Edit tour

Linux Analysis Report
ftp.elf

Overview

General Information

Sample name:	ftp.elf
Analysis ID:	1645502
MD5:	08cca37a09762e4f5450f6bad61466a8
SHA1:	ee90f21d30436ffc4bc2b1abaaf63b24c5f0a229
SHA256:	cc02b6ace8e617b947080de8fbf1c984be8866ebe476af65d77c0d2d6a21c93e
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	84
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1645502
Start date and time:	2025-03-21 20:56:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ftp.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 93.115.172.234:6667

Runtime Messages

Command:	/tmp/ftp.elf
PID:	5495
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	MAC: EC:F4:BB:61:AE:30
Standard Error:

Process Tree

system is lnxubuntu20

ftp.elf (PID: 5495, Parent: 5418, MD5: 08cca37a09762e4f5450f6bad61466a8) Arguments: /tmp/ftp.elf

ftp.elf New Fork (PID: 5496, Parent: 5495)

ftp.elf New Fork (PID: 5497, Parent: 5496)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ftp.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
ftp.elf	Linux_Trojan_Gafgyt_6321b565	unknown	unknown	0x23f8:$a: D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF
ftp.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x54a:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
ftp.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x81f1:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
ftp.elf	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x165f:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
ftp.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x2cf:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
ftp.elf	Linux_Trojan_Gafgyt_71e487ea	unknown	unknown	0x4480:$a: E0 8B 45 D8 8B 04 D0 8D 50 01 83 EC 0C 8D 85 40 FF FF FF 50
ftp.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x5e7:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
ftp.elf	Linux_Trojan_Gafgyt_20f5e74f	unknown	unknown	0x494c:$a: D8 8B 45 D0 8B 04 D0 8D 50 01 83 EC 0C 8D 85 38 FF FF FF 50 8D 85 40 FF
ftp.elf	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0x9b4c:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
ftp.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x7ec4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Click to see the 6 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6321b565	unknown	unknown	0x23f8:$a: D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x54a:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x81f1:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x165f:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x2cf:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_71e487ea	unknown	unknown	0x4480:$a: E0 8B 45 D8 8B 04 D0 8D 50 01 83 EC 0C 8D 85 40 FF FF FF 50
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x5e7:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_20f5e74f	unknown	unknown	0x494c:$a: D8 8B 45 D0 8B 04 D0 8D 50 01 83 EC 0C 8D 85 38 FF FF FF 50 8D 85 40 FF
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0x9b4c:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
5495.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x7ec4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6321b565	unknown	unknown	0x23f8:$a: D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x54a:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x81f1:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x165f:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x2cf:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_71e487ea	unknown	unknown	0x4480:$a: E0 8B 45 D8 8B 04 D0 8D 50 01 83 EC 0C 8D 85 40 FF FF FF 50
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x5e7:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_20f5e74f	unknown	unknown	0x494c:$a: D8 8B 45 D0 8B 04 D0 8D 50 01 83 EC 0C 8D 85 38 FF FF FF 50 8D 85 40 FF
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0x9b4c:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
5496.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x7ec4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ftp.elf

Avira: detected

Found malware configuration

Source: ftp.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "93.115.172.234:6667"}

Multi AV Scanner detection for submitted file

Source: ftp.elf

ReversingLabs: Detection: 69%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/ftp.elf (PID: 5495)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.14:39378 -> 93.115.172.234:6667

Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6321b565 Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_71e487ea Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_20f5e74f Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_71e487ea Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_20f5e74f Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_71e487ea Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_20f5e74f Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown

Source: ftp.elf	ELF static info symbol of initial sample: passwords
Source: ftp.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample

String containing 'busybox' found: /bin/busybox;echo -e '\147\141\171\146\147\164'

Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6321b565 reference_sample = cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07, id = 6321b565-ed25-4bf2-be4f-3ffa0e643085, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_71e487ea reference_sample = b8d044f2de21d20c7e4b43a2baf5d8cdb97fba95c3b99816848c0f214515295b, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8df69968ddfec5821500949015192b6cdbc188c74f785a272effd7bc9707f661, id = 71e487ea-a592-469c-a03e-0c64d2549e74, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_20f5e74f reference_sample = 9084b00f9bb71524987dc000fb2bc6f38e722e2be2832589ca4bb1671e852f5b, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 070fe0d678612b4ec8447a07ead0990a0abd908ce714388720e7fd7055bf1175, id = 20f5e74f-9f94-431b-877c-9b0d78a1d4eb, last_modified = 2021-09-16
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: ftp.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 reference_sample = cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07, id = 6321b565-ed25-4bf2-be4f-3ffa0e643085, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_71e487ea reference_sample = b8d044f2de21d20c7e4b43a2baf5d8cdb97fba95c3b99816848c0f214515295b, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8df69968ddfec5821500949015192b6cdbc188c74f785a272effd7bc9707f661, id = 71e487ea-a592-469c-a03e-0c64d2549e74, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_20f5e74f reference_sample = 9084b00f9bb71524987dc000fb2bc6f38e722e2be2832589ca4bb1671e852f5b, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 070fe0d678612b4ec8447a07ead0990a0abd908ce714388720e7fd7055bf1175, id = 20f5e74f-9f94-431b-877c-9b0d78a1d4eb, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 5495.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 reference_sample = cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07, id = 6321b565-ed25-4bf2-be4f-3ffa0e643085, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_71e487ea reference_sample = b8d044f2de21d20c7e4b43a2baf5d8cdb97fba95c3b99816848c0f214515295b, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8df69968ddfec5821500949015192b6cdbc188c74f785a272effd7bc9707f661, id = 71e487ea-a592-469c-a03e-0c64d2549e74, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_20f5e74f reference_sample = 9084b00f9bb71524987dc000fb2bc6f38e722e2be2832589ca4bb1671e852f5b, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 070fe0d678612b4ec8447a07ead0990a0abd908ce714388720e7fd7055bf1175, id = 20f5e74f-9f94-431b-877c-9b0d78a1d4eb, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 5496.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@2/0

Source: ftp.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: ftp.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: ftp.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: ftp.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: ftp.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: ftp.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: ftp.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "93.115.172.234:6667"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ftp.elf	69%	ReversingLabs	Linux.Trojan.Gafgyt
ftp.elf	100%	Avira	LINUX/Gafgyt.cona

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
93.115.172.234:6667	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
93.115.172.234	unknown	Romania		39531	ALTER-NET-ASZorilorNr11SfGheorgheRO	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.115.172.234	tftp.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	tftp.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	jwyt4py98x.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	.main.elf	Get hash	malicious	Xmrig	Browse	162.213.35.25
	jwyt4py98x.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jwyt4py98x.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jwyt4py98x.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jwyt4py98x.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	miner.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	ht-jupit.elf	Get hash	malicious	Poseidon	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALTER-NET-ASZorilorNr11SfGheorgheRO	tftp.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	Ravateb.pdf.exe	Get hash	malicious	Unknown	Browse	89.46.233.239
	pp.dd.exe	Get hash	malicious	Unknown	Browse	93.115.172.125
	RPV.exe	Get hash	malicious	I2PRAT	Browse	93.115.172.125
	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse	93.115.172.41
	pXlV6TKi3E.exe	Get hash	malicious	Sality	Browse	89.46.234.189
	boatnet.x86	Get hash	malicious	Mirai	Browse	89.46.238.151
	jRBdJBRpya	Get hash	malicious	Mirai	Browse	89.46.234.98

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.27010507404679
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ftp.elf
File size:	60'887 bytes
MD5:	08cca37a09762e4f5450f6bad61466a8
SHA1:	ee90f21d30436ffc4bc2b1abaaf63b24c5f0a229
SHA256:	cc02b6ace8e617b947080de8fbf1c984be8866ebe476af65d77c0d2d6a21c93e
SHA512:	3bf03f62156419aec1ff0aaedfbfa4481d7d1f10165e5ff199687644dc08a9a4762e77ef026ca509d190f7cd45d1a9beb96e1fb07cd39f4279986e12448a8fe3
SSDEEP:	1536:n4RB1ffMQgZ9yEj1VyFTx8o5Ayl6/p3Az9AGRjngqX:n4t0Q+9yEj1VSjmkzm6
TLSH:	2C5316847658D9F7C12203F10693ABDC073AFD3609BAED15F3183CB49A71098BA3A765
File Content Preview:	.ELF....................d...4...........4. ...(..............................................5...5.......g..........Q.td............................U..S.......G....h........[]...$.............U......=.8...t..5.....6......6......u........t....h.%..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	45304
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0x92e8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8051398	0x9398	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x80513c0	0x93c0	0x120a	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x80525cc	0xa5cc	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x80535d0	0xa5d0	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x80535d8	0xa5d8	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x80535e0	0xa5e0	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x80535e4	0xa5e4	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8053600	0xa600	0x2dc	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x80538e0	0xa8dc	0x64c0	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0xa8dc	0x7aa	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xb086	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xb378	0x21e0	0x10	0x0		15	181	4
.strtab	STRTAB	0x0	0xd558	0x187f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xa5d0	0xa5d0	6.2812	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0xa5d0	0x80535d0	0x80535d0	0x30c	0x67d0	3.6781	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8051398	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80513c0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x80525cc	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x80535d0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x80535d8	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x80535e0	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x80535e4	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8053600	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x80538e0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
Q	.symtab	0x8053920	16384	OBJECT	<unknown>	DEFAULT	11
StartTheLelz	.symtab	0x8049ef6	6480	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x80535e4	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x80535d4	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x80535d0	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8053680	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8051d20	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8053688	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8052020	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x80535dc	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x80535d8	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x80525cc	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x80525cc	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8053680	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x8051d20	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8053688	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x8052020	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x8053684	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x805368c	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804e73c	6	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x804e8ec	197	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804e284	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804e2dc	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x804e4f8	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8050530	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80505a7	64	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804e31c	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x804fba8	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8050040	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x8050040	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8051060	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804e344	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x805092c	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804e374	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804ed14	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x804e3a4	50	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8059974	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x80501f0	105	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8050960	54	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8050188	103	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804e284	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804e2dc	63	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804e3d8	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804e9b4	51	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8051098	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80510b4	227	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804e9e8	116	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804e400	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8050998	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80509c0	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x80509e8	38	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8050a10	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804e428	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x804e450	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804ed40	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8050a24	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8059978	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x804ecec	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8050fa0	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x804ecd7	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x804ec88	79	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x804ff92	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804e484	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x804ebd0	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804e4c4	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x805130c	95	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8050e24	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804ea5c	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8050e48	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8050e6c	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804ea84	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x80508a0	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8050a4c	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8050a80	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804e4f8	75	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x804e55c	46	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x804e8ec	197	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8051034	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x804fcc4	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x804fe9d	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8051274	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804e58c	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804eda8	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8050ab4	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804e5c4	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804eddc	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x804ee10	67	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804e604	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804ee54	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x804fe04	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80507af	217	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x804eebc	42	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x804eee8	25	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804ef04	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804e62c	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x805025c	393	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804ee90	43	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x804fefc	150	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804ea9c	30	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804eabc	27	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804ead8	19	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8050f78	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80512d8	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804eaec	198	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804ebb4	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8050f1c	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8050054	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x80503e8	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x804ebf0	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804e684	46	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804e71c	29	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x804e26c	21	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8050b04	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804e6b4	26	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804e6d0	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x80535e0	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x80535e0	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8059968	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x80538c0	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x804ef04	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80538dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8050573	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x8053684	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x805368c	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805997c	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x8053608	0	NOTYPE	<unknown>	DEFAULT	10
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x8051370	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8053600	0	OBJECT	<unknown>	HIDDEN	10
__environ	.symtab	0x8059960	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804e73c	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8059958	4	OBJECT	<unknown>	HIDDEN	11
__fini_array_end	.symtab	0x80535d0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x80535d0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x804e8ec	197	FUNC	<unknown>	DEFAULT	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8050a10	19	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x80535d0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x80535d0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x804e374	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804ed14	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x804e543	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804e284	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804e2dc	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804e3d8	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804e428	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x805130c	95	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8050a80	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804e4f8	75	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804e58c	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804eda8	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804e5c4	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804eddc	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x804ee10	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80507af	217	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805995c	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804e6b4	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804e6d0	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x804f841	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804f018	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80537d0	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x8059a20	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x804f7b4	141	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x8059964	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x80535d0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x80535d0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x805056f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x805056f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x805056f	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x805056f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x805056f	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x8050572	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8051034	24	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore	.symtab	0x80507a7	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x80507a0	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805996c	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x804efd8	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804eff8	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804efb4	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80508bc	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x805369c	4	OBJECT	<unknown>	DEFAULT	10
__stdio_WRITE	.symtab	0x8050b40	126	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8051198	168	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8050bc0	240	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804e821	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3991	.symtab	0x8052320	24	OBJECT	<unknown>	DEFAULT	4
__stdio_seek	.symtab	0x8051240	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8050cb0	158	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804e8c0	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x80536a0	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x8050888	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x80508f0	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8050530	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80505a7	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80505e7	441	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80538d8	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x804e26c	21	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x805104c	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8059d98	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x8059d9c	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80538dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8059da0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x8059974	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804e31c	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8051398	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8057940	8192	OBJECT	<unknown>	DEFAULT	11
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8059978	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_pthread_cleanup_pop_restore	.symtab	0x8050572	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8050572	1	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x80599a0	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048164	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_init	.symtab	0x804e7c0	97	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80536a4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x80536a8	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_count	.symtab	0x8057928	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x80536c0	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x8057924	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x80536e0	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804e838	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80536d8	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x8050070	277	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8050d50	209	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x804fba8	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x8050040	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8050040	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8059954	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2832	.symtab	0x8059970	1	OBJECT	<unknown>	DEFAULT	11
brk	.symtab	0x8051060	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804ef04	175	FUNC	<unknown>	DEFAULT	2
buf.2658	.symtab	0x8059944	16	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x8053678	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x804e344	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x805092c	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804e374	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x8053620	4	OBJECT	<unknown>	DEFAULT	10
completed.2429	.symtab	0x80538e0	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x804ed14	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x804932c	456	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x804e543	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049ce6	168	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x8053624	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x8053608	0	NOTYPE	<unknown>	DEFAULT	10
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x804e3a4	50	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x8059960	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x8059974	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x80501f0	105	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8050960	54	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8050188	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804e284	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804e2dc	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8048c51	104	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x8057920	4	OBJECT	<unknown>	DEFAULT	11
fdpclose	.symtab	0x8048aed	356	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x80488f7	502	FUNC	<unknown>	DEFAULT	2
fork	.symtab	0x804e3d8	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x804e8ec	197	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804e9b4	51	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804f9e9	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8051098	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8051098	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80510b4	227	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x804e9e8	116	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBogos	.symtab	0x8048ea1	439	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x804da3b	10	FUNC	<unknown>	DEFAULT	2
getCores	.symtab	0x8049058	172	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048e33	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804d832	521	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x8049cb6	48	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x80499b5	769	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x804e400	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8050998	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80509c0	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x80509e8	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8050a10	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804e428	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x804e450	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804ed40	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804ed6c	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8050a24	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8053904	4	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x8059978	4	OBJECT	<unknown>	DEFAULT	11
hextable	.symtab	0x8051460	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x804ec6c	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x804ec60	12	FUNC	<unknown>	DEFAULT	2
i.4251	.symtab	0x805367c	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x804ea9c	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804ecec	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8050fa0	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x804ecd7	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x804ec88	79	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804d6fd	309	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8048188	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x804fd69	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x804ff92	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804e484	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState	.symtab	0x8053916	5	OBJECT	<unknown>	DEFAULT	11
isatty	.symtab	0x804ebd0	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x804e708	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804e4c4	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x80494f4	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x805130c	95	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8053910	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804da45	2087	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x8053900	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x8049e49	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8049104	103	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x804f03e	1908	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x804fb85	34	FUNC	<unknown>	DEFAULT	2
matchPrompt	.symtab	0x80496fb	257	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x8050e24	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x804ea5c	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8050e48	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8050e6c	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804ea84	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x80508a0	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x8050a4c	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x80537e8	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8053800	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x8050a80	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x8049600	251	FUNC	<unknown>	DEFAULT	2
next_start.1109	.symtab	0x8059940	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x804ec7f	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x804ec73	12	FUNC	<unknown>	DEFAULT	2
numpids	.symtab	0x8053908	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x80538e4	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804e4f8	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x8059980	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x8053604	0	OBJECT	<unknown>	DEFAULT	10
parseHex	.symtab	0x8048cb9	68	FUNC	<unknown>	DEFAULT	2
passwords	.symtab	0x8053640	56	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x8059988	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x804e55c	46	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
print	.symtab	0x804859c	584	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8048366	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048477	293	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x80483a0	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804c9cf	3374	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x804e8ec	197	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x804e744	124	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
raise	.symtab	0x8051034	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x804fcbc	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80481f7	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x804fcc4	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8052340	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x804fe9d	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8053840	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8051274	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804e58c	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readUntil	.symtab	0x80497fc	441	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x804eda8	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x804916b	449	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x8050ab4	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x8059984	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x8049ec7	47	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x804e5c4	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804eddc	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x804c5df	1008	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x804c234	939	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0x804bca2	1426	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x804b846	1116	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x804ee10	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804e604	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804ee54	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x804fd0c	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x804fe04	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80507af	217	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x804eebc	42	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x804eee8	25	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x804ef04	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804e62c	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x805025c	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804ee90	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sockprintf	.symtab	0x804882a	205	FUNC	<unknown>	DEFAULT	2
srand	.symtab	0x804fdc0	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x804fdc0	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x804fefc	150	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x8053698	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x8053690	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x8053694	4	OBJECT	<unknown>	DEFAULT	10
strchr	.symtab	0x804ea9c	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcpy	.symtab	0x804eabc	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strlen	.symtab	0x804ead8	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8050f78	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80512d8	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804eaec	198	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x804ebb4	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8050f1c	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8050054	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x80503e8	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x8048806	36	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x804ebf0	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x8049d8e	187	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804e684	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804e71c	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x80482b7	175	FUNC	<unknown>	DEFAULT	2
unsafe_state	.symtab	0x8053818	28	OBJECT	<unknown>	DEFAULT	10
uppercase	.symtab	0x8048e6e	51	FUNC	<unknown>	DEFAULT	2
usernames	.symtab	0x8053628	24	OBJECT	<unknown>	DEFAULT	10
vfork	.symtab	0x804e26c	21	FUNC	<unknown>	DEFAULT	2
wait4	.symtab	0x8050b04	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804e6b4	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x8048cfd	310	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x804e6d0	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
zprintf	.symtab	0x80487e4	34	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 45
• 6667 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 20:57:42.165334940 CET	39378	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:57:42.343111038 CET	6667	39378	93.115.172.234	192.168.2.14
Mar 21, 2025 20:57:47.344333887 CET	39380	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:57:47.509536982 CET	6667	39380	93.115.172.234	192.168.2.14
Mar 21, 2025 20:57:52.510704994 CET	39382	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:57:52.680854082 CET	6667	39382	93.115.172.234	192.168.2.14
Mar 21, 2025 20:57:57.682151079 CET	39384	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:57:57.852447033 CET	6667	39384	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:02.853930950 CET	39386	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:03.031301022 CET	6667	39386	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:08.032646894 CET	39388	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:08.209750891 CET	6667	39388	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:13.211519003 CET	39390	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:13.392009974 CET	6667	39390	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:18.393426895 CET	39392	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:18.568284035 CET	6667	39392	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:23.570350885 CET	39394	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:23.746721029 CET	6667	39394	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:28.748421907 CET	39396	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:28.926552057 CET	6667	39396	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:33.928909063 CET	39398	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:34.100375891 CET	6667	39398	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:39.102268934 CET	39400	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:39.277482033 CET	6667	39400	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:44.278913975 CET	39402	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:44.450963020 CET	6667	39402	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:49.452632904 CET	39404	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:49.628375053 CET	6667	39404	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:54.630332947 CET	39406	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:54.804191113 CET	6667	39406	93.115.172.234	192.168.2.14
Mar 21, 2025 20:58:59.806091070 CET	39408	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:58:59.975542068 CET	6667	39408	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:04.977473974 CET	39410	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:05.154129982 CET	6667	39410	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:10.157113075 CET	39412	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:10.334547997 CET	6667	39412	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:15.337337971 CET	39414	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:15.510185957 CET	6667	39414	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:20.514353037 CET	39416	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:20.685364962 CET	6667	39416	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:25.687983036 CET	39418	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:26.699282885 CET	39418	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:26.878258944 CET	6667	39418	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:31.880301952 CET	39420	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:32.059304953 CET	6667	39420	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:37.061372042 CET	39422	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:37.240588903 CET	6667	39422	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:42.242156029 CET	39424	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:42.411834002 CET	6667	39424	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:47.413216114 CET	39426	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:47.584414959 CET	6667	39426	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:52.585700035 CET	39428	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:52.763586998 CET	6667	39428	93.115.172.234	192.168.2.14
Mar 21, 2025 20:59:57.765415907 CET	39430	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 20:59:57.945733070 CET	6667	39430	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:02.947577953 CET	39432	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:03.128448009 CET	6667	39432	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:08.130569935 CET	39434	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:08.308357954 CET	6667	39434	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:13.310241938 CET	39436	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:13.486020088 CET	6667	39436	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:18.487667084 CET	39438	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:18.667453051 CET	6667	39438	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:23.669976950 CET	39440	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:23.845570087 CET	6667	39440	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:28.860407114 CET	39442	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:29.031213999 CET	6667	39442	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:34.033776999 CET	39444	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:34.207308054 CET	6667	39444	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:39.208962917 CET	39446	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:39.379947901 CET	6667	39446	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:44.381895065 CET	39448	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:44.559468985 CET	6667	39448	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:49.561757088 CET	39450	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:49.737966061 CET	6667	39450	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:54.740129948 CET	39452	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:00:54.906465054 CET	6667	39452	93.115.172.234	192.168.2.14
Mar 21, 2025 21:00:59.908448935 CET	39454	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:01:00.078860044 CET	6667	39454	93.115.172.234	192.168.2.14
Mar 21, 2025 21:01:05.080861092 CET	39456	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:01:05.252176046 CET	6667	39456	93.115.172.234	192.168.2.14
Mar 21, 2025 21:01:10.254265070 CET	39458	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:01:10.426831007 CET	6667	39458	93.115.172.234	192.168.2.14
Mar 21, 2025 21:01:15.428204060 CET	39460	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:01:15.598882914 CET	6667	39460	93.115.172.234	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 21:00:26.206444979 CET	54371	53	192.168.2.14	1.1.1.1
Mar 21, 2025 21:00:26.206497908 CET	44829	53	192.168.2.14	1.1.1.1
Mar 21, 2025 21:00:26.309231043 CET	53	44829	1.1.1.1	192.168.2.14
Mar 21, 2025 21:00:26.312903881 CET	53	54371	1.1.1.1	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 21, 2025 21:00:26.206444979 CET	192.168.2.14	1.1.1.1	0xc717	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 21, 2025 21:00:26.206497908 CET	192.168.2.14	1.1.1.1	0xb126	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 21, 2025 21:00:26.312903881 CET	1.1.1.1	192.168.2.14	0xc717	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Mar 21, 2025 21:00:26.312903881 CET	1.1.1.1	192.168.2.14	0xc717	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ftp.elf PID: 5495, Parent PID: 5418

General

Start time (UTC):	19:57:40
Start date (UTC):	21/03/2025
Path:	/tmp/ftp.elf
Arguments:	/tmp/ftp.elf
File size:	60887 bytes
MD5 hash:	08cca37a09762e4f5450f6bad61466a8

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: ftp.elf PID: 5496, Parent PID: 5495

General

Start time (UTC):	19:57:41
Start date (UTC):	21/03/2025
Path:	/tmp/ftp.elf
Arguments:	-
File size:	60887 bytes
MD5 hash:	08cca37a09762e4f5450f6bad61466a8

Process Activities

Process Forked

Chronological Activities

Analysis Process: ftp.elf PID: 5497, Parent PID: 5496

General

Start time (UTC):	19:57:41
Start date (UTC):	21/03/2025
Path:	/tmp/ftp.elf
Arguments:	-
File size:	60887 bytes
MD5 hash:	08cca37a09762e4f5450f6bad61466a8

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ftp.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ftp.elf PID: 5495, Parent PID: 5418

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: ftp.elf PID: 5496, Parent PID: 5495

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: ftp.elf PID: 5497, Parent PID: 5496

General

Process Activities

Linux Analysis Report
ftp.elf