Edit tour

Linux Analysis Report
wget.elf

Overview

General Information

Sample name:	wget.elf
Analysis ID:	1645510
MD5:	d22d580c17f65c1cec1120b194ab453d
SHA1:	427ef13913305d613d8b1e60fe9723f6a3c1272c
SHA256:	f23f8bc8abf0a224ae81ba8620e89ae3e018c0d4f0cfa7b67ef18b2d6fcd42b7
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	84
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1645510
Start date and time:	2025-03-21 21:05:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wget.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 93.115.172.234:6667

Runtime Messages

Command:	/tmp/wget.elf
PID:	5477
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	MAC: EC:F4:BB:61:AE:30
Standard Error:

Process Tree

system is lnxubuntu20

wget.elf (PID: 5477, Parent: 5399, MD5: d22d580c17f65c1cec1120b194ab453d) Arguments: /tmp/wget.elf

wget.elf New Fork (PID: 5478, Parent: 5477)

wget.elf New Fork (PID: 5479, Parent: 5478)

dash New Fork (PID: 5549, Parent: 3632)

rm (PID: 5549, Parent: 3632, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.fWOb9WKTDA /tmp/tmp.9ijiu0TQHx /tmp/tmp.pBTa6aCfnW

dash New Fork (PID: 5550, Parent: 3632)

rm (PID: 5550, Parent: 3632, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.fWOb9WKTDA /tmp/tmp.9ijiu0TQHx /tmp/tmp.pBTa6aCfnW

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wget.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
wget.elf	Linux_Trojan_Gafgyt_83715433	unknown	unknown	0xf41:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
wget.elf	Linux_Trojan_Gafgyt_6321b565	unknown	unknown	0x26ce:$a: D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF
wget.elf	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x2d3:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
wget.elf	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0xe18:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
wget.elf	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0xe58:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
wget.elf	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x560:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
wget.elf	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x11f4:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
wget.elf	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xa06c:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_83715433	unknown	unknown	0xf41:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6321b565	unknown	unknown	0x26ce:$a: D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x2d3:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0xe18:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0xe58:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x560:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x11f4:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5478.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xa06c:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_83715433	unknown	unknown	0xf41:$a: 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6321b565	unknown	unknown	0x26ce:$a: D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_6122acdf	unknown	unknown	0x2d3:$a: E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0xe18:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0xe58:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x560:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_9127f7be	unknown	unknown	0x11f4:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
5477.1.0000000008048000.0000000008053000.r-x.sdmp	Linux_Trojan_Gafgyt_fb14e81f	unknown	unknown	0xa06c:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wget.elf

Avira: detected

Found malware configuration

Source: wget.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "93.115.172.234:6667"}

Multi AV Scanner detection for submitted file

Source: wget.elf	Virustotal: Detection: 64%			Perma Link
Source: wget.elf	ReversingLabs: Detection: 69%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/wget.elf (PID: 5477)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.14:39376 -> 93.115.172.234:6667

Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.172.234

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown	Network traffic detected: HTTP traffic on port 34590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37924
Source: unknown	Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6321b565 Author: unknown
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown

Source: wget.elf	ELF static info symbol of initial sample: passwords
Source: wget.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample

String containing 'busybox' found: /bin/busybox;echo -e '\147\141\171\146\147\164'

Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6321b565 reference_sample = cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07, id = 6321b565-ed25-4bf2-be4f-3ffa0e643085, last_modified = 2021-09-16
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: wget.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 reference_sample = cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07, id = 6321b565-ed25-4bf2-be4f-3ffa0e643085, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5478.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_83715433 reference_sample = 3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9, id = 83715433-3dff-4238-8cdb-c51279565e05, last_modified = 2021-09-16
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6321b565 reference_sample = cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07, id = 6321b565-ed25-4bf2-be4f-3ffa0e643085, last_modified = 2021-09-16
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6122acdf os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212, id = 6122acdf-1eef-45ea-83ea-699d21c2dc20, last_modified = 2021-09-16
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
Source: 5477.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@2/0

Source: wget.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: wget.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: wget.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: wget.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: wget.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Source: /usr/bin/dash (PID: 5549)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.fWOb9WKTDA /tmp/tmp.9ijiu0TQHx /tmp/tmp.pBTa6aCfnW			Jump to behavior
Source: /usr/bin/dash (PID: 5550)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.fWOb9WKTDA /tmp/tmp.9ijiu0TQHx /tmp/tmp.pBTa6aCfnW			Jump to behavior

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: wget.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: wget.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "93.115.172.234:6667"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wget.elf	65%	Virustotal		Browse
wget.elf	69%	ReversingLabs	Linux.Trojan.Gafgyt
wget.elf	100%	Avira	LINUX/Gafgyt.cona

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
93.115.172.234:6667	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
54.217.10.153	unknown	United States	16509	AMAZON-02US	false
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false
93.115.172.234	unknown	Romania	39531	ALTER-NET-ASZorilorNr11SfGheorgheRO	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	na.elf	Get hash	malicious	Prometei	Browse
	jwyt4py98x.mips.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	conf.png	Get hash	malicious	Tsunami	Browse
	miner.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
54.217.10.153	main_x86_64.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	46.19.143.26-mips-2025-03-01T06_09_25.elf	Get hash	malicious	Unknown	Browse
	dlr.sh4.elf	Get hash	malicious	Unknown	Browse
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	miner.elf	Get hash	malicious	Unknown	Browse
	psmips.elf	Get hash	malicious	Unknown	Browse
	yakuza.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	jkse.arm7.elf	Get hash	malicious	Mirai	Browse
185.125.190.26	x.rar.elf	Get hash	malicious	Xmrig	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	46.19.143.26-mips-2025-03-01T06_09_25.elf	Get hash	malicious	Unknown	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	hiss.mips.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
93.115.172.234	cron.elf	Get hash	malicious	Gafgyt	Browse
	apache2.elf	Get hash	malicious	Gafgyt	Browse
	openssh.elf	Get hash	malicious	Gafgyt	Browse
	pftp.elf	Get hash	malicious	Gafgyt	Browse
	sh.elf	Get hash	malicious	Gafgyt	Browse
	sshd.elf	Get hash	malicious	Gafgyt	Browse
	ftp.elf	Get hash	malicious	Gafgyt	Browse
	tftp.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	apache2.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	openssh.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	pftp.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	sshd.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	ftp.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	tftp.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	jwyt4py98x.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	.main.elf	Get hash	malicious	Xmrig	Browse	162.213.35.25
	jwyt4py98x.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jwyt4py98x.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALTER-NET-ASZorilorNr11SfGheorgheRO	cron.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	apache2.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	openssh.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	pftp.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	sh.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	sshd.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	ftp.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	tftp.elf	Get hash	malicious	Gafgyt	Browse	93.115.172.234
	Ravateb.pdf.exe	Get hash	malicious	Unknown	Browse	89.46.233.239
	pp.dd.exe	Get hash	malicious	Unknown	Browse	93.115.172.125
CANONICAL-ASGB	cron.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	sh.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	jwyt4py98x.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x.rar.elf	Get hash	malicious	Xmrig	Browse	185.125.190.26
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	jwyt4py98x.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
AMAZON-02US	openssh.elf	Get hash	malicious	Gafgyt	Browse	54.247.62.1
	YG.ps1	Get hash	malicious	FormBook	Browse	13.248.169.48
	STEPH.ps1	Get hash	malicious	FormBook	Browse	13.248.169.48
	GUYBIN.ps1	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://mail.notifyvisitors.com/tracker/email_tracker/handler/click/51260/13866?cd=aktPMUFtRXRLeXhOT3pUYzZJeEw1Y2ptMzBDSDJkYm1IWEdmNk5GVEFvVlRyN1FMVjdQUFEyWmpkUURtQndBMnJ2Nk1iOWtYSEJQY0UzY1NodklLd05WQ2RtaG9SSHJrL0FGZk40Y0FNdlNwczAxdFp6WXI5b3h4WVZPOW12Rko0UDhwS1dPb3A0T3pCTXdxU210Y3dvWDIwaTFZZ2ZBeEUxRDFYQnVINmR2blI0TExHM2wrcEtIYTJqL3lWWXBKOVhQTHo3ZHVlLzZxTGdvZXhPc1owZUFrZFllSEFjWStwZGkyMlVaQzFidzBpU2ZBTW5wTjhFWW5SUmlxQXVQOVVPZE1UOVRNREs4WSttZkNXeEhmdS9ncktZaC9VTzZLbERPTjNzSVp0cm5aZmFkTEV6Vk96d0k4bTZaL3p1QUpsSHEwUHhpWlgrNG11M05SUVVWZUpxVTlTR0svVHQ3clFnZ0lLd29iNS9ERVJWOG8wVnNhK2V3TVdKMVM0RUhSMTZJTFlTKzhKY29TWk9WY3lwOFlOWS9ySXRWcVhtcHY0STFKVE9oUHpGSFkzcXhpalJnOGNTRFVBTDBBVHU4cDJGZURnN2k3VEsyQVkvL0gxQm90cmtZYXRmVmpub0tERDBsU0hZSlUzUmlnMGZtR0ZPbW1lOVpMRHV1WDZDSWpwL3FBWlZ6OW00Y2ZhbEdJd3lUeGpRPT0%3D#?email=test@gotcha.com	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	3.168.73.64
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54
	x.rar.elf	Get hash	malicious	Xmrig	Browse	34.254.182.186
	Scanned Inv#118953-0012345.svg	Get hash	malicious	HTMLPhisher	Browse	13.33.252.45
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
AMAZON-02US	openssh.elf	Get hash	malicious	Gafgyt	Browse	54.247.62.1
	YG.ps1	Get hash	malicious	FormBook	Browse	13.248.169.48
	STEPH.ps1	Get hash	malicious	FormBook	Browse	13.248.169.48
	GUYBIN.ps1	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://mail.notifyvisitors.com/tracker/email_tracker/handler/click/51260/13866?cd=aktPMUFtRXRLeXhOT3pUYzZJeEw1Y2ptMzBDSDJkYm1IWEdmNk5GVEFvVlRyN1FMVjdQUFEyWmpkUURtQndBMnJ2Nk1iOWtYSEJQY0UzY1NodklLd05WQ2RtaG9SSHJrL0FGZk40Y0FNdlNwczAxdFp6WXI5b3h4WVZPOW12Rko0UDhwS1dPb3A0T3pCTXdxU210Y3dvWDIwaTFZZ2ZBeEUxRDFYQnVINmR2blI0TExHM2wrcEtIYTJqL3lWWXBKOVhQTHo3ZHVlLzZxTGdvZXhPc1owZUFrZFllSEFjWStwZGkyMlVaQzFidzBpU2ZBTW5wTjhFWW5SUmlxQXVQOVVPZE1UOVRNREs4WSttZkNXeEhmdS9ncktZaC9VTzZLbERPTjNzSVp0cm5aZmFkTEV6Vk96d0k4bTZaL3p1QUpsSHEwUHhpWlgrNG11M05SUVVWZUpxVTlTR0svVHQ3clFnZ0lLd29iNS9ERVJWOG8wVnNhK2V3TVdKMVM0RUhSMTZJTFlTKzhKY29TWk9WY3lwOFlOWS9ySXRWcVhtcHY0STFKVE9oUHpGSFkzcXhpalJnOGNTRFVBTDBBVHU4cDJGZURnN2k3VEsyQVkvL0gxQm90cmtZYXRmVmpub0tERDBsU0hZSlUzUmlnMGZtR0ZPbW1lOVpMRHV1WDZDSWpwL3FBWlZ6OW00Y2ZhbEdJd3lUeGpRPT0%3D#?email=test@gotcha.com	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	3.168.73.64
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54
	x.rar.elf	Get hash	malicious	Xmrig	Browse	34.254.182.186
	Scanned Inv#118953-0012345.svg	Get hash	malicious	HTMLPhisher	Browse	13.33.252.45
	jwyt4py98x.arm7.elf	Get hash	malicious	Mirai	Browse	34.249.145.219

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.142393181783485
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	wget.elf
File size:	63'479 bytes
MD5:	d22d580c17f65c1cec1120b194ab453d
SHA1:	427ef13913305d613d8b1e60fe9723f6a3c1272c
SHA256:	f23f8bc8abf0a224ae81ba8620e89ae3e018c0d4f0cfa7b67ef18b2d6fcd42b7
SHA512:	44f4452058d376e23fb426c699fb05238ebbe3a94adb66f3c7200aabff681a5ce9d2f44a4c58689d2ba4f8c08fdd3cd4e034db831001bb52a53bed003e393b90
SSDEEP:	1536:ZMsL7rO6tPhCVjMWrj1FnFiYNPTuBvMBzAzAulDgqX:r7rO6tPhCVjMWrjLYwPTuRMlG
TLSH:	50530649B556C5F7C8120BB1029BBDDE0769FD398A7AAE44F3183CF45BB3894392A311
File Content Preview:	.ELF....................h...4...........4. ...(..............................................0...0.......g..........Q.td............................U..S.......w....h........[]...$.............U......=.3...t..1....$0.....$0......u........t...$.*..........3

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	47896
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0x9814	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x80518c4	0x98c4	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x80518e0	0x98e0	0x120a	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8052aec	0xaaec	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8053000	0xb000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8053008	0xb008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8053010	0xb010	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8053014	0xb014	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8053020	0xb020	0x2dc	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x8053300	0xb2fc	0x64c0	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0xb2fc	0x7aa	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xbaa6	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xbd98	0x21e0	0x10	0x0		15	181	4
.strtab	STRTAB	0x0	0xdf78	0x187f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xaaf0	0xaaf0	6.2129	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0xb000	0x8053000	0x8053000	0x2fc	0x67c0	3.7229	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80518c4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80518e0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8052aec	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8053000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8053008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8053010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8053014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8053020	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8053300	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
Q	.symtab	0x8053340	16384	OBJECT	<unknown>	DEFAULT	11
StartTheLelz	.symtab	0x804a19f	6704	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8053014	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8053004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8053000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x80530a0	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8052240	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x80530a8	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8052540	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x805300c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8053008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8052aec	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8052aec	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x80530a0	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x8052240	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x80530a8	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x8052540	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x80530a4	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x80530ac	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804ec18	6	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x804edcc	187	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804e760	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804e7b8	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x804e9d4	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8050a48	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8050abf	64	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x804e7f8	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80500b4	273	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x805054c	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x805054c	20	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8051580	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804e820	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x8050e4c	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804e850	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x804f1f4	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x804e880	50	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8059394	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x8050708	105	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8050e80	54	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x80506a0	103	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804e760	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804e7b8	63	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804e8b4	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x804ee88	49	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x80515b8	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80515d4	231	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x804eebc	120	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804e8dc	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8050eb8	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8050ee0	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8050f08	38	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8050f30	17	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804e904	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x804e92c	50	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x804f220	43	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8050f44	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8059398	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x804f1cc	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80514c0	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x804f1b7	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x804f168	79	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x80504a1	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804e960	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x804f0b0	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804e9a0	50	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x805182c	86	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8051344	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x804ef34	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8051368	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x805138c	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x804ef5c	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8050dc0	27	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8050f6c	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8050fa0	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x804e9d4	75	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x804ea38	46	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x804edcc	187	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8051554	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80501d0	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80503a9	94	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8051794	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x804ea68	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x804f288	51	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8050fd4	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804eaa0	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x804f2bc	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x804f2f0	67	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804eae0	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x804f334	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8050310	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8050ccb	218	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x804f39c	42	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x804f3c8	25	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x804f3e4	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x804eb08	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8050774	393	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x804f370	43	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8050407	154	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x804ef74	30	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x804ef94	27	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x804efb0	19	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8051498	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80517f8	50	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x804efc4	206	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x804f094	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x805143c	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8050560	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8050900	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x804f0d0	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804eb60	46	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804ebf8	29	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x804e748	21	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8051024	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804eb90	26	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804ebac	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8053010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8053010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8059388	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x80532e0	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x804f3e4	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80532fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8050a8b	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x80530a4	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x80530ac	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x805939c	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x8053028	0	NOTYPE	<unknown>	DEFAULT	10
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x8051890	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8053020	0	OBJECT	<unknown>	HIDDEN	10
__environ	.symtab	0x8059380	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804ec18	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8059378	4	OBJECT	<unknown>	HIDDEN	11
__fini_array_end	.symtab	0x8053000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8053000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x804edcc	187	FUNC	<unknown>	DEFAULT	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8050f30	17	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x8053000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8053000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x804e850	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x804f1f4	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x804ea1f	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804e760	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804e7b8	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804e8b4	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804e904	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x805182c	86	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8050fa0	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x804e9d4	75	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x804ea68	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x804f288	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804eaa0	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x804f2bc	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x804f2f0	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8050ccb	218	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x805937c	4	OBJECT	<unknown>	DEFAULT	11
__libc_waitpid	.symtab	0x804eb90	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804ebac	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x804fd4d	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x804f4f8	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x80531f0	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x8059440	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x804fcc0	141	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x8059384	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x8053000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8053000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8050a87	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8050a87	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8050a87	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8050a87	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8050a87	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x8050a8a	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8051554	24	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore	.symtab	0x8050cc3	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8050cbc	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x805938c	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x804f4b8	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x804f4d8	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x804f494	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8050ddc	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x80530bc	4	OBJECT	<unknown>	DEFAULT	10
__stdio_WRITE	.symtab	0x8051060	128	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80516bc	164	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x80510e0	234	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x804ecff	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4160	.symtab	0x8052840	24	OBJECT	<unknown>	DEFAULT	4
__stdio_seek	.symtab	0x8051760	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x80511cc	167	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x804eda0	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x80530c0	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x8050da8	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x8050e10	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8050a48	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8050abf	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8050aff	443	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x80532f8	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x804e748	21	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x805156c	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x80597b8	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x80597bc	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x80532fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x80597c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x8059394	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x804e7f8	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80518c4	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8057360	8192	OBJECT	<unknown>	DEFAULT	11
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8059398	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_pthread_cleanup_pop_restore	.symtab	0x8050a8a	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8050a8a	1	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x80593c0	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048168	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_init	.symtab	0x804ec9c	99	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80530c4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x80530c8	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_count	.symtab	0x8057348	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x80530e0	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x8057344	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x8053100	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x804ed16	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80530f8	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x805057c	289	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8051274	207	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80500b4	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x805054c	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x805054c	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8059374	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.3001	.symtab	0x8059390	1	OBJECT	<unknown>	DEFAULT	11
brk	.symtab	0x8051580	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x804f3e4	175	FUNC	<unknown>	DEFAULT	2
buf.2827	.symtab	0x8059364	16	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x8053098	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x804e820	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x8050e4c	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804e850	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x8053040	4	OBJECT	<unknown>	DEFAULT	10
completed.2429	.symtab	0x8053300	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x804f1f4	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8049419	523	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x804ea1f	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8049f98	159	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x8053044	4	OBJECT	<unknown>	DEFAULT	10
data_start	.symtab	0x8053028	0	NOTYPE	<unknown>	DEFAULT	10
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x804e880	50	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x8059380	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x8059394	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x8050708	105	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8050e80	54	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x80506a0	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804e760	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804e7b8	63	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8048d15	111	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x8057340	4	OBJECT	<unknown>	DEFAULT	11
fdpclose	.symtab	0x8048ba0	373	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x80489ba	486	FUNC	<unknown>	DEFAULT	2
fork	.symtab	0x804e8b4	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x804edcc	187	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x804ee88	49	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x804fef5	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x80515b8	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x80515b8	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80515d4	231	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x804eebc	120	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBogos	.symtab	0x8048f55	450	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x804df1f	10	FUNC	<unknown>	DEFAULT	2
getCores	.symtab	0x8049117	174	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048eef	55	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x804dcfc	547	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x8049f6c	44	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x8049b46	1062	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x804e8dc	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8050eb8	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8050ee0	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8050f08	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8050f30	17	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804e904	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x804e92c	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x804f220	43	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x804f24c	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8050f44	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8053324	4	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x8059398	4	OBJECT	<unknown>	DEFAULT	11
hextable	.symtab	0x8051980	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x804f14d	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x804f140	13	FUNC	<unknown>	DEFAULT	2
i.4251	.symtab	0x805309c	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x804ef74	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x804f1cc	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80514c0	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x804f1b7	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x804f168	79	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x804dbae	334	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x804818c	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8050275	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x80504a1	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804e960	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState	.symtab	0x8053336	5	OBJECT	<unknown>	DEFAULT	11
isatty	.symtab	0x804f0b0	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x804ebe4	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x804e9a0	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8049624	261	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x805182c	86	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8053330	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x804df29	2077	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x8053320	4	OBJECT	<unknown>	DEFAULT	11
makeIPPacket	.symtab	0x804a0ef	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x80491c5	106	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x804f51e	1954	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x8050091	34	FUNC	<unknown>	DEFAULT	2
matchPrompt	.symtab	0x804984c	263	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x8051344	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x804ef34	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8051368	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x805138c	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x804ef5c	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8050dc0	27	FUNC	<unknown>	DEFAULT	2
munmap	.symtab	0x8050f6c	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8053208	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8053220	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x8050fa0	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x8049729	291	FUNC	<unknown>	DEFAULT	2
next_start.1278	.symtab	0x8059360	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x804f161	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x804f154	13	FUNC	<unknown>	DEFAULT	2
numpids	.symtab	0x8053328	8	OBJECT	<unknown>	DEFAULT	11
object.2482	.symtab	0x8053304	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x804e9d4	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x80593a0	4	OBJECT	<unknown>	DEFAULT	11
p.2427	.symtab	0x8053024	0	OBJECT	<unknown>	DEFAULT	10
parseHex	.symtab	0x8048d84	68	FUNC	<unknown>	DEFAULT	2
passwords	.symtab	0x8053060	56	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x80593a8	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x804ea38	46	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
print	.symtab	0x80485c1	722	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8048366	66	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8048482	319	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x80483a8	218	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804ce39	3445	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x804edcc	187	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x804ec20	124	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
raise	.symtab	0x8051554	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80501c8	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x80481fb	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80501d0	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8052860	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80503a9	94	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x8053260	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8051794	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x804ea68	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readUntil	.symtab	0x8049953	499	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x804f288	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x804922f	490	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x8050fd4	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x80593a4	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x804a173	44	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x804eaa0	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x804f2bc	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x804ca12	1063	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x804c632	992	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0x804c06a	1480	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0x804bbcf	1179	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x804f2f0	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x804eae0	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x804f334	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8050218	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8050310	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x8050ccb	218	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x804f39c	42	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x804f3c8	25	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x804f3e4	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x804eb08	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x8050774	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x804f370	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sockprintf	.symtab	0x80488e2	216	FUNC	<unknown>	DEFAULT	2
srand	.symtab	0x80502cc	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80502cc	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8050407	154	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x80530b8	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x80530b0	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x80530b4	4	OBJECT	<unknown>	DEFAULT	10
strchr	.symtab	0x804ef74	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcpy	.symtab	0x804ef94	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strlen	.symtab	0x804efb0	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8051498	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80517f8	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x804efc4	206	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x804f094	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x805143c	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8050560	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x8050900	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x80488bb	39	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x804f0d0	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x804a037	184	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x804eb60	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x804ebf8	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x80482bb	171	FUNC	<unknown>	DEFAULT	2
unsafe_state	.symtab	0x8053238	28	OBJECT	<unknown>	DEFAULT	10
uppercase	.symtab	0x8048f26	47	FUNC	<unknown>	DEFAULT	2
usernames	.symtab	0x8053048	24	OBJECT	<unknown>	DEFAULT	10
vfork	.symtab	0x804e748	21	FUNC	<unknown>	DEFAULT	2
wait4	.symtab	0x8051024	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804eb90	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x8048dc8	295	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x804ebac	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
zprintf	.symtab	0x8048893	40	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 51
• 6667 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 21:06:38.014450073 CET	39376	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:06:38.188672066 CET	6667	39376	93.115.172.234	192.168.2.14
Mar 21, 2025 21:06:42.703258991 CET	34590	443	192.168.2.14	54.217.10.153
Mar 21, 2025 21:06:43.190279961 CET	39378	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:06:43.368585110 CET	6667	39378	93.115.172.234	192.168.2.14
Mar 21, 2025 21:06:48.370062113 CET	39380	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:06:48.537039995 CET	6667	39380	93.115.172.234	192.168.2.14
Mar 21, 2025 21:06:48.847064972 CET	46540	443	192.168.2.14	185.125.190.26
Mar 21, 2025 21:06:53.539273977 CET	39382	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:06:53.709377050 CET	6667	39382	93.115.172.234	192.168.2.14
Mar 21, 2025 21:06:58.711025000 CET	39384	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:06:58.879674911 CET	6667	39384	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:03.881742001 CET	39386	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:04.056922913 CET	6667	39386	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:09.059433937 CET	39388	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:09.234214067 CET	6667	39388	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:11.327085972 CET	37924	443	192.168.2.14	54.171.230.55
Mar 21, 2025 21:07:11.327186108 CET	443	37924	54.171.230.55	192.168.2.14
Mar 21, 2025 21:07:11.327316999 CET	37924	443	192.168.2.14	54.171.230.55
Mar 21, 2025 21:07:11.329454899 CET	37924	443	192.168.2.14	54.171.230.55
Mar 21, 2025 21:07:11.329492092 CET	443	37924	54.171.230.55	192.168.2.14
Mar 21, 2025 21:07:14.236216068 CET	39392	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:14.400830984 CET	6667	39392	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:19.402612925 CET	39394	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:19.574062109 CET	6667	39394	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:19.821578026 CET	46540	443	192.168.2.14	185.125.190.26
Mar 21, 2025 21:07:24.576033115 CET	39396	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:24.750900984 CET	6667	39396	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:29.753273010 CET	39398	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:29.929107904 CET	6667	39398	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:34.931277990 CET	39400	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:35.097965002 CET	6667	39400	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:40.099839926 CET	39402	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:40.268589020 CET	6667	39402	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:45.270535946 CET	39404	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:45.446297884 CET	6667	39404	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:50.448252916 CET	39406	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:50.626514912 CET	6667	39406	93.115.172.234	192.168.2.14
Mar 21, 2025 21:07:55.628391981 CET	39408	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:07:55.793901920 CET	6667	39408	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:00.796004057 CET	39410	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:00.972845078 CET	6667	39410	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:05.974884033 CET	39412	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:06.155261040 CET	6667	39412	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:11.157155991 CET	39414	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:11.324326992 CET	6667	39414	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:11.325438023 CET	37924	443	192.168.2.14	54.171.230.55
Mar 21, 2025 21:08:11.368336916 CET	443	37924	54.171.230.55	192.168.2.14
Mar 21, 2025 21:08:16.327184916 CET	39416	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:16.490289927 CET	6667	39416	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:21.491918087 CET	39418	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:21.667943001 CET	6667	39418	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:26.669743061 CET	39420	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:26.840187073 CET	6667	39420	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:31.841880083 CET	39422	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:32.017949104 CET	6667	39422	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:37.019221067 CET	39424	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:37.188457012 CET	6667	39424	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:42.190665960 CET	39426	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:42.364200115 CET	6667	39426	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:47.366224051 CET	39428	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:47.541614056 CET	6667	39428	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:52.553258896 CET	39430	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:52.727278948 CET	6667	39430	93.115.172.234	192.168.2.14
Mar 21, 2025 21:08:57.729748964 CET	39432	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:08:57.899399042 CET	6667	39432	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:02.901094913 CET	39434	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:03.071039915 CET	6667	39434	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:08.072791100 CET	39436	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:08.243237019 CET	6667	39436	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:13.244808912 CET	39438	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:13.414674997 CET	6667	39438	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:18.416677952 CET	39440	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:18.588408947 CET	6667	39440	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:23.589953899 CET	39442	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:23.760080099 CET	6667	39442	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:28.761569977 CET	39444	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:28.926265955 CET	6667	39444	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:33.927473068 CET	39446	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:34.096992970 CET	6667	39446	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:39.098201036 CET	39448	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:39.271661997 CET	6667	39448	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:44.273565054 CET	39450	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:44.446161985 CET	6667	39450	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:49.448050022 CET	39452	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:49.616540909 CET	6667	39452	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:54.617955923 CET	39454	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:54.788321972 CET	6667	39454	93.115.172.234	192.168.2.14
Mar 21, 2025 21:09:59.790226936 CET	39456	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:09:59.966064930 CET	6667	39456	93.115.172.234	192.168.2.14
Mar 21, 2025 21:10:04.967763901 CET	39458	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:10:05.139556885 CET	6667	39458	93.115.172.234	192.168.2.14
Mar 21, 2025 21:10:10.140979052 CET	39460	6667	192.168.2.14	93.115.172.234
Mar 21, 2025 21:10:10.306997061 CET	6667	39460	93.115.172.234	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 21:09:22.960658073 CET	41934	53	192.168.2.14	8.8.8.8
Mar 21, 2025 21:09:22.960722923 CET	59793	53	192.168.2.14	8.8.8.8
Mar 21, 2025 21:09:23.051613092 CET	53	59793	8.8.8.8	192.168.2.14
Mar 21, 2025 21:09:23.057862997 CET	53	41934	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 21, 2025 21:09:22.960658073 CET	192.168.2.14	8.8.8.8	0xce3e	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 21, 2025 21:09:22.960722923 CET	192.168.2.14	8.8.8.8	0xf735	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 21, 2025 21:09:23.057862997 CET	8.8.8.8	192.168.2.14	0xce3e	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Mar 21, 2025 21:09:23.057862997 CET	8.8.8.8	192.168.2.14	0xce3e	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: wget.elf PID: 5477, Parent PID: 5399

General

Start time (UTC):	20:06:36
Start date (UTC):	21/03/2025
Path:	/tmp/wget.elf
Arguments:	/tmp/wget.elf
File size:	63479 bytes
MD5 hash:	d22d580c17f65c1cec1120b194ab453d

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: wget.elf PID: 5478, Parent PID: 5477

General

Start time (UTC):	20:06:36
Start date (UTC):	21/03/2025
Path:	/tmp/wget.elf
Arguments:	-
File size:	63479 bytes
MD5 hash:	d22d580c17f65c1cec1120b194ab453d

Process Activities

Process Forked

Chronological Activities

Analysis Process: wget.elf PID: 5479, Parent PID: 5478

General

Start time (UTC):	20:06:36
Start date (UTC):	21/03/2025
Path:	/tmp/wget.elf
Arguments:	-
File size:	63479 bytes
MD5 hash:	d22d580c17f65c1cec1120b194ab453d

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: dash PID: 5549, Parent PID: 3632

General

Start time (UTC):	20:08:10
Start date (UTC):	21/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5549, Parent PID: 3632

General

Start time (UTC):	20:08:10
Start date (UTC):	21/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.fWOb9WKTDA /tmp/tmp.9ijiu0TQHx /tmp/tmp.pBTa6aCfnW
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 5550, Parent PID: 3632

General

Start time (UTC):	20:08:10
Start date (UTC):	21/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5550, Parent PID: 3632

General

Start time (UTC):	20:08:10
Start date (UTC):	21/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.fWOb9WKTDA /tmp/tmp.9ijiu0TQHx /tmp/tmp.pBTa6aCfnW
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wget.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: wget.elf PID: 5477, Parent PID: 5399

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: wget.elf PID: 5478, Parent PID: 5477

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: wget.elf PID: 5479, Parent PID: 5478

General

Linux Analysis Report
wget.elf