Edit tour

Linux Analysis Report
141.11.212.101-mips-2025-03-03T07_22_22.elf

Overview

General Information

Sample name:141.11.212.101-mips-2025-03-03T07_22_22.elf
Analysis ID:1639919
MD5:60921b7616b34905ec5138cb8775a6b0
SHA1:659b1b26e3e04817459a808c55df48fce87c118a
SHA256:1f47c070b2a00df5128848fde60579bc94aacbc78e5a122e131b4a9f6744085f
Tags:elfuser-threatquery
Infos:

Detection

Gafgyt, Mirai
Score:88
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Yara detected Mirai
Contains symbols with names commonly found in malware
Opens /proc/net/* files useful for finding connected devices and routers
Detected TCP or UDP traffic on non-standard ports
Sample contains strings that are user agent strings indicative of HTTP manipulation
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1639919
Start date and time:2025-03-16 16:13:14 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 58s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:141.11.212.101-mips-2025-03-03T07_22_22.elf
Detection:MAL
Classification:mal88.spre.troj.linELF@0/1@2/0
Command:/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
PID:5428
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate alot
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
141.11.212.101-mips-2025-03-03T07_22_22.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    141.11.212.101-mips-2025-03-03T07_22_22.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      141.11.212.101-mips-2025-03-03T07_22_22.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19ce8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19d10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      SourceRuleDescriptionAuthorStrings
      5431.1.00007f9af8400000.00007f9af841e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5431.1.00007f9af8400000.00007f9af841e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19ce8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19d10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        5428.1.00007f9af8400000.00007f9af841e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5428.1.00007f9af8400000.00007f9af841e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19ce8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19d10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          5430.1.00007f9af8400000.00007f9af841e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
            Click to see the 7 entries
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfAvira: detected
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfVirustotal: Detection: 65%Perma Link
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfReversingLabs: Detection: 61%

            Spreading

            barindex
            Source: /tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf (PID: 5428)Opens: /proc/net/routeJump to behavior
            Source: global trafficTCP traffic: 192.168.2.13:60206 -> 141.11.212.101:820
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

            System Summary

            barindex
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5431.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5428.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5430.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5430, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5431, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: ELF static info symbol of initial sampleName: vseattack
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5431.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5428.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5430.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5430, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5431, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: classification engineClassification label: mal88.spre.troj.linELF@0/1@2/0
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfELF static info symbol of initial sample: libc/string/mips/memcpy.S
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfELF static info symbol of initial sample: libc/string/mips/memset.S
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/pipe.S
            Source: /tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf (PID: 5428)Queries kernel information via 'uname': Jump to behavior
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5428.1.00007fff02d05000.00007fff02d26000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5430.1.00007fff02d05000.00007fff02d26000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5431.1.00007fff02d05000.00007fff02d26000.rw-.sdmpBinary or memory string: Cwx86_64/usr/bin/qemu-mips/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5428.1.000055b6c03b6000.000055b6c043d000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5430.1.000055b6c03b6000.000055b6c043d000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5431.1.000055b6c03b6000.000055b6c043d000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mips
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5428.1.00007fff02d05000.00007fff02d26000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.MjK0TE\
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5428.1.000055b6c03b6000.000055b6c043d000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5430.1.000055b6c03b6000.000055b6c043d000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5431.1.000055b6c03b6000.000055b6c043d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5428.1.00007fff02d05000.00007fff02d26000.rw-.sdmpBinary or memory string: /tmp/qemu-open.MjK0TE
            Source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5428.1.00007fff02d05000.00007fff02d26000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5430.1.00007fff02d05000.00007fff02d26000.rw-.sdmp, 141.11.212.101-mips-2025-03-03T07_22_22.elf, 5431.1.00007fff02d05000.00007fff02d26000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, type: SAMPLE
            Source: Yara matchFile source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, type: SAMPLE
            Source: Yara matchFile source: 5431.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5428.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5430.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5428, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5430, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5431, type: MEMORYSTR
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
            Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, type: SAMPLE
            Source: Yara matchFile source: 141.11.212.101-mips-2025-03-03T07_22_22.elf, type: SAMPLE
            Source: Yara matchFile source: 5431.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5428.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5430.1.00007f9af8400000.00007f9af841e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5428, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5430, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mips-2025-03-03T07_22_22.elf PID: 5431, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local System1
            Data Obfuscation
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
            Remote System Discovery
            Remote Desktop ProtocolData from Removable Media1
            Non-Standard Port
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
            Application Layer Protocol
            Traffic DuplicationData Destruction
            No configs have been found
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1639919 Sample: 141.11.212.101-mips-2025-03... Startdate: 16/03/2025 Architecture: LINUX Score: 88 17 141.11.212.101, 60206, 60208, 60210 FranceTelecom-OrangeFR United Kingdom 2->17 19 daisy.ubuntu.com 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 3 other signatures 2->27 8 141.11.212.101-mips-2025-03-03T07_22_22.elf 2->8         started        signatures3 process4 signatures5 29 Opens /proc/net/* files useful for finding connected devices and routers 8->29 11 141.11.212.101-mips-2025-03-03T07_22_22.elf 8->11         started        13 141.11.212.101-mips-2025-03-03T07_22_22.elf 8->13         started        process6 process7 15 141.11.212.101-mips-2025-03-03T07_22_22.elf 11->15         started       
            SourceDetectionScannerLabelLink
            141.11.212.101-mips-2025-03-03T07_22_22.elf66%VirustotalBrowse
            141.11.212.101-mips-2025-03-03T07_22_22.elf61%ReversingLabsLinux.Trojan.LnxGafgyt
            141.11.212.101-mips-2025-03-03T07_22_22.elf100%AviraLINUX/Mirai.Gafgyt.
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches

            Download Network PCAP: filteredfull

            NameIPActiveMaliciousAntivirus DetectionReputation
            daisy.ubuntu.com
            162.213.35.24
            truefalse
              high
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              141.11.212.101
              unknownUnited Kingdom
              3215FranceTelecom-OrangeFRtrue
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              141.11.212.101141.11.212.101-sparc-2025-03-03T07_22_24.elfGet hashmaliciousGafgyt, MiraiBrowse
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                daisy.ubuntu.comEdiAf.ppc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                EdiAf.arm5.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                EdiAf.mpsl.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                EdiAf.arm6.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                .i.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                .i.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                yakuza.ppc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                sora.mpsl.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                sora.sh4.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                sora.arm7.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                FranceTelecom-OrangeFRNyx4r.arm.elfGet hashmaliciousOkiruBrowse
                • 90.34.68.220
                sora.ppc.elfGet hashmaliciousMiraiBrowse
                • 92.156.220.251
                sora.mpsl.elfGet hashmaliciousMiraiBrowse
                • 90.4.153.119
                sora.sh4.elfGet hashmaliciousMiraiBrowse
                • 92.170.221.65
                sora.m68k.elfGet hashmaliciousMiraiBrowse
                • 83.118.43.145
                hgfs.arm5.elfGet hashmaliciousUnknownBrowse
                • 90.107.43.114
                hgfs.arm.elfGet hashmaliciousUnknownBrowse
                • 86.253.246.234
                hgfs.mpsl.elfGet hashmaliciousUnknownBrowse
                • 83.195.219.129
                hgfs.arm.elfGet hashmaliciousUnknownBrowse
                • 90.111.104.240
                hgfs.x86.elfGet hashmaliciousUnknownBrowse
                • 81.255.36.91
                No context
                No context
                Process:/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
                File Type:ASCII text
                Category:dropped
                Size (bytes):230
                Entropy (8bit):3.709552666863289
                Encrypted:false
                SSDEEP:6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
                MD5:2E667F43AE18CD1FE3C108641708A82C
                SHA1:12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
                SHA-256:6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
                SHA-512:D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
                Malicious:false
                Reputation:high, very likely benign file
                Preview:Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.
                File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
                Entropy (8bit):5.320734775906037
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:141.11.212.101-mips-2025-03-03T07_22_22.elf
                File size:155'428 bytes
                MD5:60921b7616b34905ec5138cb8775a6b0
                SHA1:659b1b26e3e04817459a808c55df48fce87c118a
                SHA256:1f47c070b2a00df5128848fde60579bc94aacbc78e5a122e131b4a9f6744085f
                SHA512:0d8527d807e17f8d2dbfdd23f836f28300defcfbc606bf09f32bda8912b6c1378f13c70322b90a006e26c7f3b336b9ae102ee2ff8734be314ac71af297743560
                SSDEEP:3072:JW6dm9tS1aRGQdK76t/zCLI5mrThPaLEnvPrNb:c6IG+LCcmrThPaLEnvPrNb
                TLSH:91E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54
                File Content Preview:.ELF.....................@.....4.........4. ...(....p........@...@...........................@...@...........................E...E.....P..o.........dt.Q.................................................FUP<...'.T....!'.......................<...'.T`...!...

                ELF header

                Class:ELF32
                Data:2's complement, big endian
                Version:1 (current)
                Machine:MIPS R3000
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x4002a0
                Flags:0x1007
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:4
                Section Header Offset:133124
                Section Header Size:40
                Number of Section Headers:21
                Header String Table Index:18
                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .reginfoMIPS_REGINFO0x4000b40xb40x180x180x2A004
                .initPROGBITS0x4000cc0xcc0x8c0x00x6AX004
                .textPROGBITS0x4001600x1600x188b00x00x6AX0016
                .finiPROGBITS0x418a100x18a100x5c0x00x6AX004
                .rodataPROGBITS0x418a700x18a700x45a00x00x2A0016
                .eh_framePROGBITS0x41d0100x1d0100x40x00x2A004
                .ctorsPROGBITS0x45d0140x1d0140x80x00x3WA004
                .dtorsPROGBITS0x45d01c0x1d01c0x80x00x3WA004
                .jcrPROGBITS0x45d0240x1d0240x40x00x3WA004
                .data.rel.roPROGBITS0x45d0280x1d0280x4c0x00x3WA004
                .dataPROGBITS0x45d0800x1d0800x4e00x00x3WA0016
                .gotPROGBITS0x45d5600x1d5600x5040x40x10000003WAp0016
                .sbssNOBITS0x45da640x1da640x240x00x10000003WAp004
                .bssNOBITS0x45da900x1da640x648c0x00x3WA0016
                .commentPROGBITS0x00x1da640xbe20x00x0001
                .mdebug.abi32PROGBITS0xbe20x1e6460x00x00x0001
                .pdrPROGBITS0x00x1e6480x21200x00x0004
                .shstrtabSTRTAB0x00x207680x9a0x00x0001
                .symtabSYMTAB0x00x20b4c0x30300x100x0203214
                .strtabSTRTAB0x00x23b7c0x23a80x00x0001
                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                <unknown>0xb40x4000b40x4000b40x180x180.98340x4R 0x4.reginfo
                LOAD0x00x4000000x4000000x1d0140x1d0145.31290x5R E0x10000.reginfo .init .text .fini .rodata .eh_frame
                LOAD0x1d0140x45d0140x45d0140xa500x6f084.14290x6RW 0x10000.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                .symtab0x4000b40SECTION<unknown>DEFAULT1
                .symtab0x4000cc0SECTION<unknown>DEFAULT2
                .symtab0x4001600SECTION<unknown>DEFAULT3
                .symtab0x418a100SECTION<unknown>DEFAULT4
                .symtab0x418a700SECTION<unknown>DEFAULT5
                .symtab0x41d0100SECTION<unknown>DEFAULT6
                .symtab0x45d0140SECTION<unknown>DEFAULT7
                .symtab0x45d01c0SECTION<unknown>DEFAULT8
                .symtab0x45d0240SECTION<unknown>DEFAULT9
                .symtab0x45d0280SECTION<unknown>DEFAULT10
                .symtab0x45d0800SECTION<unknown>DEFAULT11
                .symtab0x45d5600SECTION<unknown>DEFAULT12
                .symtab0x45da640SECTION<unknown>DEFAULT13
                .symtab0x45da900SECTION<unknown>DEFAULT14
                .symtab0x00SECTION<unknown>DEFAULT15
                .symtab0xbe20SECTION<unknown>DEFAULT16
                .symtab0x00SECTION<unknown>DEFAULT17
                .symtab0x00SECTION<unknown>DEFAULT18
                .symtab0x00SECTION<unknown>DEFAULT19
                .symtab0x00SECTION<unknown>DEFAULT20
                C.151.5648.symtab0x45d02840OBJECT<unknown>DEFAULT10
                C.182.5940.symtab0x45d06416OBJECT<unknown>DEFAULT10
                C.183.5941.symtab0x45d05020OBJECT<unknown>DEFAULT10
                KHcommSOCK.symtab0x45dab04OBJECT<unknown>DEFAULT14
                KHserverHACKER.symtab0x45d0c44OBJECT<unknown>DEFAULT11
                LOCAL_ADDR.symtab0x45da644OBJECT<unknown>DEFAULT13
                Q.symtab0x45dacc16384OBJECT<unknown>DEFAULT14
                UserAgents.symtab0x45d0e0144OBJECT<unknown>DEFAULT11
                _GLOBAL_OFFSET_TABLE_.symtab0x45d5600OBJECT<unknown>DEFAULT12
                _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __CTOR_END__.symtab0x45d0180OBJECT<unknown>DEFAULT7
                __CTOR_LIST__.symtab0x45d0140OBJECT<unknown>DEFAULT7
                __C_ctype_b.symtab0x45d1804OBJECT<unknown>DEFAULT11
                __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_b_data.symtab0x41b870768OBJECT<unknown>DEFAULT5
                __C_ctype_tolower.symtab0x45d5504OBJECT<unknown>DEFAULT11
                __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_tolower_data.symtab0x41cd10768OBJECT<unknown>DEFAULT5
                __C_ctype_toupper.symtab0x45d1904OBJECT<unknown>DEFAULT11
                __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_toupper_data.symtab0x41bb70768OBJECT<unknown>DEFAULT5
                __DTOR_END__.symtab0x45d0200OBJECT<unknown>DEFAULT8
                __DTOR_LIST__.symtab0x45d01c0OBJECT<unknown>DEFAULT8
                __EH_FRAME_BEGIN__.symtab0x41d0100OBJECT<unknown>DEFAULT6
                __FRAME_END__.symtab0x41d0100OBJECT<unknown>DEFAULT6
                __GI___C_ctype_b.symtab0x45d1804OBJECT<unknown>HIDDEN11
                __GI___C_ctype_b_data.symtab0x41b870768OBJECT<unknown>HIDDEN5
                __GI___C_ctype_tolower.symtab0x45d5504OBJECT<unknown>HIDDEN11
                __GI___C_ctype_tolower_data.symtab0x41cd10768OBJECT<unknown>HIDDEN5
                __GI___C_ctype_toupper.symtab0x45d1904OBJECT<unknown>HIDDEN11
                __GI___C_ctype_toupper_data.symtab0x41bb70768OBJECT<unknown>HIDDEN5
                __GI___ctype_b.symtab0x45d1844OBJECT<unknown>HIDDEN11
                __GI___ctype_tolower.symtab0x45d5544OBJECT<unknown>HIDDEN11
                __GI___ctype_toupper.symtab0x45d1944OBJECT<unknown>HIDDEN11
                __GI___errno_location.symtab0x40e45024FUNC<unknown>HIDDEN3
                __GI___fgetc_unlocked.symtab0x4182f0388FUNC<unknown>HIDDEN3
                __GI___glibc_strerror_r.symtab0x4103e068FUNC<unknown>HIDDEN3
                __GI___h_errno_location.symtab0x4134c024FUNC<unknown>HIDDEN3
                __GI___libc_fcntl.symtab0x40db00136FUNC<unknown>HIDDEN3
                __GI___libc_fcntl64.symtab0x40db90104FUNC<unknown>HIDDEN3
                __GI___libc_open.symtab0x40e070124FUNC<unknown>HIDDEN3
                __GI___uClibc_fini.symtab0x412aa0196FUNC<unknown>HIDDEN3
                __GI___uClibc_init.symtab0x412bfc140FUNC<unknown>HIDDEN3
                __GI___xpg_strerror_r.symtab0x410430392FUNC<unknown>HIDDEN3
                __GI__exit.symtab0x40dc0080FUNC<unknown>HIDDEN3
                __GI_abort.symtab0x415b60428FUNC<unknown>HIDDEN3
                __GI_atoi.symtab0x41238028FUNC<unknown>HIDDEN3
                __GI_atol.symtab0x41238028FUNC<unknown>HIDDEN3
                __GI_brk.symtab0x415d40112FUNC<unknown>HIDDEN3
                __GI_close.symtab0x40dcb084FUNC<unknown>HIDDEN3
                __GI_connect.symtab0x410c6084FUNC<unknown>HIDDEN3
                __GI_dup2.symtab0x40dd1084FUNC<unknown>HIDDEN3
                __GI_errno.symtab0x463d304OBJECT<unknown>HIDDEN14
                __GI_execl.symtab0x412700204FUNC<unknown>HIDDEN3
                __GI_execve.symtab0x41319084FUNC<unknown>HIDDEN3
                __GI_exit.symtab0x412610236FUNC<unknown>HIDDEN3
                __GI_fclose.symtab0x415e10512FUNC<unknown>HIDDEN3
                __GI_fcntl.symtab0x40db00136FUNC<unknown>HIDDEN3
                __GI_fcntl64.symtab0x40db90104FUNC<unknown>HIDDEN3
                __GI_fflush_unlocked.symtab0x4169b0628FUNC<unknown>HIDDEN3
                __GI_fgetc_unlocked.symtab0x4182f0388FUNC<unknown>HIDDEN3
                __GI_fgets.symtab0x416740216FUNC<unknown>HIDDEN3
                __GI_fgets_unlocked.symtab0x416c30268FUNC<unknown>HIDDEN3
                __GI_fopen.symtab0x41601028FUNC<unknown>HIDDEN3
                __GI_fork.symtab0x40dd7084FUNC<unknown>HIDDEN3
                __GI_fputs_unlocked.symtab0x40fb90128FUNC<unknown>HIDDEN3
                __GI_fseek.symtab0x41603068FUNC<unknown>HIDDEN3
                __GI_fseeko64.symtab0x416080388FUNC<unknown>HIDDEN3
                __GI_fwrite_unlocked.symtab0x40fc10280FUNC<unknown>HIDDEN3
                __GI_getc_unlocked.symtab0x4182f0388FUNC<unknown>HIDDEN3
                __GI_getdtablesize.symtab0x40ddd072FUNC<unknown>HIDDEN3
                __GI_getegid.symtab0x4131f088FUNC<unknown>HIDDEN3
                __GI_geteuid.symtab0x40de2088FUNC<unknown>HIDDEN3
                __GI_getgid.symtab0x41325084FUNC<unknown>HIDDEN3
                __GI_gethostbyname.symtab0x410780116FUNC<unknown>HIDDEN3
                __GI_gethostbyname_r.symtab0x4108001108FUNC<unknown>HIDDEN3
                __GI_getpid.symtab0x40de8084FUNC<unknown>HIDDEN3
                __GI_getrlimit.symtab0x40df4084FUNC<unknown>HIDDEN3
                __GI_getsockname.symtab0x410cc084FUNC<unknown>HIDDEN3
                __GI_getuid.symtab0x4132b084FUNC<unknown>HIDDEN3
                __GI_h_errno.symtab0x463d344OBJECT<unknown>HIDDEN14
                __GI_inet_addr.symtab0x41073072FUNC<unknown>HIDDEN3
                __GI_inet_aton.symtab0x414c00244FUNC<unknown>HIDDEN3
                __GI_inet_ntop.symtab0x417550852FUNC<unknown>HIDDEN3
                __GI_inet_pton.symtab0x4170a0700FUNC<unknown>HIDDEN3
                __GI_initstate_r.symtab0x412230328FUNC<unknown>HIDDEN3
                __GI_ioctl.symtab0x40dfa0104FUNC<unknown>HIDDEN3
                __GI_isatty.symtab0x41062060FUNC<unknown>HIDDEN3
                __GI_kill.symtab0x40e01088FUNC<unknown>HIDDEN3
                __GI_lseek64.symtab0x418200168FUNC<unknown>HIDDEN3
                __GI_memchr.symtab0x414550264FUNC<unknown>HIDDEN3
                __GI_memcpy.symtab0x40fd30308FUNC<unknown>HIDDEN3
                __GI_memmove.symtab0x414660816FUNC<unknown>HIDDEN3
                __GI_mempcpy.symtab0x41499076FUNC<unknown>HIDDEN3
                __GI_memrchr.symtab0x4149e0272FUNC<unknown>HIDDEN3
                __GI_memset.symtab0x40fe70144FUNC<unknown>HIDDEN3
                __GI_nanosleep.symtab0x41331084FUNC<unknown>HIDDEN3
                __GI_open.symtab0x40e070124FUNC<unknown>HIDDEN3
                __GI_pipe.symtab0x40dac064FUNC<unknown>HIDDEN3
                __GI_poll.symtab0x415db084FUNC<unknown>HIDDEN3
                __GI_raise.symtab0x4181b076FUNC<unknown>HIDDEN3
                __GI_random.symtab0x411c00164FUNC<unknown>HIDDEN3
                __GI_random_r.symtab0x41200c176FUNC<unknown>HIDDEN3
                __GI_rawmemchr.symtab0x416d40200FUNC<unknown>HIDDEN3
                __GI_read.symtab0x40e19084FUNC<unknown>HIDDEN3
                __GI_recv.symtab0x410da084FUNC<unknown>HIDDEN3
                __GI_recvfrom.symtab0x410e00128FUNC<unknown>HIDDEN3
                __GI_sbrk.symtab0x413370144FUNC<unknown>HIDDEN3
                __GI_select.symtab0x40e1f0120FUNC<unknown>HIDDEN3
                __GI_send.symtab0x410e8084FUNC<unknown>HIDDEN3
                __GI_sendto.symtab0x410ee0128FUNC<unknown>HIDDEN3
                __GI_setsockopt.symtab0x410f60120FUNC<unknown>HIDDEN3
                __GI_setstate_r.symtab0x411ed0316FUNC<unknown>HIDDEN3
                __GI_sigaction.symtab0x413040232FUNC<unknown>HIDDEN3
                __GI_sigaddset.symtab0x411040104FUNC<unknown>HIDDEN3
                __GI_sigemptyset.symtab0x4110b060FUNC<unknown>HIDDEN3
                __GI_signal.symtab0x4110f0252FUNC<unknown>HIDDEN3
                __GI_sigprocmask.symtab0x40e270148FUNC<unknown>HIDDEN3
                __GI_sleep.symtab0x4127d0564FUNC<unknown>HIDDEN3
                __GI_socket.symtab0x410fe084FUNC<unknown>HIDDEN3
                __GI_sprintf.symtab0x40e4e080FUNC<unknown>HIDDEN3
                __GI_srandom_r.symtab0x4120bc372FUNC<unknown>HIDDEN3
                __GI_strcasecmp.symtab0x418480108FUNC<unknown>HIDDEN3
                __GI_strchr.symtab0x40ff00256FUNC<unknown>HIDDEN3
                __GI_strcmp.symtab0x41000044FUNC<unknown>HIDDEN3
                __GI_strcoll.symtab0x41000044FUNC<unknown>HIDDEN3
                __GI_strcpy.symtab0x41003036FUNC<unknown>HIDDEN3
                __GI_strdup.symtab0x416f20144FUNC<unknown>HIDDEN3
                __GI_strlen.symtab0x410060184FUNC<unknown>HIDDEN3
                __GI_strncat.symtab0x416e10180FUNC<unknown>HIDDEN3
                __GI_strncpy.symtab0x410120188FUNC<unknown>HIDDEN3
                __GI_strnlen.symtab0x4101e0256FUNC<unknown>HIDDEN3
                __GI_strpbrk.symtab0x414bc064FUNC<unknown>HIDDEN3
                __GI_strspn.symtab0x416ed076FUNC<unknown>HIDDEN3
                __GI_strstr.symtab0x4102e0256FUNC<unknown>HIDDEN3
                __GI_strtok.symtab0x41060032FUNC<unknown>HIDDEN3
                __GI_strtok_r.symtab0x414af0204FUNC<unknown>HIDDEN3
                __GI_strtol.symtab0x4123a028FUNC<unknown>HIDDEN3
                __GI_tcgetattr.symtab0x410660176FUNC<unknown>HIDDEN3
                __GI_time.symtab0x40e31084FUNC<unknown>HIDDEN3
                __GI_times.symtab0x41340084FUNC<unknown>HIDDEN3
                __GI_tolower.symtab0x4182b060FUNC<unknown>HIDDEN3
                __GI_toupper.symtab0x40e41060FUNC<unknown>HIDDEN3
                __GI_vfork.symtab0x40e37028FUNC<unknown>HIDDEN3
                __GI_vsnprintf.symtab0x40e530260FUNC<unknown>HIDDEN3
                __GI_wait4.symtab0x41346088FUNC<unknown>HIDDEN3
                __GI_waitpid.symtab0x40e39028FUNC<unknown>HIDDEN3
                __GI_wcrtomb.symtab0x4134e0112FUNC<unknown>HIDDEN3
                __GI_wcsnrtombs.symtab0x413590228FUNC<unknown>HIDDEN3
                __GI_wcsrtombs.symtab0x41355064FUNC<unknown>HIDDEN3
                __GI_write.symtab0x40e3b084FUNC<unknown>HIDDEN3
                __JCR_END__.symtab0x45d0240OBJECT<unknown>DEFAULT9
                __JCR_LIST__.symtab0x45d0240OBJECT<unknown>DEFAULT9
                __app_fini.symtab0x463d1c4OBJECT<unknown>HIDDEN14
                __atexit_lock.symtab0x45d4d024OBJECT<unknown>DEFAULT11
                __bsd_signal.symtab0x4110f0252FUNC<unknown>HIDDEN3
                __bss_start.symtab0x45da640NOTYPE<unknown>DEFAULTSHN_ABS
                __check_one_fd.symtab0x412b74136FUNC<unknown>DEFAULT3
                __ctype_b.symtab0x45d1844OBJECT<unknown>DEFAULT11
                __ctype_tolower.symtab0x45d5544OBJECT<unknown>DEFAULT11
                __ctype_toupper.symtab0x45d1944OBJECT<unknown>DEFAULT11
                __curbrk.symtab0x463d704OBJECT<unknown>HIDDEN14
                __data_start.symtab0x45d0a00OBJECT<unknown>DEFAULT11
                __decode_answer.symtab0x417bb0340FUNC<unknown>HIDDEN3
                __decode_dotted.symtab0x418610340FUNC<unknown>HIDDEN3
                __decode_header.symtab0x4179c0228FUNC<unknown>HIDDEN3
                __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                __dns_lookup.symtab0x414d002568FUNC<unknown>HIDDEN3
                __do_global_ctors_aux.symtab0x4189a00FUNC<unknown>DEFAULT3
                __do_global_dtors_aux.symtab0x4001600FUNC<unknown>DEFAULT3
                __dso_handle.symtab0x45d0800OBJECT<unknown>HIDDEN11
                __encode_dotted.symtab0x4184f0280FUNC<unknown>HIDDEN3
                __encode_header.symtab0x4178b0272FUNC<unknown>HIDDEN3
                __encode_question.symtab0x417ab0172FUNC<unknown>HIDDEN3
                __environ.symtab0x463d144OBJECT<unknown>DEFAULT14
                __errno_location.symtab0x40e45024FUNC<unknown>DEFAULT3
                __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __exit_cleanup.symtab0x463d004OBJECT<unknown>HIDDEN14
                __fgetc_unlocked.symtab0x4182f0388FUNC<unknown>DEFAULT3
                __fini_array_end.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
                __fini_array_start.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
                __get_hosts_byname_r.symtab0x415af0104FUNC<unknown>HIDDEN3
                __glibc_strerror_r.symtab0x4103e068FUNC<unknown>DEFAULT3
                __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __h_errno_location.symtab0x4134c024FUNC<unknown>DEFAULT3
                __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __heap_alloc.symtab0x4118a0188FUNC<unknown>DEFAULT3
                __heap_alloc_at.symtab0x411960184FUNC<unknown>DEFAULT3
                __heap_free.symtab0x411a68364FUNC<unknown>DEFAULT3
                __heap_link_free_area.symtab0x411a2044FUNC<unknown>DEFAULT3
                __heap_link_free_area_after.symtab0x411a4c28FUNC<unknown>DEFAULT3
                __init_array_end.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
                __init_array_start.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
                __length_dotted.symtab0x41877072FUNC<unknown>HIDDEN3
                __length_question.symtab0x417b6072FUNC<unknown>HIDDEN3
                __libc_close.symtab0x40dcb084FUNC<unknown>DEFAULT3
                __libc_connect.symtab0x410c6084FUNC<unknown>DEFAULT3
                __libc_creat.symtab0x40e0ec28FUNC<unknown>DEFAULT3
                __libc_fcntl.symtab0x40db00136FUNC<unknown>DEFAULT3
                __libc_fcntl64.symtab0x40db90104FUNC<unknown>DEFAULT3
                __libc_fork.symtab0x40dd7084FUNC<unknown>DEFAULT3
                __libc_getpid.symtab0x40de8084FUNC<unknown>DEFAULT3
                __libc_lseek64.symtab0x418200168FUNC<unknown>DEFAULT3
                __libc_nanosleep.symtab0x41331084FUNC<unknown>DEFAULT3
                __libc_open.symtab0x40e070124FUNC<unknown>DEFAULT3
                __libc_poll.symtab0x415db084FUNC<unknown>DEFAULT3
                __libc_read.symtab0x40e19084FUNC<unknown>DEFAULT3
                __libc_recv.symtab0x410da084FUNC<unknown>DEFAULT3
                __libc_recvfrom.symtab0x410e00128FUNC<unknown>DEFAULT3
                __libc_select.symtab0x40e1f0120FUNC<unknown>DEFAULT3
                __libc_send.symtab0x410e8084FUNC<unknown>DEFAULT3
                __libc_sendto.symtab0x410ee0128FUNC<unknown>DEFAULT3
                __libc_sigaction.symtab0x413040232FUNC<unknown>DEFAULT3
                __libc_stack_end.symtab0x463d104OBJECT<unknown>DEFAULT14
                __libc_waitpid.symtab0x40e39028FUNC<unknown>DEFAULT3
                __libc_write.symtab0x40e3b084FUNC<unknown>DEFAULT3
                __malloc_heap.symtab0x45d4004OBJECT<unknown>DEFAULT11
                __malloc_heap_lock.symtab0x463ce024OBJECT<unknown>DEFAULT14
                __malloc_sbrk_lock.symtab0x463ee824OBJECT<unknown>DEFAULT14
                __nameserver.symtab0x463f1012OBJECT<unknown>HIDDEN14
                __nameservers.symtab0x45da784OBJECT<unknown>HIDDEN13
                __open_etc_hosts.symtab0x417d10108FUNC<unknown>HIDDEN3
                __open_nameservers.symtab0x415710984FUNC<unknown>HIDDEN3
                __pagesize.symtab0x463d184OBJECT<unknown>DEFAULT14
                __preinit_array_end.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
                __preinit_array_start.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
                __pthread_initialize_minimal.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                __pthread_mutex_init.symtab0x412b648FUNC<unknown>DEFAULT3
                __pthread_mutex_lock.symtab0x412b648FUNC<unknown>DEFAULT3
                __pthread_mutex_trylock.symtab0x412b648FUNC<unknown>DEFAULT3
                __pthread_mutex_unlock.symtab0x412b648FUNC<unknown>DEFAULT3
                __pthread_return_0.symtab0x412b648FUNC<unknown>DEFAULT3
                __pthread_return_void.symtab0x412b6c8FUNC<unknown>DEFAULT3
                __raise.symtab0x4181b076FUNC<unknown>HIDDEN3
                __read_etc_hosts_r.symtab0x417d7c1076FUNC<unknown>HIDDEN3
                __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                __resolv_lock.symtab0x45d51024OBJECT<unknown>DEFAULT11
                __rtld_fini.symtab0x463d204OBJECT<unknown>HIDDEN14
                __searchdomain.symtab0x463f0016OBJECT<unknown>HIDDEN14
                __searchdomains.symtab0x45da7c4OBJECT<unknown>HIDDEN13
                __sigaddset.symtab0x41121844FUNC<unknown>DEFAULT3
                __sigdelset.symtab0x41124448FUNC<unknown>DEFAULT3
                __sigismember.symtab0x4111f040FUNC<unknown>DEFAULT3
                __start.symtab0x4002a0100FUNC<unknown>DEFAULT3
                __stdin.symtab0x45d1ec4OBJECT<unknown>DEFAULT11
                __stdio_READ.symtab0x4187c0140FUNC<unknown>HIDDEN3
                __stdio_WRITE.symtab0x413680280FUNC<unknown>HIDDEN3
                __stdio_adjust_position.symtab0x416210324FUNC<unknown>HIDDEN3
                __stdio_fwrite.symtab0x4137a0472FUNC<unknown>HIDDEN3
                __stdio_init_mutex.symtab0x40e6f832FUNC<unknown>HIDDEN3
                __stdio_mutex_initializer.3833.symtab0x41be7024OBJECT<unknown>DEFAULT5
                __stdio_rfill.symtab0x41885088FUNC<unknown>HIDDEN3
                __stdio_seek.symtab0x4166d0112FUNC<unknown>HIDDEN3
                __stdio_trans2r_o.symtab0x4188b0228FUNC<unknown>HIDDEN3
                __stdio_trans2w_o.symtab0x413980308FUNC<unknown>HIDDEN3
                __stdio_wcommit.symtab0x40e840100FUNC<unknown>HIDDEN3
                __stdout.symtab0x45d1f04OBJECT<unknown>DEFAULT11
                __syscall_error.symtab0x412ff072FUNC<unknown>HIDDEN3
                __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_rt_sigaction.symtab0x41313084FUNC<unknown>HIDDEN3
                __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uClibc_fini.symtab0x412aa0196FUNC<unknown>DEFAULT3
                __uClibc_init.symtab0x412bfc140FUNC<unknown>DEFAULT3
                __uClibc_main.symtab0x412c88864FUNC<unknown>DEFAULT3
                __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uclibc_progname.symtab0x45d4f04OBJECT<unknown>HIDDEN11
                __vfork.symtab0x40e37028FUNC<unknown>HIDDEN3
                __xpg_strerror_r.symtab0x410430392FUNC<unknown>DEFAULT3
                __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _charpad.symtab0x40e8b0128FUNC<unknown>DEFAULT3
                _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _dl_aux_init.symtab0x415d1044FUNC<unknown>DEFAULT3
                _dl_phdr.symtab0x45da804OBJECT<unknown>DEFAULT13
                _dl_phnum.symtab0x45da844OBJECT<unknown>DEFAULT13
                _edata.symtab0x45da640NOTYPE<unknown>DEFAULTSHN_ABS
                _end.symtab0x463f1c0NOTYPE<unknown>DEFAULTSHN_ABS
                _errno.symtab0x463d304OBJECT<unknown>DEFAULT14
                _exit.symtab0x40dc0080FUNC<unknown>DEFAULT3
                _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fbss.symtab0x45da640NOTYPE<unknown>DEFAULTSHN_ABS
                _fdata.symtab0x45d0800NOTYPE<unknown>DEFAULT11
                _fini.symtab0x418a1028FUNC<unknown>DEFAULT4
                _fixed_buffers.symtab0x461ae88192OBJECT<unknown>DEFAULT14
                _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fp_out_narrow.symtab0x40e930228FUNC<unknown>DEFAULT3
                _fpmaxtostr.symtab0x413d002120FUNC<unknown>HIDDEN3
                _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ftext.symtab0x4001600NOTYPE<unknown>DEFAULT3
                _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _gp.symtab0x4655500NOTYPE<unknown>DEFAULTSHN_ABS
                _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                _h_errno.symtab0x463d344OBJECT<unknown>DEFAULT14
                _init.symtab0x4000cc28FUNC<unknown>DEFAULT2
                _load_inttype.symtab0x413ac0136FUNC<unknown>HIDDEN3
                _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_init.symtab0x40f1c0220FUNC<unknown>HIDDEN3
                _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_parsespec.symtab0x40f59c1512FUNC<unknown>HIDDEN3
                _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_prepargs.symtab0x40f2a0100FUNC<unknown>HIDDEN3
                _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_setargs.symtab0x40f310540FUNC<unknown>HIDDEN3
                _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _promoted_size.symtab0x40f530108FUNC<unknown>DEFAULT3
                _pthread_cleanup_pop_restore.symtab0x412b6c8FUNC<unknown>DEFAULT3
                _pthread_cleanup_push_defer.symtab0x412b6c8FUNC<unknown>DEFAULT3
                _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _sigintr.symtab0x463e68128OBJECT<unknown>HIDDEN14
                _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _stdio_fopen.symtab0x416360880FUNC<unknown>HIDDEN3
                _stdio_init.symtab0x40e640184FUNC<unknown>HIDDEN3
                _stdio_openlist.symtab0x45d1f44OBJECT<unknown>DEFAULT11
                _stdio_openlist_add_lock.symtab0x45d1a024OBJECT<unknown>DEFAULT11
                _stdio_openlist_dec_use.symtab0x416820400FUNC<unknown>DEFAULT3
                _stdio_openlist_del_count.symtab0x461ae44OBJECT<unknown>DEFAULT14
                _stdio_openlist_del_lock.symtab0x45d1b824OBJECT<unknown>DEFAULT11
                _stdio_openlist_use_count.symtab0x461ae04OBJECT<unknown>DEFAULT14
                _stdio_streams.symtab0x45d1f8240OBJECT<unknown>DEFAULT11
                _stdio_term.symtab0x40e718284FUNC<unknown>HIDDEN3
                _stdio_user_locking.symtab0x45d1d04OBJECT<unknown>DEFAULT11
                _stdlib_strto_l.symtab0x4123c0592FUNC<unknown>HIDDEN3
                _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _store_inttype.symtab0x413b5068FUNC<unknown>HIDDEN3
                _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _string_syserrmsgs.symtab0x41bfe02934OBJECT<unknown>HIDDEN5
                _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _uintmaxtostr.symtab0x413ba0340FUNC<unknown>HIDDEN3
                _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _vfprintf_internal.symtab0x40ea141960FUNC<unknown>HIDDEN3
                _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                abort.symtab0x415b60428FUNC<unknown>DEFAULT3
                abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                access.symtab0x40dc5084FUNC<unknown>DEFAULT3
                access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                acnc.symtab0x40623c372FUNC<unknown>DEFAULT3
                add_entry.symtab0x40c4f4200FUNC<unknown>DEFAULT3
                atoi.symtab0x41238028FUNC<unknown>DEFAULT3
                atol.symtab0x41238028FUNC<unknown>DEFAULT3
                atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                axis_bp.symtab0x45d0c04OBJECT<unknown>DEFAULT11
                bcopy.symtab0x4105c032FUNC<unknown>DEFAULT3
                bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                been_there_done_that.symtab0x463d604OBJECT<unknown>DEFAULT14
                been_there_done_that.2792.symtab0x463d244OBJECT<unknown>DEFAULT14
                brk.symtab0x415d40112FUNC<unknown>DEFAULT3
                brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                bsd_signal.symtab0x4110f0252FUNC<unknown>DEFAULT3
                buf.4833.symtab0x463b00460OBJECT<unknown>DEFAULT14
                bzero.symtab0x4105e028FUNC<unknown>DEFAULT3
                bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                c.symtab0x45d0cc4OBJECT<unknown>DEFAULT11
                calloc.symtab0x411470180FUNC<unknown>DEFAULT3
                calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                checksum_generic.symtab0x400310268FUNC<unknown>DEFAULT3
                checksum_tcp_udp.symtab0x40041c572FUNC<unknown>DEFAULT3
                checksum_tcpudp.symtab0x400658572FUNC<unknown>DEFAULT3
                clock.symtab0x40e470108FUNC<unknown>DEFAULT3
                clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                close.symtab0x40dcb084FUNC<unknown>DEFAULT3
                close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                completed.2296.symtab0x45da901OBJECT<unknown>DEFAULT14
                connect.symtab0x410c6084FUNC<unknown>DEFAULT3
                connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                connectTimeout.symtab0x403024828FUNC<unknown>DEFAULT3
                creat.symtab0x40e0ec28FUNC<unknown>DEFAULT3
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                csum.symtab0x403688460FUNC<unknown>DEFAULT3
                data_start.symtab0x45d0a00OBJECT<unknown>DEFAULT11
                decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dup2.symtab0x40dd1084FUNC<unknown>DEFAULT3
                dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                environ.symtab0x463d144OBJECT<unknown>DEFAULT14
                errno.symtab0x463d304OBJECT<unknown>DEFAULT14
                errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                estridx.symtab0x41bf50126OBJECT<unknown>DEFAULT5
                execl.symtab0x412700204FUNC<unknown>DEFAULT3
                execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                execve.symtab0x41319084FUNC<unknown>DEFAULT3
                execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exit.symtab0x412610236FUNC<unknown>DEFAULT3
                exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exp10_table.symtab0x41cbf872OBJECT<unknown>DEFAULT5
                fclose.symtab0x415e10512FUNC<unknown>DEFAULT3
                fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fcntl.symtab0x40db00136FUNC<unknown>DEFAULT3
                fcntl64.symtab0x40db90104FUNC<unknown>DEFAULT3
                fdgets.symtab0x402604292FUNC<unknown>DEFAULT3
                fdopen_pids.symtab0x461acc4OBJECT<unknown>DEFAULT14
                fdpclose.symtab0x402388636FUNC<unknown>DEFAULT3
                fdpopen.symtab0x401f141140FUNC<unknown>DEFAULT3
                fflush_unlocked.symtab0x4169b0628FUNC<unknown>DEFAULT3
                fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgetc_unlocked.symtab0x4182f0388FUNC<unknown>DEFAULT3
                fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets.symtab0x416740216FUNC<unknown>DEFAULT3
                fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets_unlocked.symtab0x416c30268FUNC<unknown>DEFAULT3
                fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                findRandIP.symtab0x4035dc172FUNC<unknown>DEFAULT3
                fmt.symtab0x41cbe020OBJECT<unknown>DEFAULT5
                fopen.symtab0x41601028FUNC<unknown>DEFAULT3
                fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fork.symtab0x40dd7084FUNC<unknown>DEFAULT3
                fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fputs_unlocked.symtab0x40fb90128FUNC<unknown>DEFAULT3
                fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                frame_dummy.symtab0x40021c0FUNC<unknown>DEFAULT3
                free.symtab0x411530396FUNC<unknown>DEFAULT3
                free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseek.symtab0x41603068FUNC<unknown>DEFAULT3
                fseeko.symtab0x41603068FUNC<unknown>DEFAULT3
                fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseeko64.symtab0x416080388FUNC<unknown>DEFAULT3
                fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fwrite_unlocked.symtab0x40fc10280FUNC<unknown>DEFAULT3
                fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getBuild.symtab0x409f8432FUNC<unknown>DEFAULT3
                getHost.symtab0x402a68160FUNC<unknown>DEFAULT3
                getOurIP.symtab0x409c04896FUNC<unknown>DEFAULT3
                get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getc_unlocked.symtab0x4182f0388FUNC<unknown>DEFAULT3
                getdtablesize.symtab0x40ddd072FUNC<unknown>DEFAULT3
                getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getegid.symtab0x4131f088FUNC<unknown>DEFAULT3
                getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                geteuid.symtab0x40de2088FUNC<unknown>DEFAULT3
                geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getgid.symtab0x41325084FUNC<unknown>DEFAULT3
                getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname.symtab0x410780116FUNC<unknown>DEFAULT3
                gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname_r.symtab0x4108001108FUNC<unknown>DEFAULT3
                gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getpid.symtab0x40de8084FUNC<unknown>DEFAULT3
                getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getppid.symtab0x40dee084FUNC<unknown>DEFAULT3
                getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getrlimit.symtab0x40df4084FUNC<unknown>DEFAULT3
                getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getsockname.symtab0x410cc084FUNC<unknown>DEFAULT3
                getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getsockopt.symtab0x410d20120FUNC<unknown>DEFAULT3
                getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getuid.symtab0x4132b084FUNC<unknown>DEFAULT3
                getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                h.4832.symtab0x463ccc20OBJECT<unknown>DEFAULT14
                h_errno.symtab0x463d344OBJECT<unknown>DEFAULT14
                hacks.symtab0x45d0b04OBJECT<unknown>DEFAULT11
                hacks2.symtab0x45d0b44OBJECT<unknown>DEFAULT11
                hacks3.symtab0x45d0b84OBJECT<unknown>DEFAULT11
                hacks4.symtab0x45d0bc4OBJECT<unknown>DEFAULT11
                heap_alloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                heap_alloc_at.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                heap_free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                hextable.symtab0x4197641024OBJECT<unknown>DEFAULT5
                hlt.symtab0x4002fc0NOTYPE<unknown>DEFAULT3
                htonl.symtab0x4107208FUNC<unknown>DEFAULT3
                htons.symtab0x4107288FUNC<unknown>DEFAULT3
                httphex.symtab0x40656c1672FUNC<unknown>DEFAULT3
                i.4419.symtab0x45d0d04OBJECT<unknown>DEFAULT11
                index.symtab0x40ff00256FUNC<unknown>DEFAULT3
                inet_addr.symtab0x41073072FUNC<unknown>DEFAULT3
                inet_aton.symtab0x414c00244FUNC<unknown>DEFAULT3
                inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_ntop.symtab0x417550852FUNC<unknown>DEFAULT3
                inet_ntop4.symtab0x41735c500FUNC<unknown>DEFAULT3
                inet_pton.symtab0x4170a0700FUNC<unknown>DEFAULT3
                inet_pton4.symtab0x416fb0240FUNC<unknown>DEFAULT3
                initConnection.symtab0x409940708FUNC<unknown>DEFAULT3
                init_rand.symtab0x400ad4300FUNC<unknown>DEFAULT3
                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                initial_fa.symtab0x45d2f0264OBJECT<unknown>DEFAULT11
                initstate.symtab0x411d54208FUNC<unknown>DEFAULT3
                initstate_r.symtab0x412230328FUNC<unknown>DEFAULT3
                ioctl.symtab0x40dfa0104FUNC<unknown>DEFAULT3
                ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                isatty.symtab0x41062060FUNC<unknown>DEFAULT3
                isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                kill.symtab0x40e01088FUNC<unknown>DEFAULT3
                kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                killer_status.symtab0x45dac04OBJECT<unknown>DEFAULT14
                lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/mips/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/mips/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/pipe.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                listFork.symtab0x403360636FUNC<unknown>DEFAULT3
                llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lseek64.symtab0x418200168FUNC<unknown>DEFAULT3
                macAddress.symtab0x45dac46OBJECT<unknown>DEFAULT14
                main.symtab0x409fa43464FUNC<unknown>DEFAULT3
                main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                makeIPPacket.symtab0x4039b8312FUNC<unknown>DEFAULT3
                makeRandomStr.symtab0x402bac268FUNC<unknown>DEFAULT3
                makevsepacket.symtab0x405714348FUNC<unknown>DEFAULT3
                malloc.symtab0x411280492FUNC<unknown>DEFAULT3
                malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memchr.symtab0x414550264FUNC<unknown>DEFAULT3
                memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memcpy.symtab0x40fd30308FUNC<unknown>DEFAULT3
                memmove.symtab0x414660816FUNC<unknown>DEFAULT3
                memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mempcpy.symtab0x41499076FUNC<unknown>DEFAULT3
                mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memrchr.symtab0x4149e0272FUNC<unknown>DEFAULT3
                memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memset.symtab0x40fe70144FUNC<unknown>DEFAULT3
                mylock.symtab0x45d41024OBJECT<unknown>DEFAULT11
                mylock.symtab0x463d4024OBJECT<unknown>DEFAULT14
                mylock.symtab0x45d53024OBJECT<unknown>DEFAULT11
                nanosleep.symtab0x41331084FUNC<unknown>DEFAULT3
                nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                next_start.1065.symtab0x463af04OBJECT<unknown>DEFAULT14
                ngPid.symtab0x45da6c4OBJECT<unknown>DEFAULT13
                ntohl.symtab0x4107108FUNC<unknown>DEFAULT3
                ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ntohs.symtab0x4107188FUNC<unknown>DEFAULT3
                ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                numpids.symtab0x45dab88OBJECT<unknown>DEFAULT14
                object.2349.symtab0x45da9424OBJECT<unknown>DEFAULT14
                open.symtab0x40e070124FUNC<unknown>DEFAULT3
                open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ourIP.symtab0x45da684OBJECT<unknown>DEFAULT13
                p.2294.symtab0x45d0900OBJECT<unknown>DEFAULT11
                parseHex.symtab0x402728176FUNC<unknown>DEFAULT3
                pids.symtab0x45da744OBJECT<unknown>DEFAULT13
                pipe.symtab0x40dac064FUNC<unknown>DEFAULT3
                poll.symtab0x415db084FUNC<unknown>DEFAULT3
                poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                prctl.symtab0x40e110120FUNC<unknown>DEFAULT3
                prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                prefix.4045.symtab0x41bea012OBJECT<unknown>DEFAULT5
                print.symtab0x40171c1456FUNC<unknown>DEFAULT3
                printchar.symtab0x401190184FUNC<unknown>DEFAULT3
                printi.symtab0x401484664FUNC<unknown>DEFAULT3
                prints.symtab0x401248572FUNC<unknown>DEFAULT3
                processCmd.symtab0x406bf411596FUNC<unknown>DEFAULT3
                qual_chars.4050.symtab0x41bec020OBJECT<unknown>DEFAULT5
                raise.symtab0x4181b076FUNC<unknown>DEFAULT3
                raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand.symtab0x411be028FUNC<unknown>DEFAULT3
                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand__str.symtab0x40af4c372FUNC<unknown>DEFAULT3
                rand_alpha_str.symtab0x40b0c0300FUNC<unknown>DEFAULT3
                rand_alphastr.symtab0x400fc0464FUNC<unknown>DEFAULT3
                rand_cmwc.symtab0x400dec468FUNC<unknown>DEFAULT3
                rand_init.symtab0x40ad30248FUNC<unknown>DEFAULT3
                rand_next.symtab0x40ae28292FUNC<unknown>DEFAULT3
                random.symtab0x411c00164FUNC<unknown>DEFAULT3
                random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                random_poly_info.symtab0x41cb6040OBJECT<unknown>DEFAULT5
                random_r.symtab0x41200c176FUNC<unknown>DEFAULT3
                random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                randtbl.symtab0x45d428128OBJECT<unknown>DEFAULT11
                rawmemchr.symtab0x416d40200FUNC<unknown>DEFAULT3
                rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                read.symtab0x40e19084FUNC<unknown>DEFAULT3
                read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                realloc.symtab0x4116c0472FUNC<unknown>DEFAULT3
                realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                recv.symtab0x410da084FUNC<unknown>DEFAULT3
                recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                recvLine.symtab0x402cb8876FUNC<unknown>DEFAULT3
                recvfrom.symtab0x410e00128FUNC<unknown>DEFAULT3
                recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                resolv_domain_to_hostname.symtab0x40b1f0360FUNC<unknown>DEFAULT3
                resolv_entries_free.symtab0x40be84164FUNC<unknown>DEFAULT3
                resolv_lookup.symtab0x40b49c2536FUNC<unknown>DEFAULT3
                resolv_skip_name.symtab0x40b358324FUNC<unknown>DEFAULT3
                rtcp.symtab0x404d701748FUNC<unknown>DEFAULT3
                sbrk.symtab0x413370144FUNC<unknown>DEFAULT3
                sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                scanPid.symtab0x45da704OBJECT<unknown>DEFAULT13
                select.symtab0x40e1f0120FUNC<unknown>DEFAULT3
                select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                send.symtab0x410e8084FUNC<unknown>DEFAULT3
                send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sendSTD.symtab0x405444720FUNC<unknown>DEFAULT3
                sendto.symtab0x410ee0128FUNC<unknown>DEFAULT3
                sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setsockopt.symtab0x410f60120FUNC<unknown>DEFAULT3
                setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setstate.symtab0x411ca4176FUNC<unknown>DEFAULT3
                setstate_r.symtab0x411ed0316FUNC<unknown>DEFAULT3
                sigaction.symtab0x413040232FUNC<unknown>DEFAULT3
                sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigaddset.symtab0x411040104FUNC<unknown>DEFAULT3
                sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigemptyset.symtab0x4110b060FUNC<unknown>DEFAULT3
                signal.symtab0x4110f0252FUNC<unknown>DEFAULT3
                signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigprocmask.symtab0x40e270148FUNC<unknown>DEFAULT3
                sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sleep.symtab0x4127d0564FUNC<unknown>DEFAULT3
                sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket.symtab0x410fe084FUNC<unknown>DEFAULT3
                socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket_connect.symtab0x4063b0444FUNC<unknown>DEFAULT3
                sockprintf.symtab0x401dbc344FUNC<unknown>DEFAULT3
                spec_and_mask.4049.symtab0x41bed416OBJECT<unknown>DEFAULT5
                spec_base.4044.symtab0x41beac7OBJECT<unknown>DEFAULT5
                spec_chars.4046.symtab0x41bf0021OBJECT<unknown>DEFAULT5
                spec_flags.4045.symtab0x41bf188OBJECT<unknown>DEFAULT5
                spec_or_mask.4048.symtab0x41bee416OBJECT<unknown>DEFAULT5
                spec_ranges.4047.symtab0x41bef49OBJECT<unknown>DEFAULT5
                sprintf.symtab0x40e4e080FUNC<unknown>DEFAULT3
                sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                srand.symtab0x411e24172FUNC<unknown>DEFAULT3
                srandom.symtab0x411e24172FUNC<unknown>DEFAULT3
                srandom_r.symtab0x4120bc372FUNC<unknown>DEFAULT3
                static_id.symtab0x45d5002OBJECT<unknown>DEFAULT11
                static_ns.symtab0x463d584OBJECT<unknown>DEFAULT14
                stderr.symtab0x45d1e84OBJECT<unknown>DEFAULT11
                stdin.symtab0x45d1e04OBJECT<unknown>DEFAULT11
                stdout.symtab0x45d1e44OBJECT<unknown>DEFAULT11
                strcasecmp.symtab0x418480108FUNC<unknown>DEFAULT3
                strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strchr.symtab0x40ff00256FUNC<unknown>DEFAULT3
                strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcmp.symtab0x41000044FUNC<unknown>DEFAULT3
                strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcoll.symtab0x41000044FUNC<unknown>DEFAULT3
                strcpy.symtab0x41003036FUNC<unknown>DEFAULT3
                strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strdup.symtab0x416f20144FUNC<unknown>DEFAULT3
                strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strerror_r.symtab0x410430392FUNC<unknown>DEFAULT3
                strlen.symtab0x410060184FUNC<unknown>DEFAULT3
                strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strncat.symtab0x416e10180FUNC<unknown>DEFAULT3
                strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strncpy.symtab0x410120188FUNC<unknown>DEFAULT3
                strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strnlen.symtab0x4101e0256FUNC<unknown>DEFAULT3
                strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strpbrk.symtab0x414bc064FUNC<unknown>DEFAULT3
                strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strspn.symtab0x416ed076FUNC<unknown>DEFAULT3
                strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strstr.symtab0x4102e0256FUNC<unknown>DEFAULT3
                strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtok.symtab0x41060032FUNC<unknown>DEFAULT3
                strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtok_r.symtab0x414af0204FUNC<unknown>DEFAULT3
                strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtol.symtab0x4123a028FUNC<unknown>DEFAULT3
                strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                szprintf.symtab0x401d44120FUNC<unknown>DEFAULT3
                table.symtab0x463d80232OBJECT<unknown>DEFAULT14
                table.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                table_init.symtab0x40bf301068FUNC<unknown>DEFAULT3
                table_key.symtab0x45d1704OBJECT<unknown>DEFAULT11
                table_lock_val.symtab0x40c3e0132FUNC<unknown>DEFAULT3
                table_retrieve_val.symtab0x40c464144FUNC<unknown>DEFAULT3
                table_unlock_val.symtab0x40c35c132FUNC<unknown>DEFAULT3
                tcgetattr.symtab0x410660176FUNC<unknown>DEFAULT3
                tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                tcpFl00d.symtab0x4044542332FUNC<unknown>DEFAULT3
                tcpcsum.symtab0x403854356FUNC<unknown>DEFAULT3
                time.symtab0x40e31084FUNC<unknown>DEFAULT3
                time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                times.symtab0x41340084FUNC<unknown>DEFAULT3
                times.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                toggle_obf.symtab0x40c5bc552FUNC<unknown>DEFAULT3
                tolower.symtab0x4182b060FUNC<unknown>DEFAULT3
                tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                toupper.symtab0x40e41060FUNC<unknown>DEFAULT3
                toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                trim.symtab0x400c00492FUNC<unknown>DEFAULT3
                type_codes.symtab0x41bf2024OBJECT<unknown>DEFAULT5
                type_sizes.symtab0x41bf3812OBJECT<unknown>DEFAULT5
                udpfl00d.symtab0x403af02404FUNC<unknown>DEFAULT3
                unknown.1088.symtab0x41bfd014OBJECT<unknown>DEFAULT5
                unsafe_state.symtab0x45d4b028OBJECT<unknown>DEFAULT11
                uppercase.symtab0x402b08164FUNC<unknown>DEFAULT3
                userID.symtab0x45d0c84OBJECT<unknown>DEFAULT11
                usleep.symtab0x412a10144FUNC<unknown>DEFAULT3
                usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                util.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                util_atoi.symtab0x40cd14968FUNC<unknown>DEFAULT3
                util_fdgets.symtab0x40d79c320FUNC<unknown>DEFAULT3
                util_isalpha.symtab0x40d944144FUNC<unknown>DEFAULT3
                util_isdigit.symtab0x40da54104FUNC<unknown>DEFAULT3
                util_isspace.symtab0x40d9d4128FUNC<unknown>DEFAULT3
                util_isupper.symtab0x40d8dc104FUNC<unknown>DEFAULT3
                util_itoa.symtab0x40d0dc572FUNC<unknown>DEFAULT3
                util_local_addr.symtab0x40d648340FUNC<unknown>DEFAULT3
                util_memcpy.symtab0x40cbf8164FUNC<unknown>DEFAULT3
                util_memsearch.symtab0x40d318292FUNC<unknown>DEFAULT3
                util_strcat.symtab0x40cb50168FUNC<unknown>DEFAULT3
                util_strcmp.symtab0x40c9a4288FUNC<unknown>DEFAULT3
                util_strcpy.symtab0x40cac4140FUNC<unknown>DEFAULT3
                util_stristr.symtab0x40d43c524FUNC<unknown>DEFAULT3
                util_strlen.symtab0x40c7f0116FUNC<unknown>DEFAULT3
                util_strncmp.symtab0x40c864320FUNC<unknown>DEFAULT3
                util_zero.symtab0x40cc9c120FUNC<unknown>DEFAULT3
                vfork.symtab0x40e37028FUNC<unknown>DEFAULT3
                vfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                vseattack.symtab0x4058702508FUNC<unknown>DEFAULT3
                vsnprintf.symtab0x40e530260FUNC<unknown>DEFAULT3
                vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                w.symtab0x461adc4OBJECT<unknown>DEFAULT14
                wait4.symtab0x41346088FUNC<unknown>DEFAULT3
                wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                waitpid.symtab0x40e39028FUNC<unknown>DEFAULT3
                waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                watchdog_maintain.symtab0x4008a0564FUNC<unknown>DEFAULT3
                watchdog_pid.symtab0x45dab44OBJECT<unknown>DEFAULT14
                wcrtomb.symtab0x4134e0112FUNC<unknown>DEFAULT3
                wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsnrtombs.symtab0x413590228FUNC<unknown>DEFAULT3
                wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsrtombs.symtab0x41355064FUNC<unknown>DEFAULT3
                wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wildString.symtab0x4027d8656FUNC<unknown>DEFAULT3
                write.symtab0x40e3b084FUNC<unknown>DEFAULT3
                write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                x.symtab0x461ad04OBJECT<unknown>DEFAULT14
                xdigits.3043.symtab0x41ccc417OBJECT<unknown>DEFAULT5
                y.symtab0x461ad44OBJECT<unknown>DEFAULT14
                z.symtab0x461ad84OBJECT<unknown>DEFAULT14
                zprintf.symtab0x401ccc120FUNC<unknown>DEFAULT3

                Download Network PCAP: filteredfull

                • Total Packets: 26
                • 820 undefined
                • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Mar 16, 2025 16:14:00.482285023 CET60206820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:00.487059116 CET82060206141.11.212.101192.168.2.13
                Mar 16, 2025 16:14:00.487469912 CET60206820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:00.544204950 CET60206820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:00.548948050 CET82060206141.11.212.101192.168.2.13
                Mar 16, 2025 16:14:21.846201897 CET82060206141.11.212.101192.168.2.13
                Mar 16, 2025 16:14:21.846651077 CET60206820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:21.851424932 CET82060206141.11.212.101192.168.2.13
                Mar 16, 2025 16:14:36.852420092 CET60208820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:37.530376911 CET82060208141.11.212.101192.168.2.13
                Mar 16, 2025 16:14:37.530550957 CET60208820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:37.530678988 CET60208820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:37.535378933 CET82060208141.11.212.101192.168.2.13
                Mar 16, 2025 16:14:58.925467014 CET82060208141.11.212.101192.168.2.13
                Mar 16, 2025 16:14:58.925865889 CET60208820192.168.2.13141.11.212.101
                Mar 16, 2025 16:14:58.932096958 CET82060208141.11.212.101192.168.2.13
                Mar 16, 2025 16:15:13.931498051 CET60210820192.168.2.13141.11.212.101
                Mar 16, 2025 16:15:13.936621904 CET82060210141.11.212.101192.168.2.13
                Mar 16, 2025 16:15:13.936723948 CET60210820192.168.2.13141.11.212.101
                Mar 16, 2025 16:15:13.936774969 CET60210820192.168.2.13141.11.212.101
                Mar 16, 2025 16:15:13.941456079 CET82060210141.11.212.101192.168.2.13
                Mar 16, 2025 16:15:35.336934090 CET82060210141.11.212.101192.168.2.13
                Mar 16, 2025 16:15:35.337107897 CET60210820192.168.2.13141.11.212.101
                Mar 16, 2025 16:15:35.341762066 CET82060210141.11.212.101192.168.2.13
                Mar 16, 2025 16:15:50.341352940 CET60212820192.168.2.13141.11.212.101
                Mar 16, 2025 16:15:50.346086979 CET82060212141.11.212.101192.168.2.13
                Mar 16, 2025 16:15:50.346177101 CET60212820192.168.2.13141.11.212.101
                Mar 16, 2025 16:15:50.346194983 CET60212820192.168.2.13141.11.212.101
                Mar 16, 2025 16:15:50.350847006 CET82060212141.11.212.101192.168.2.13
                Mar 16, 2025 16:16:11.707508087 CET82060212141.11.212.101192.168.2.13
                Mar 16, 2025 16:16:11.707948923 CET60212820192.168.2.13141.11.212.101
                Mar 16, 2025 16:16:11.712661982 CET82060212141.11.212.101192.168.2.13
                Mar 16, 2025 16:16:26.712071896 CET60214820192.168.2.13141.11.212.101
                Mar 16, 2025 16:16:26.716856956 CET82060214141.11.212.101192.168.2.13
                Mar 16, 2025 16:16:26.716974974 CET60214820192.168.2.13141.11.212.101
                Mar 16, 2025 16:16:26.717072010 CET60214820192.168.2.13141.11.212.101
                Mar 16, 2025 16:16:26.721801043 CET82060214141.11.212.101192.168.2.13
                Mar 16, 2025 16:16:48.085808039 CET82060214141.11.212.101192.168.2.13
                Mar 16, 2025 16:16:48.085922956 CET60214820192.168.2.13141.11.212.101
                Mar 16, 2025 16:16:48.093513012 CET82060214141.11.212.101192.168.2.13
                Mar 16, 2025 16:17:03.092097044 CET60216820192.168.2.13141.11.212.101
                Mar 16, 2025 16:17:03.096911907 CET82060216141.11.212.101192.168.2.13
                Mar 16, 2025 16:17:03.096981049 CET60216820192.168.2.13141.11.212.101
                Mar 16, 2025 16:17:03.097012997 CET60216820192.168.2.13141.11.212.101
                Mar 16, 2025 16:17:03.101681948 CET82060216141.11.212.101192.168.2.13
                Mar 16, 2025 16:17:24.511148930 CET82060216141.11.212.101192.168.2.13
                Mar 16, 2025 16:17:24.511549950 CET60216820192.168.2.13141.11.212.101
                Mar 16, 2025 16:17:24.516295910 CET82060216141.11.212.101192.168.2.13
                TimestampSource PortDest PortSource IPDest IP
                Mar 16, 2025 16:16:46.653897047 CET6007253192.168.2.138.8.8.8
                Mar 16, 2025 16:16:46.653985977 CET5176653192.168.2.138.8.8.8
                Mar 16, 2025 16:16:46.660039902 CET53517668.8.8.8192.168.2.13
                Mar 16, 2025 16:16:46.660056114 CET53600728.8.8.8192.168.2.13
                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Mar 16, 2025 16:16:46.653897047 CET192.168.2.138.8.8.80x481dStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                Mar 16, 2025 16:16:46.653985977 CET192.168.2.138.8.8.80x279Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Mar 16, 2025 16:16:46.660056114 CET8.8.8.8192.168.2.130x481dNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                Mar 16, 2025 16:16:46.660056114 CET8.8.8.8192.168.2.130x481dNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                System Behavior

                Start time (UTC):15:13:59
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
                Arguments:/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
                File size:5777432 bytes
                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                Start time (UTC):15:13:59
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
                Arguments:-
                File size:5777432 bytes
                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                Start time (UTC):15:13:59
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
                Arguments:-
                File size:5777432 bytes
                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                Start time (UTC):15:13:59
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mips-2025-03-03T07_22_22.elf
                Arguments:-
                File size:5777432 bytes
                MD5 hash:0083f1f0e77be34ad27f849842bbb00c