Edit tour

Linux Analysis Report
yakuza.arm4.elf

Overview

General Information

Sample name:	yakuza.arm4.elf
Analysis ID:	1644205
MD5:	9e2b447d2a412553c548ac654e6d0206
SHA1:	f8c1742d12c49585720f3d0555c8b64732d1c4a1
SHA256:	b3b6026514267391ee8a829523322b8e7603dba28b8625141b9c09d6918d0ea8
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	80
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1644205
Start date and time:	2025-03-20 13:00:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.arm4.elf
Detection:	MAL
Classification:	mal80.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 45.135.194.39:5555
VT rate limit hit for: http://0.0.0.0/bins.sh;

Runtime Messages

Command:	/tmp/yakuza.arm4.elf
PID:	5434
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.arm4.elf (PID: 5434, Parent: 5355, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/yakuza.arm4.elf

yakuza.arm4.elf New Fork (PID: 5436, Parent: 5434)

yakuza.arm4.elf New Fork (PID: 5438, Parent: 5436)

yakuza.arm4.elf New Fork (PID: 5444, Parent: 5438)

yakuza.arm4.elf New Fork (PID: 5480, Parent: 5444)

yakuza.arm4.elf New Fork (PID: 5499, Parent: 5480)

yakuza.arm4.elf New Fork (PID: 5516, Parent: 5499)

yakuza.arm4.elf New Fork (PID: 5535, Parent: 5516)

yakuza.arm4.elf New Fork (PID: 5559, Parent: 5535)

yakuza.arm4.elf New Fork (PID: 5576, Parent: 5559)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.arm4.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
yakuza.arm4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5434.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5436.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5444.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5535.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5499.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5516.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5438.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5559.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5480.1.00007f8224017000.00007f822402a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Click to see the 4 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yakuza.arm4.elf

Avira: detected

Found malware configuration

Source: yakuza.arm4.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "45.135.194.39:5555"}

Multi AV Scanner detection for submitted file

Source: yakuza.arm4.elf	Virustotal: Detection: 66%			Perma Link
Source: yakuza.arm4.elf	ReversingLabs: Detection: 72%

Source: global traffic

TCP traffic: 192.168.2.13:59014 -> 45.135.194.39:5555

Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	TCP traffic detected without corresponding DNS query: 45.135.194.39
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: yakuza.arm4.elf	String found in binary or memory: http://0.0.0.0/bins.sh;
Source: yakuza.arm4.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: yakuza.arm4.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: yakuza.arm4.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: yakuza.arm4.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: yakuza.arm4.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: yakuza.arm4.elf	ELF static info symbol of initial sample: TelnetScanner
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: payload

Source: Initial sample

String containing 'busybox' found: busybox

Source: classification engine

Classification label: mal80.troj.linELF@0/0@2/0

Source: yakuza.arm4.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: yakuza.arm4.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/yakuza.arm4.elf (PID: 5434)

Queries kernel information via 'uname':

Jump to behavior

Source: yakuza.arm4.elf, 5434.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5436.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5438.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5444.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5480.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5499.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5516.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5535.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5559.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: yakuza.arm4.elf, 5434.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5436.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5438.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5444.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5480.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5499.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5516.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5535.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp, yakuza.arm4.elf, 5559.1.000055abfc09b000.000055abfc1c9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: yakuza.arm4.elf, 5434.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5436.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5438.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5444.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5480.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5499.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5516.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5535.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5559.1.00007fff5416d000.00007fff5418e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: yakuza.arm4.elf, 5434.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5436.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5438.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5444.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5480.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5499.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5516.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5535.1.00007fff5416d000.00007fff5418e000.rw-.sdmp, yakuza.arm4.elf, 5559.1.00007fff5416d000.00007fff5418e000.rw-.sdmp	Binary or memory string: =+.x86_64/usr/bin/qemu-arm/tmp/yakuza.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.arm4.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: yakuza.arm4.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: yakuza.arm4.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5535.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5516.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5559.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5480.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: yakuza.arm4.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: yakuza.arm4.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5535.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5516.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5559.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5480.1.00007f8224017000.00007f822402a000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "45.135.194.39:5555"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.arm4.elf	67%	Virustotal		Browse
yakuza.arm4.elf	72%	ReversingLabs	Linux.Trojan.Gafgyt
yakuza.arm4.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.135.194.39:5555	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	yakuza.arm4.elf	false	high
http://www.billybobbot.com/crawler/)	yakuza.arm4.elf	false	high
http://fast.no/support/crawler.asp)	yakuza.arm4.elf	false	high
http://feedback.redkolibri.com/	yakuza.arm4.elf	false	high
http://www.baidu.com/search/spider.htm)	yakuza.arm4.elf	false	high
http://0.0.0.0/bins.sh;	yakuza.arm4.elf	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.135.194.39	unknown	Germany		213030	SKYLINKCZ	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.135.194.39	yakuza.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	yakuza.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	yakuza.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	yakuza.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	yakuza.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	.5r3fqt67ew531has4231.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	.5r3fqt67ew531has4231.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	.5r3fqt67ew531has4231.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	.5r3fqt67ew531has4231.dbg.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	162.213.35.24
	.5r3fqt67ew531has4231.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	.5r3fqt67ew531has4231.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYLINKCZ	yakuza.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.135.194.39
	yakuza.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.135.194.39
	yakuza.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.135.194.39
	yakuza.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.135.194.39
	yakuza.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.135.194.39
	yakuza.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.135.194.39
	Sakura.sh.bin	Get hash	malicious	Unknown	Browse	45.135.194.28
	Sakura.sh.bin	Get hash	malicious	Unknown	Browse	45.135.194.28
	na.elf	Get hash	malicious	Prometei	Browse	45.135.194.29
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	45.135.194.29

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.9616920590801366
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.arm4.elf
File size:	109'446 bytes
MD5:	9e2b447d2a412553c548ac654e6d0206
SHA1:	f8c1742d12c49585720f3d0555c8b64732d1c4a1
SHA256:	b3b6026514267391ee8a829523322b8e7603dba28b8625141b9c09d6918d0ea8
SHA512:	1cd7c939e33b7bc22f929df554927cd134560f8bc7da9d74d42647a0294b3ac59cb9848239d5e53d791df0c041f55af25b979221ecad0c78054b07f8b9d228c3
SSDEEP:	3072:pqDUOulvQ+nozmuCoJraQSZki5h8jbOwSfTll7HoDQHDVpZAlvm:eJrkei5h8jbe7HoDQHDVpZAlvm
TLSH:	34B30901FC404B27C7D267BBF79A438D77366658ABD7331266296EF02BC17982E39160
File Content Preview:	.ELF...a..........(.........4....=......4. ...(......................#...#...............#...#...#......@i..........Q.td..................................-...L."....<..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	81296
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0xf2f4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x173a4	0xf3a4	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x173b8	0xf3b8	0x2ffc	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1a3b4	0x123b4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x223b8	0x123b8	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x223c0	0x123c0	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x223c8	0x123c8	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x223cc	0x123cc	0x5ac	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x22978	0x12978	0x6380	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x12978	0xbd4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x13550	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x135f0	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x138fc	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x13960	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x13c48	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x13ce8	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x140b0	0x45f0	0x10	0x0		19	627	4
.strtab	STRTAB	0x0	0x186a0	0x24e6	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x123b8	0x123b8	6.1138	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x123b8	0x223b8	0x223b8	0x5c0	0x6940	3.5762	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x173a4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x173b8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1a3b4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x223b8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x223c0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x223c8	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x223cc	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x22978	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x173a4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173b0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x17368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1739c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x173b4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x852c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa2bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xada4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe24c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf01c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf09c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf30c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf82c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf83c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1100c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1155c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1158c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1226c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1240c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1303c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1320c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1325c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1327c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1433c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1447c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14db4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ccc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1716c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17228	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x223b8	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x223c0	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x223d4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17398	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x223d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x223dc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x912c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x928c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9c08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc218	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeb48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf15c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22614	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x2261c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf38c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf55c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf798	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf838	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf8e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22624	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1935c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xffd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10740	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x110f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1166c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22760	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22868	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11c8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11db0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22880	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f88	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22934	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2294c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1317c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22950	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x28c00	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x13208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1349c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a2d0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1463c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15678	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2295c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x159fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15bc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ea8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x162d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16690	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16cdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f20	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
Laligned	.symtab	0x10958	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10974	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x229b0	16384	OBJECT	<unknown>	DEFAULT	10
SendHTTP	.symtab	0xd034	364	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xc254	340	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0xc874	1652	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0xc3a8	1228	FUNC	<unknown>	DEFAULT	2
SendWGET	.symtab	0xd1a0	192	FUNC	<unknown>	DEFAULT	2
TelnetIPRanges	.symtab	0xa2bc	1016	FUNC	<unknown>	DEFAULT	2
TelnetScanner	.symtab	0xaadc	6008	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0xe090	168	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x223bc	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x223b8	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x22614	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x18d4c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x22950	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x19fba	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x2261c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1904c	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x223c4	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x223c0	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1a3b4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1a3b4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x22614	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x18d4c	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x22950	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x19fba	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x2261c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1904c	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x22618	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x22954	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x22620	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0xf384	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x16d78	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x10d6c	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x13200	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xee80	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0xf0f4	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x12a88	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x12b38	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x10d80	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xef44	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x11adc	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x12260	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x12260	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x15a04	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xef98	44	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x12f34	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xefc4	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x11474	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x12f60	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x28c00	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x124a0	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x12f8c	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1240c	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x13338	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xee80	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x134b8	56	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1447c	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x16d78	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x15ccc	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x15d60	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x15a88	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xeff0	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10764	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x15a94	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x15aa0	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10798	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x16d78	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0xf01c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x12fb8	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x12fe4	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x13010	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x110bc	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x11100	884	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1303c	24	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xf044	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0xf09c	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x13054	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x28c04	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x11098	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x14db4	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1108c	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1100c	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x16438	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x160c4	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x12060	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x13080	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x10f10	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xf0c8	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x16ce0	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x14b00	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10860	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x14af0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x14bfc	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x14c14	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10870	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x130d0	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xf0f4	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x130fc	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x15a5c	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x159c8	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x11c28	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x11f04	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x15df8	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xf190	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x114d0	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x13128	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xf1bc	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x114fc	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x11528	52	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0xf1ec	104	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0xf254	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0xf280	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1155c	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x11e44	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x12de0	228	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x115b8	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x13180	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x12534	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1158c	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xf390	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x11f94	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x16ea8	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x10e68	156	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x10990	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x109b8	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10910	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10910	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10ac0	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x15fc8	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10930	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x15eb0	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x10adc	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x10b94	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x14d74	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x15f78	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x10c74	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x10f04	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x14d00	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1226c	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x126d8	944	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10f30	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xf2d8	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x16d44	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xf350	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x12ed0	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xf3c4	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x131d4	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xf304	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1320c	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1327c	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1325c	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xf30c	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x223c8	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x223c8	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x17228	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0xee2c	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x17350	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0xee2c	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0xeb6c	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0xec64	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x28bf4	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x22934	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x115b8	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x28cf8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x22978	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x22978	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x12b00	56	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x22618	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x22954	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x22620	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x28c24	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x223cc	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x168a8	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x16fcc	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x16780	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x12f04	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x12f00	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xee2c	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x17228	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x14ea0	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x17368	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x223d0	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x16f24	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x16698	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x16838	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x28cf8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x28bec	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0xf384	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x12ef4	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x28be4	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x16d78	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x223b8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x223b8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x15980	72	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1303c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x10d6c	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x13200	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x11920	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x119e8	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x119b4	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x119d4	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x223b8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x223b8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x17098	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x16894	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xefc4	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x11474	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0xf150	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xee80	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xeff0	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0xf044	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x16ce0	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x130d0	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xf0f4	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x15a5c	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xf190	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x114d0	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xf1bc	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x114fc	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x11528	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x12de0	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x28be8	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x12128	312	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0xf304	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xf30c	44	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x22760	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x28bc8	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x28cb4	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0xed48	228	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0xee30	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x28cdc	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x28ce8	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x16984	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x156ac	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x28bf0	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x223b8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x223b8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x12afc	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x159c8	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x169b8	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x2295c	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x28bf8	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x28ccc	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x28cec	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x11694	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x116b8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x11670	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x22630	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x170e4	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x134f0	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x15bd0	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x138a4	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0xf82c	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1935c	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x17140	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x15c9c	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1716c	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x139dc	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xf8f4	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x22634	4	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x15a40	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x12f08	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x12a88	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x12b38	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x12b94	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2294c	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0xeb6c	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0xec7c	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x12ed0	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x10d80	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x28cf8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xf924	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x159e0	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x28cf0	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x28cf4	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x22978	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x28cf8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x28c00	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0xef44	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x173a4	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x269d4	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xf970	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x13cd4	1640	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x28c04	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x13ae0	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x14660	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xffe8	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x102a0	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x10080	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x100b8	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x10254	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x12afc	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x12afc	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x28c34	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x135ac	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xf7bc	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x22638	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x2263c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x1433c	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x269d0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x22654	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x269cc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x22670	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0xf83c	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2266c	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x12274	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x13b50	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1942c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x13b84	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xf9f4	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x11adc	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xef6c	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x8798	112	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x2243c	64	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x224f0	44	OBJECT	<unknown>	DEFAULT	9
atoi	.symtab	0x12260	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x12260	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x10850	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x28be0	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x28bfc	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x15a04	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x115b8	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x289d8	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x289e8	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x2260c	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1739c	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0xef98	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x12f34	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xefc4	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x223dc	4	OBJECT	<unknown>	DEFAULT	9
completed.2555	.symtab	0x22978	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x11474	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x97f8	640	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x84fc	48	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x852c	96	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x83f4	216	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x84cc	48	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0xf150	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xa714	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x2251c	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x223d8	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x12f60	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x28bec	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x28c00	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x124a0	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x12f8c	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1240c	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1a2d0	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x2247c	44	OBJECT	<unknown>	DEFAULT	9
fclose	.symtab	0x13338	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xee80	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x134b8	56	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x1447c	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x16d78	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x15ccc	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x15d60	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1a2bc	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x15a88	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x223cc	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x22974	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0xeff0	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x10764	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x11830	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x15a94	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x15a94	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x15aa0	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10798	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x81cc	28	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0xe138	276	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x9438	100	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0xa6b4	96	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x9f0c	944	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x8760	56	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x16d78	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0xf01c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x12fb8	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x12fe4	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x13010	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x110bc	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x11100	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x1303c	24	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xf044	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0xf070	44	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0xf09c	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x114a0	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x13054	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4900	.symtab	0x28bb4	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x28c04	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x10fd4	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x10ff8	20	FUNC	<unknown>	DEFAULT	2
i.4276	.symtab	0x22610	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x109b8	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x11098	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x14db4	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x1108c	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1100c	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x16438	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x162d4	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x160c4	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x15ff8	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xdf08	392	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81e8	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x22764	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x11d30	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x12060	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x13080	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5057	.symtab	0x229a6	4	OBJECT	<unknown>	DEFAULT	10
ipState.5159	.symtab	0x229aa	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x10f10	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xf338	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xf0c8	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9a78	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x16ce0	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x229a0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xe24c	2336	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x22994	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0xa97c	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x949c	136	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x116dc	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x9d9c	368	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x14b00	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x10860	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x14af0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x14bfc	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x14c14	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x10870	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x269b0	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x22868	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x22880	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x28c08	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x130d0	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x9c10	396	FUNC	<unknown>	DEFAULT	2
next_start.1066	.symtab	0x289d4	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x10f9c	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x10fc0	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x22998	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x2297c	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0xf0f4	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x28c28	4	OBJECT	<unknown>	DEFAULT	10
p.2553	.symtab	0x223d4	0	OBJECT	<unknown>	DEFAULT	9
payload	.symtab	0x223e0	4	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0xf474	256	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x28c30	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x130fc	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x15a5c	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0xf574	584	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x269c8	4	OBJECT	<unknown>	DEFAULT	10
prctl	.symtab	0xf160	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x19384	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8d40	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8968	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8b58	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x89d4	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xd260	3240	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x19398	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x159c8	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x11c24	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82bc	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x11c28	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x19f88	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x11f04	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x228b4	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x15df8	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0xf190	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x86b4	172	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x858c	296	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x114d0	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x9524	724	FUNC	<unknown>	DEFAULT	2
reset_telstate	.symtab	0x8808	48	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x13128	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x28c2c	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0xaa90	76	FUNC	<unknown>	DEFAULT	2
select	.symtab	0xf1bc	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x114fc	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x11528	52	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0xf1ec	104	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0xf254	44	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0xf280	44	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1155c	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x11ca4	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x11e44	192	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0xf2ac	44	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x12de0	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x115b8	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x13180	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x12534	420	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1158c	44	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 41
• 5555 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 13:01:17.377585888 CET	59014	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:18.391957045 CET	59014	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:20.407675982 CET	59014	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:24.503793001 CET	59014	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:32.695656061 CET	59014	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:48.823630095 CET	59014	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:52.414985895 CET	59016	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:53.432332039 CET	59016	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:55.447701931 CET	59016	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:01:59.575710058 CET	59016	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:07.767693996 CET	59016	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:23.895725012 CET	59016	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:27.444628000 CET	59018	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:28.471694946 CET	59018	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:30.487790108 CET	59018	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:34.647691965 CET	59018	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:42.839639902 CET	59018	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:02:58.967624903 CET	59018	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:02.479546070 CET	59020	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:03.512007952 CET	59020	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:05.527753115 CET	59020	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:09.719801903 CET	59020	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:17.911667109 CET	59020	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:34.039706945 CET	59020	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:37.519433022 CET	59022	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:38.519669056 CET	59022	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:40.535689116 CET	59022	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:44.791549921 CET	59022	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:03:52.983804941 CET	59022	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:09.111746073 CET	59022	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:12.553339005 CET	59024	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:13.559616089 CET	59024	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:15.575728893 CET	59024	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:19.607687950 CET	59024	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:27.799650908 CET	59024	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:43.927731037 CET	59024	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:47.590859890 CET	59026	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:48.599786043 CET	59026	5555	192.168.2.13	45.135.194.39
Mar 20, 2025 13:04:50.615686893 CET	59026	5555	192.168.2.13	45.135.194.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 13:04:00.712616920 CET	36453	53	192.168.2.13	1.1.1.1
Mar 20, 2025 13:04:00.712670088 CET	50100	53	192.168.2.13	1.1.1.1
Mar 20, 2025 13:04:00.813577890 CET	53	36453	1.1.1.1	192.168.2.13
Mar 20, 2025 13:04:00.813612938 CET	53	50100	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2025 13:04:00.712616920 CET	192.168.2.13	1.1.1.1	0xb7be	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 13:04:00.712670088 CET	192.168.2.13	1.1.1.1	0x77c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2025 13:04:00.813577890 CET	1.1.1.1	192.168.2.13	0xb7be	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Mar 20, 2025 13:04:00.813577890 CET	1.1.1.1	192.168.2.13	0xb7be	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: yakuza.arm4.elf PID: 5434, Parent PID: 5355

General

Start time (UTC):	12:01:16
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	/tmp/yakuza.arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5436, Parent PID: 5434

General

Start time (UTC):	12:01:16
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5438, Parent PID: 5436

General

Start time (UTC):	12:01:16
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5444, Parent PID: 5438

General

Start time (UTC):	12:01:16
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5480, Parent PID: 5444

General

Start time (UTC):	12:01:51
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5499, Parent PID: 5480

General

Start time (UTC):	12:02:26
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5516, Parent PID: 5499

General

Start time (UTC):	12:03:01
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5535, Parent PID: 5516

General

Start time (UTC):	12:03:37
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5559, Parent PID: 5535

General

Start time (UTC):	12:04:12
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5576, Parent PID: 5559

General

Start time (UTC):	12:04:47
Start date (UTC):	20/03/2025
Path:	/tmp/yakuza.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.arm4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: yakuza.arm4.elf PID: 5434, Parent PID: 5355

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: yakuza.arm4.elf PID: 5436, Parent PID: 5434

General

Process Activities

Linux Analysis Report
yakuza.arm4.elf