsdfsi	.symtab	0x15634	84	FUNC	<unknown>	DEFAULT	2
__floatdidf	.symtab	0x14f74	108	FUNC	<unknown>	DEFAULT	2
__floatsidf	.symtab	0x14ef4	44	FUNC	<unknown>	DEFAULT	2
__floatundidf	.symtab	0x14f60	128	FUNC	<unknown>	DEFAULT	2
__floatunsidf	.symtab	0x14ecc	40	FUNC	<unknown>	DEFAULT	2
__gedf2	.symtab	0x1550c	148	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x12a78	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0xeadc	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x1550c	148	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x1087c	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0xf620	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0xf6e8	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0xf6b4	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0xf6d4	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x21514	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x21514	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__ledf2	.symtab	0x15514	140	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x14910	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x1410c	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xd284	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0xf148	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0xd3e0	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xd140	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0xd1b4	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xd2b0	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0xd2dc	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x14558	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x10778	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xd384	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x12b38	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xd3f0	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0xf1d0	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xd41c	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0xf1fc	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0xf228	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x105b0	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x27b68	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0xd4a4	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xd4ac	44	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x15514	140	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x21700	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x27b48	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x27c80	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0xd008	228	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x14fe0	808	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0xd0f0	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x27ca8	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x27cb4	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x1551c	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x141fc	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x127a4	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x27b70	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x21514	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x21514	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x102c4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x102c4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x102c4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x102c4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x102c4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x102cc	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x12ac0	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x14230	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x218f4	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x27b78	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x27c98	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x27cb8	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0xf394	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0xf3b8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0xf370	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x215d0	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x1495c	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x109b4	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x12e2c	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x10a70	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0xd684	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x184b8	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x149b8	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x131f0	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x149e4	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x10ba8	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xd74c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x215d4	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x14be8	740	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1069c	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x10258	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10308	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x10364	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x218ec	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0xce2c	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0xcf3c	204	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0xeaf0	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x27cc4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xd77c	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x12ad8	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x27cbc	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x27cc0	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x21918	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x27cc4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x27b80	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0xd204	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x156c4	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x25954	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xd7c8	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x10ea0	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x27b84	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x10cac	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x116a0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xde40	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0xe0f8	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xded8	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xdf10	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xe0ac	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x102cc	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x102cc	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x27c00	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x12ef8	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xd614	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x215d8	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x215dc	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x132b4	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x25950	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x215f4	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x2594c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x21610	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0xd694	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2160c	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0xfe3c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x10d1c	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x18588	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x10d50	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xd84c	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0xf7dc	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xd22c	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0xfe28	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0xfe28	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0xe6a0	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x27b60	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x27b7c	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x12afc	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0xf2b8	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x27958	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x27968	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x215ac	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x156bc	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
cck	.symtab	0x9d00	356	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0xd258	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xd284	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x21538	4	OBJECT	<unknown>	DEFAULT	9
completed.2555	.symtab	0x21918	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0xf148	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x956c	640	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0xd3e0	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9a98	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x215a8	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x21534	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x27b6c	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x27b80	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0xffd4	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1912c	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x12b64	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xd140	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0xd1b4	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8438	208	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x133f4	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x145f0	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x13220	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x135d8	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x19118	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x12ce4	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x21528	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x21914	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0xd2b0	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0xe5bc	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0xf530	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x12cf0	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x12cf0	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x12cfc	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0xe5f0	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0xb2d0	28	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x91ac	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8508	740	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x83d8	96	FUNC	<unknown>	DEFAULT	2
getSoftware	.symtab	0xc250	436	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x145f0	304	FUNC	<unknown>	DEFAULT	2
getegid	.symtab	0x106c8	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x106f4	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x10720	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0xed90	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0xedd4	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xd2dc	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0xf174	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0xf1a0	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1074c	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x21938	4	OBJECT	<unknown>	DEFAULT	10
h.4900	.symtab	0x27b34	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x27b84	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0xeca8	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0xeccc	20	FUNC	<unknown>	DEFAULT	2
i.4127	.symtab	0x215b0	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0xe7e0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0xed6c	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x11eac	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0xed60	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0xece0	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x13cb0	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x13b4c	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x1393c	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x13870	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xc404	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x21704	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0xfa30	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0xfd60	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0xd308	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0xebe4	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xd4d8	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xd358	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x97ec	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x14558	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x21944	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xc590	2204	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x21934	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x9984	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x9210	136	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0xf3dc	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x11b40	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0xe6b0	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x11b30	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x11c3c	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x11c54	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0xe6c0	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x21808	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x21820	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x27b88	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x10778	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x27954	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0xec70	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0xec94	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x2193c	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x2191c	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0xd384	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x27ba8	4	OBJECT	<unknown>	DEFAULT	10
p.2553	.symtab	0x21530	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x27bfc	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x12b38	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x184e0	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8cf4	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x891c	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8b0c	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8988	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xb2ec	3940	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x184f4	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x12ac0	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0xf924	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0xf928	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x190e4	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0xfc04	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x21854	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x13670	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0xd3f0	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0xf1d0	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x9298	724	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x107a4	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0xd41c	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0xf1fc	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendTCP	.symtab	0xa1c8	1732	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0xa88c	1800	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0xf228	52	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0xd44c	44	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0xf25c	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0xf9a4	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0xfb44	192	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x105b0	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0xf2b8	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x107fc	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x10068	420	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0xf28c	44	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0xa07c	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x90e4	200	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4146	.symtab	0x18508	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4140	.symtab	0x184ec	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4143	.symtab	0x18534	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4142	.symtab	0x1854c	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4145	.symtab	0x18518	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4144	.symtab	0x18528	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0xd530	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0xfac8	124	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0xfac8	124	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0xfc94	204	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x218f0	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x27ba0	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x215cc	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x215c4	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x215c8	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x14720	124	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0xe7e0	264	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0xe760	28	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0xe760	28	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0xe8e8	28	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x13840	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0xeaf0	232	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0xe780	96	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x13728	200	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x11d40	184	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0xe904	224	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x11e6c	64	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x137f0	80	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0xe9e4	248	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0xebd8	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x11df8	116	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0xfe34	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0xec04	108	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x9bf0	272	FUNC	<unknown>	DEFAULT	2
time	.symtab	0xd478	44	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x145bc	52	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0xd4f0	52	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x87ec	304	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x18554	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x1856c	12	OBJECT	<unknown>	DEFAULT	4
unknown.1088	.symtab	0x18578	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x21838	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x2153c	108	OBJECT	<unknown>	DEFAULT	9

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-20T21:17:51.724191+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.13	33642	15.204.128.30	6140	TCP
2025-02-20T21:17:51.729561+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.13	33642	15.204.128.30	6140	TCP
2025-02-20T21:20:56.306480+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.13	33644	15.204.128.30	6140	TCP
2025-02-20T21:20:56.311618+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.13	33644	15.204.128.30	6140	TCP

Network Port Distribution

Total Packets: 11
• 6140 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2025 21:17:51.694761992 CET	33642	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:17:51.700783968 CET	6140	33642	15.204.128.30	192.168.2.13
Feb 20, 2025 21:17:51.700851917 CET	33642	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:17:51.724190950 CET	33642	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:17:51.729485989 CET	6140	33642	15.204.128.30	192.168.2.13
Feb 20, 2025 21:17:51.729561090 CET	33642	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:17:51.734631062 CET	6140	33642	15.204.128.30	192.168.2.13
Feb 20, 2025 21:20:56.298472881 CET	6140	33642	15.204.128.30	192.168.2.13
Feb 20, 2025 21:20:56.299597979 CET	33642	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:20:56.301054001 CET	33644	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:20:56.304697990 CET	6140	33642	15.204.128.30	192.168.2.13
Feb 20, 2025 21:20:56.306185007 CET	6140	33644	15.204.128.30	192.168.2.13
Feb 20, 2025 21:20:56.306266069 CET	33644	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:20:56.306479931 CET	33644	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:20:56.311542034 CET	6140	33644	15.204.128.30	192.168.2.13
Feb 20, 2025 21:20:56.311618090 CET	33644	6140	192.168.2.13	15.204.128.30
Feb 20, 2025 21:20:56.316709042 CET	6140	33644	15.204.128.30	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2025 21:20:35.280256987 CET	53135	53	192.168.2.13	1.1.1.1
Feb 20, 2025 21:20:35.280325890 CET	44761	53	192.168.2.13	1.1.1.1
Feb 20, 2025 21:20:35.288383007 CET	53	44761	1.1.1.1	192.168.2.13
Feb 20, 2025 21:20:35.288434029 CET	53	53135	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 20, 2025 21:20:35.280256987 CET	192.168.2.13	1.1.1.1	0xea7d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Feb 20, 2025 21:20:35.280325890 CET	192.168.2.13	1.1.1.1	0xd56f	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 20, 2025 21:20:35.288434029 CET	1.1.1.1	192.168.2.13	0xea7d	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Feb 20, 2025 21:20:35.288434029 CET	1.1.1.1	192.168.2.13	0xea7d	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: felkawtf.armv4l.elf PID: 5504, Parent PID: 5427

General

Start time (UTC):	20:17:50
Start date (UTC):	20/02/2025
Path:	/tmp/felkawtf.armv4l.elf
Arguments:	/tmp/felkawtf.armv4l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: felkawtf.armv4l.elf PID: 5506, Parent PID: 5504

General

Start time (UTC):	20:17:51
Start date (UTC):	20/02/2025
Path:	/tmp/felkawtf.armv4l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: felkawtf.armv4l.elf PID: 5508, Parent PID: 5506

General

Start time (UTC):	20:17:51
Start date (UTC):	20/02/2025
Path:	/tmp/felkawtf.armv4l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report felkawtf.armv4l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: felkawtf.armv4l.elf PID: 5504, Parent PID: 5427

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: felkawtf.armv4l.elf PID: 5506, Parent PID: 5504

General

Linux Analysis Report
felkawtf.armv4l.elf