Edit tour

Linux Analysis Report
cron.elf

Overview

General Information

Sample name:	cron.elf
Analysis ID:	1645508
MD5:	99fbacf0e2dfc254c5d633c5df7cce00
SHA1:	fd25ac8a06b0cfdae3484e30b861b6c048b7a6f4
SHA256:	f4809ab199cdfe7731e84bfb5db88169d619b0916d8391e657b045c0c49ed181
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	84
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1645508
Start date and time:	2025-03-21 21:01:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	cron.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/1@0/0

Warnings

VT rate limit hit for: 93.115.172.234:6667

Runtime Messages

Command:	/tmp/cron.elf
PID:	6247
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

cron.elf (PID: 6247, Parent: 6169, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/cron.elf

cron.elf New Fork (PID: 6249, Parent: 6247)

cron.elf New Fork (PID: 6251, Parent: 6249)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
cron.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
cron.elf	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xcbcc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00

Memory Dumps

Source	Rule	Description	Author	Strings
6247.1.00007fea08001000.00007fea0800f000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xcbcc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
6249.1.00007fea08001000.00007fea0800f000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xcbcc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cron.elf

Avira: detected

Found malware configuration

Source: cron.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "93.115.172.234:6667"}

Multi AV Scanner detection for submitted file

Source: cron.elf

ReversingLabs: Detection: 72%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/cron.elf (PID: 6247)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:57290 -> 93.115.172.234:6667

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: cron.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 6247.1.00007fea08001000.00007fea0800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 6249.1.00007fea08001000.00007fea0800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown

Source: cron.elf	ELF static info symbol of initial sample: passwords
Source: cron.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample

String containing 'busybox' found: /bin/busybox;echo -e '\147\141\171\146\147\164'

Source: cron.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 6247.1.00007fea08001000.00007fea0800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 6249.1.00007fea08001000.00007fea0800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/1@0/0

Source: cron.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/brk.S
Source: cron.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crt1.S
Source: cron.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crti.S
Source: cron.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crtn.S
Source: cron.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/vfork.S

Source: /tmp/cron.elf (PID: 6247)

Queries kernel information via 'uname':

Jump to behavior

Source: cron.elf, 6247.1.000055d562cb9000.000055d562d69000.rw-.sdmp, cron.elf, 6249.1.000055d562cb9000.000055d562d69000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: cron.elf, 6247.1.00007ffc265e2000.00007ffc26603000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.FqvSdy\Tu
Source: cron.elf, 6247.1.000055d562cb9000.000055d562d69000.rw-.sdmp, cron.elf, 6249.1.000055d562cb9000.000055d562d69000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: cron.elf, 6247.1.00007ffc265e2000.00007ffc26603000.rw-.sdmp, cron.elf, 6249.1.00007ffc265e2000.00007ffc26603000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: cron.elf, 6247.1.00007ffc265e2000.00007ffc26603000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.FqvSdy
Source: cron.elf, 6247.1.00007ffc265e2000.00007ffc26603000.rw-.sdmp, cron.elf, 6249.1.00007ffc265e2000.00007ffc26603000.rw-.sdmp	Binary or memory string: f=x86_64/usr/bin/qemu-ppc/tmp/cron.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/cron.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: cron.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: cron.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "93.115.172.234:6667"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cron.elf	72%	ReversingLabs	Linux.Trojan.Gafgyt
cron.elf	100%	Avira	LINUX/Gafgyt.cond

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
93.115.172.234:6667	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
93.115.172.234:6667	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.115.172.234	unknown	Romania	39531	ALTER-NET-ASZorilorNr11SfGheorgheRO	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.115.172.234	pftp.elf	Get hash	malicious	Gafgyt	Browse
	sh.elf	Get hash	malicious	Gafgyt	Browse
	sshd.elf	Get hash	malicious	Gafgyt	Browse
	ftp.elf	Get hash	malicious	Gafgyt	Browse
	tftp.elf	Get hash	malicious	Gafgyt	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	sh.elf	Get hash	malicious	Gafgyt	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	jwyt4py98x.m68k.elf	Get hash	malicious	Mirai	Browse
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse
	jwyt4py98x.mips.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
91.189.91.42	sh.elf	Get hash	malicious	Gafgyt	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	jwyt4py98x.m68k.elf	Get hash	malicious	Mirai	Browse
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse
	jwyt4py98x.mips.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	sh.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	jwyt4py98x.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x.rar.elf	Get hash	malicious	Xmrig	Browse	185.125.190.26
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	jwyt4py98x.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
CANONICAL-ASGB	sh.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	jwyt4py98x.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x.rar.elf	Get hash	malicious	Xmrig	Browse	185.125.190.26
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	jwyt4py98x.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
ALTER-NET-ASZorilorNr11SfGheorgheRO	pftp.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	sh.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	sshd.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	ftp.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	tftp.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	Ravateb.pdf.exe	Get hash	malicious	Unknown	Browse	89.46.233.239
	pp.dd.exe	Get hash	malicious	Unknown	Browse	93.115.172.125
	RPV.exe	Get hash	malicious	I2PRAT	Browse	93.115.172.125
	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse	93.115.172.41
	pXlV6TKi3E.exe	Get hash	malicious	Sality	Browse	89.46.234.189
INIT7CH	sh.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	jwyt4py98x.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	jwyt4py98x.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.FqvSdy (deleted)

Download File

Process:	/tmp/cron.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.861126097384873
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	cron.elf
File size:	72'870 bytes
MD5:	99fbacf0e2dfc254c5d633c5df7cce00
SHA1:	fd25ac8a06b0cfdae3484e30b861b6c048b7a6f4
SHA256:	f4809ab199cdfe7731e84bfb5db88169d619b0916d8391e657b045c0c49ed181
SHA512:	2127298920b5a42a4c2f36ef4f4468edd8ec2a14b7bf0f9d75392d9b2826bb37582b9540eeabaac972c5d091dac84aca82b5aca20dd396de6d6e065f31c0e971
SSDEEP:	1536:JiGeggaG5O/uYyOGtO8AO8CD792EmBWJCluw:8f1bYyOGtO8AO8CxG
TLSH:	6A63D68BB72C076FC5AB5BB11CB727F1DB69ED2102A641C4E50AFB840BB25745432B39
File Content Preview:	.ELF...........................4.........4. ...(..........................................................e.........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?..........4..../...@..\?........+../...A..$8...})......N..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	57292
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	14

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000b8	0xb8	0xc32c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1000c3e4	0xc3e4	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1000c404	0xc404	0xff4	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1000d3f8	0xd3f8	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x1001d3fc	0xd3fc	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1001d404	0xd404	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x1001d40c	0xd40c	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x1001d410	0xd410	0x374	0x0	0x3	WA	0	0	8
.sdata	PROGBITS	0x1001d784	0xd784	0x3c	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x1001d7c0	0xd7c0	0x74	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x1001d834	0xd7c0	0x60dc	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0xd7c0	0x798	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xdf58	0x73	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xe274	0x21c0	0x10	0x0		16	183	4
.strtab	STRTAB	0x0	0x10434	0x1872	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0xd3fc	0xd3fc	5.7908	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0xd3fc	0x1001d3fc	0x1001d3fc	0x3c4	0x6514	3.0212	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000b8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1000c3e4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1000c404	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1000d3f8	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1001d3fc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x1001d404	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1001d40c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x1001d410	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x1001d784	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1001d7c0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1001d834	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
Q	.symtab	0x1001d850	16384	OBJECT	<unknown>	DEFAULT	12
StartTheLelz	.symtab	0x10003724	7352	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_SDA_BASE_	.symtab	0x10025784	0	NOTYPE	<unknown>	DEFAULT	10
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x1001d400	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x1001d3fc	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x1001d78c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1000cda8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x1001d794	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1000d0a8	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x1001d408	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x1001d404	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1000d3f8	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1000d3f8	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x1001d78c	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x1000cda8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x1001d794	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x1000d0a8	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x1001d790	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x1001d798	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x10008f70	12	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x100091b8	292	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1000892c	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x100089b0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x10008c80	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1000adc0	148	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1000aec0	128	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x10008a14	60	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1000bd5c	336	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1000a86c	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x1000a86c	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1000bec8	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x10008a50	72	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x10008a98	72	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10009b34	52	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x10008ae0	72	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x1001d81c	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x1000aab8	308	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1000b228	72	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1000aa34	132	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1000892c	132	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x100089b0	100	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x10008b28	72	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x100092dc	92	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1000bf44	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1000bf54	284	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10009338	184	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x10008b70	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1000b270	72	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1000b2b8	72	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1000b300	72	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x10008ba8	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x10008bf0	72	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x10009b68	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1000b348	72	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x1001d820	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x10009b00	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1000bbd8	192	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x10009acc	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x10009a50	124	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1000a784	232	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x10008834	232	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x10009814	44	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x10008c38	72	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1000c2f8	128	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1000b8cc	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x100093f0	156	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1000b9d4	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1000ba08	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1000948c	144	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1000b390	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x10008c80	120	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x10008d08	72	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x100091b8	292	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1000c2c8	48	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1000a338	108	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1000a610	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1000c1c4	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10008d50	72	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x10009bd8	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1000b3d8	112	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x10008d98	72	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x10009c10	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x10009c48	64	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x10008de0	72	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10009c88	60	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1000a51c	244	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1000bc98	196	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x10009cf8	76	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x10009d44	44	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10009d70	224	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x10008e28	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1000abec	468	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x10009cc4	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1000a6a0	228	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1000951c	256	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1000961c	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1000961c	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10009650	32	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10009670	164	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1000bb9c	60	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1000c27c	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x10009714	244	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x10009808	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1000bafc	160	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1000a878	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10009840	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x100098dc	356	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x10008ea0	72	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x10008f50	32	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x1000891c	16	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1000b448	72	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x10008ee8	8	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x10008ef0	72	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x1001d40c	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x1001d40c	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x1001d810	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x1001d754	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x10009d70	224	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x1001d7c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1000ae60	96	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1001d790	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x1001d798	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x1001d830	4	OBJECT	<unknown>	DEFAULT	11
__data_start	.symtab	0x1001d418	0	NOTYPE	<unknown>	DEFAULT	9
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x1000c378	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000b8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x1001d410	0	OBJECT	<unknown>	HIDDEN	9
__environ	.symtab	0x1001d808	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x10008f70	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x1001d800	4	OBJECT	<unknown>	HIDDEN	11
__fini_array_end	.symtab	0x1001d3fc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x1001d3fc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x100091b8	292	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__heap_alloc	.symtab	0x1000a120	160	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1000a208	300	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x1000a1c0	44	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1000a1ec	28	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x1001d3fc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x1001d3fc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x10008a98	72	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10009b34	52	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x10008cf8	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1000892c	132	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x100089b0	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x10008b28	72	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x10008ba8	72	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1000c2f8	128	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1000b390	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x10008c80	120	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10008d50	72	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x10009bd8	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x10008d98	72	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x10009c10	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x10009c48	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1000bc98	196	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x1001d804	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x10008ee8	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x10008ef0	72	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x1001d7b8	4	OBJECT	<unknown>	DEFAULT	10
__malloc_heap_lock	.symtab	0x10023860	24	OBJECT	<unknown>	DEFAULT	12
__malloc_sbrk_lock	.symtab	0x100238f8	24	OBJECT	<unknown>	DEFAULT	12
__pagesize	.symtab	0x1001d80c	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x1001d3fc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x1001d3fc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x1000ae54	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1000ae54	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1000ae54	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1000ae54	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1000ae54	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x1000ae5c	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x1000c2c8	48	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__rtld_fini	.symtab	0x1001d814	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x10009e78	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10009ea0	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x10009e50	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x1000b1e0	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x1001d7a8	4	OBJECT	<unknown>	DEFAULT	10
__stdio_WRITE	.symtab	0x1000b490	224	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1000c070	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1000b570	364	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x10009098	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3862	.symtab	0x1000d3a8	24	OBJECT	<unknown>	DEFAULT	4
__stdio_seek	.symtab	0x1000c16c	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1000b6dc	248	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x10009168	80	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x1001d7ac	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x1000b1ac	52	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1000befc	72	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x1000adc0	148	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1000aec0	128	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1000af40	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1001d7bc	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x1000891c	16	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x1000beac	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x1001d828	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x1001d82c	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x1001d7c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x10023910	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x1001d81c	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x10008a14	60	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1000c3e4	16	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x10021850	8192	OBJECT	<unknown>	DEFAULT	12
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x1001d820	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x10000094	16	FUNC	<unknown>	DEFAULT	1
_pthread_cleanup_pop_restore	.symtab	0x1000ae5c	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1000ae5c	4	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x10023878	128	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x100001f0	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_init	.symtab	0x10009024	116	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x1001d7b0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x1001d474	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_del_count	.symtab	0x1001d7f8	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x1001d48c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x1001d7f4	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x1001d4a4	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x100090a8	192	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x1001d7b4	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x1000a880	436	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1000b7d4	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1000bd5c	336	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x1000a86c	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1000a86c	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x1001d824	4	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2829	.symtab	0x1001d818	4	OBJECT	<unknown>	DEFAULT	11
brk	.symtab	0x1000bec8	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x10009d70	224	FUNC	<unknown>	DEFAULT	2
buf.2641	.symtab	0x10023850	16	OBJECT	<unknown>	DEFAULT	12
c	.symtab	0x1001d46c	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1000c3c8	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1000014c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001d4	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x10008a50	72	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x10008a98	72	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x1001d784	4	OBJECT	<unknown>	DEFAULT	10
completed.3069	.symtab	0x1001d834	1	OBJECT	<unknown>	DEFAULT	12
connect	.symtab	0x10009b34	52	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x10002234	656	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x10008cf8	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x10003388	320	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x1001d788	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x1001d418	0	NOTYPE	<unknown>	DEFAULT	9
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x10008ae0	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x1001d808	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x1001d81c	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x1000aab8	308	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x1000b228	72	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1000aa34	132	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1000892c	132	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x100089b0	100	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x10001708	232	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x1001d7e0	4	OBJECT	<unknown>	DEFAULT	11
fdpclose	.symtab	0x10001568	416	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x100012bc	684	FUNC	<unknown>	DEFAULT	2
fork	.symtab	0x10008b28	72	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x100091b8	292	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x100092dc	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10000168	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1000a020	256	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1000bf44	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1000bf44	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1000bf54	284	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10009338	184	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBogos	.symtab	0x10001b5c	536	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x10007dcc	40	FUNC	<unknown>	DEFAULT	2
getCores	.symtab	0x10001d74	216	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10001a64	124	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x10007b34	664	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x10003318	112	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x10002cb8	1632	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x10008b70	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x1000b270	72	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1000b2b8	72	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x1000b300	72	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x10008ba8	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x10008bf0	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x10009b68	52	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x10009b9c	60	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1000b348	72	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x1001d7c4	4	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x1001d820	4	OBJECT	<unknown>	DEFAULT	11
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x1000c4b4	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x10009a48	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x10009a4c	4	FUNC	<unknown>	DEFAULT	2
i.4237	.symtab	0x1001d470	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x1000951c	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x10009b00	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1000bbd8	192	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x10009acc	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x10009a50	124	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10007994	416	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x10000238	232	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x1001d598	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x1000a428	136	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1000a784	232	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x10008834	232	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState	.symtab	0x1001d7d8	5	OBJECT	<unknown>	DEFAULT	11
isatty	.symtab	0x10009814	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x10008f38	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x10008c38	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/brk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x100024c4	456	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x1000c2f8	128	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x1001d7d0	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x10007df4	2624	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x1001d7c0	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x100035d8	236	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x10001e4c	188	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x10009ec8	344	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x1000283c	420	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x1000b8cc	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x100093f0	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x1000b9d4	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x1000ba08	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1000948c	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x1001d6a0	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x1001d76c	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x1000b390	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x1000268c	432	FUNC	<unknown>	DEFAULT	2
next_start.1106	.symtab	0x1001d7fc	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x10009a40	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x10009a44	4	FUNC	<unknown>	DEFAULT	2
numpids	.symtab	0x1001d7c8	8	OBJECT	<unknown>	DEFAULT	11
object.3150	.symtab	0x1001d838	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x10008c80	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x1001d7e8	4	OBJECT	<unknown>	DEFAULT	11
p.3067	.symtab	0x1001d414	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x100017f0	144	FUNC	<unknown>	DEFAULT	2
passwords	.symtab	0x1001d434	56	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x1001d7f0	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x10008d08	72	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
print	.symtab	0x100009f8	1564	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x100005d4	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x100007f8	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10000654	420	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x10006bc4	3536	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x100091b8	292	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x10008f7c	168	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
raise	.symtab	0x1000c2c8	48	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1000a334	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10000320	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1000a338	108	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1000d3c0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1000a610	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x1001d6d4	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x1000c1c4	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10008d50	72	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readUntil	.symtab	0x100029e0	728	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x10009bd8	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x10001f08	812	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x1000b3d8	112	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x1001d7ec	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x100036c4	96	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x10008d98	72	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x10009c10	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x100065a0	1572	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x1000602c	1396	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0x100059d4	1624	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x100053dc	1528	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x10009c48	64	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x10008de0	72	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x10009c88	60	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1000a3a4	132	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1000a51c	244	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x1000bc98	196	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x10009cf8	76	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x10009d44	44	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x10009d70	224	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x10008e28	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1000abec	468	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x10009cc4	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sockprintf	.symtab	0x10001170	332	FUNC	<unknown>	DEFAULT	2
srand	.symtab	0x1000a4b0	108	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x1000a4b0	108	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x1000a6a0	228	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x1001d7a4	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x1001d79c	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x1001d7a0	4	OBJECT	<unknown>	DEFAULT	10
strchr	.symtab	0x1000951c	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x1000961c	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x1000961c	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x10009650	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strlen	.symtab	0x10009670	164	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x1000bb9c	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x1000c27c	76	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x10009714	244	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x10009808	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x1000bafc	160	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1000a878	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x100010c0	176	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x10009840	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x100034c8	272	FUNC	<unknown>	DEFAULT	2
tcsetattr	.symtab	0x100098dc	356	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x10008ea0	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x10008f50	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x10000478	348	FUNC	<unknown>	DEFAULT	2
unsafe_state	.symtab	0x1001d6b8	28	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x10001ae0	124	FUNC	<unknown>	DEFAULT	2
usernames	.symtab	0x1001d41c	24	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x1000891c	16	FUNC	<unknown>	DEFAULT	2
wait4	.symtab	0x1000b448	72	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x10008ee8	8	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x10001880	484	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x10008ef0	72	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
zprintf	.symtab	0x10001014	172	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 49
• 6667 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 21:02:37.771099091 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2025 21:02:38.213768959 CET	57290	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:02:38.394444942 CET	6667	57290	93.115.172.234	192.168.2.23
Mar 21, 2025 21:02:43.142441988 CET	42836	443	192.168.2.23	91.189.91.43
Mar 21, 2025 21:02:43.403625011 CET	57292	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:02:43.570235968 CET	6667	57292	93.115.172.234	192.168.2.23
Mar 21, 2025 21:02:44.166256905 CET	42516	80	192.168.2.23	109.202.202.202
Mar 21, 2025 21:02:48.572355032 CET	57294	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:02:48.746433020 CET	6667	57294	93.115.172.234	192.168.2.23
Mar 21, 2025 21:02:53.749306917 CET	57296	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:02:53.918515921 CET	6667	57296	93.115.172.234	192.168.2.23
Mar 21, 2025 21:02:57.988270998 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2025 21:02:58.921550989 CET	57298	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:02:59.103128910 CET	6667	57298	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:04.106187105 CET	57300	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:04.273051023 CET	6667	57300	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:09.276679039 CET	57302	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:09.452284098 CET	6667	57302	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:10.274457932 CET	42836	443	192.168.2.23	91.189.91.43
Mar 21, 2025 21:03:14.369899988 CET	42516	80	192.168.2.23	109.202.202.202
Mar 21, 2025 21:03:14.455724001 CET	57304	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:14.634093046 CET	6667	57304	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:19.637271881 CET	57306	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:19.816039085 CET	6667	57306	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:24.821064949 CET	57308	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:24.998817921 CET	6667	57308	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:30.005062103 CET	57310	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:30.183182955 CET	6667	57310	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:35.188679934 CET	57312	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:35.353229046 CET	6667	57312	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:38.942384005 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2025 21:03:40.357753038 CET	57314	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:40.533075094 CET	6667	57314	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:45.536622047 CET	57316	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:45.712035894 CET	6667	57316	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:50.714636087 CET	57318	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:50.885422945 CET	6667	57318	93.115.172.234	192.168.2.23
Mar 21, 2025 21:03:55.887553930 CET	57320	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:03:56.057987928 CET	6667	57320	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:01.060683966 CET	57322	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:01.236923933 CET	6667	57322	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:06.238737106 CET	57324	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:06.411117077 CET	6667	57324	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:11.412416935 CET	57326	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:11.585999966 CET	6667	57326	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:16.587686062 CET	57328	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:16.763600111 CET	6667	57328	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:21.765508890 CET	57330	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:21.940738916 CET	6667	57330	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:26.942239046 CET	57332	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:27.109908104 CET	6667	57332	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:32.112186909 CET	57334	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:32.284403086 CET	6667	57334	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:37.285847902 CET	57336	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:37.459150076 CET	6667	57336	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:42.460325003 CET	57338	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:42.624449968 CET	6667	57338	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:47.625885963 CET	57340	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:47.793261051 CET	6667	57340	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:52.795135975 CET	57342	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:52.958828926 CET	6667	57342	93.115.172.234	192.168.2.23
Mar 21, 2025 21:04:57.960167885 CET	57344	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:04:58.135246992 CET	6667	57344	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:03.136991024 CET	57346	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:03.314443111 CET	6667	57346	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:08.315557003 CET	57348	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:08.492665052 CET	6667	57348	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:13.494142056 CET	57350	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:13.664386034 CET	6667	57350	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:18.665988922 CET	57352	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:18.844275951 CET	6667	57352	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:23.847819090 CET	57354	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:24.020209074 CET	6667	57354	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:29.022326946 CET	57356	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:29.189481020 CET	6667	57356	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:34.190947056 CET	57358	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:34.361560106 CET	6667	57358	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:39.363437891 CET	57360	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:39.541193962 CET	6667	57360	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:44.543020964 CET	57362	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:44.712507010 CET	6667	57362	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:49.714684010 CET	57364	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:49.886765957 CET	6667	57364	93.115.172.234	192.168.2.23
Mar 21, 2025 21:05:54.888407946 CET	57366	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:05:55.062392950 CET	6667	57366	93.115.172.234	192.168.2.23
Mar 21, 2025 21:06:00.064656973 CET	57368	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:06:00.236335039 CET	6667	57368	93.115.172.234	192.168.2.23
Mar 21, 2025 21:06:05.237992048 CET	57370	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:06:05.404721022 CET	6667	57370	93.115.172.234	192.168.2.23
Mar 21, 2025 21:06:10.407535076 CET	57372	6667	192.168.2.23	93.115.172.234
Mar 21, 2025 21:06:10.578094959 CET	6667	57372	93.115.172.234	192.168.2.23

System Behavior

Analysis Process: cron.elf PID: 6247, Parent PID: 6169

General

Start time (UTC):	20:02:37
Start date (UTC):	21/03/2025
Path:	/tmp/cron.elf
Arguments:	/tmp/cron.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: cron.elf PID: 6249, Parent PID: 6247

General

Start time (UTC):	20:02:37
Start date (UTC):	21/03/2025
Path:	/tmp/cron.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: cron.elf PID: 6251, Parent PID: 6249

General

Start time (UTC):	20:02:37
Start date (UTC):	21/03/2025
Path:	/tmp/cron.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report cron.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.FqvSdy (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: cron.elf PID: 6247, Parent PID: 6169

General

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: cron.elf PID: 6249, Parent PID: 6247

General

Linux Analysis Report
cron.elf