Play interactive tour

Edit tour

Linux Analysis Report Fate.x86

Overview

General Information

Sample Name:	Fate.x86
Analysis ID:	505335
MD5:	4a5cbb0c859cd1e000ca58eb3edd125a
SHA1:	94e93a1253ae9bb2ad0bcbdf0b48b923236c2833
SHA256:	f99804291a44f9d785e7305a3c1499e1518ce820799dd8d3b137443c288604a8
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Sample contains symbols with suspicious names

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	505335
Start date:	19.10.2021
Start time:	10:03:49
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Fate.x86
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal56.linX86@0/0@0/0
Warnings:	Show All VT rate limit hit for: /opt/package/joesandbox/database/analysis/505335/sample/Fate.x86

Process Tree

system is lnxubuntu20

Fate.x86 (PID: 5248, Parent: 5121, MD5: 4a5cbb0c859cd1e000ca58eb3edd125a) Arguments: /tmp/Fate.x86

Fate.x86 New Fork (PID: 5249, Parent: 5248)

Fate.x86 New Fork (PID: 5250, Parent: 5249)

cleanup

Yara Overview

No yara matches

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Fate.x86	Metadefender: Detection: 25%			Perma Link
Source: Fate.x86	ReversingLabs: Detection: 35%

Machine Learning detection for sample

Show sources

Source: Fate.x86

Joe Sandbox ML: detected

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:47474 -> 149.202.251.226:384

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 149.202.251.226
Source: unknown	TCP traffic detected without corresponding DNS query: 149.202.251.226
Source: unknown	TCP traffic detected without corresponding DNS query: 149.202.251.226
Source: unknown	TCP traffic detected without corresponding DNS query: 149.202.251.226
Source: unknown	TCP traffic detected without corresponding DNS query: 149.202.251.226
Source: unknown	TCP traffic detected without corresponding DNS query: 149.202.251.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 12.166.238.132
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

System Summary:

Contains symbols with names commonly found in malware

Show sources

Source: ELF static info symbol of initial sample

Name: attacks.c

Source: ELF static info symbol of initial sample

Name: payload

Source: /tmp/Fate.x86 (PID: 5250)

SIGKILL sent: pid: 5250, result: unknown

Jump to behavior

Source: classification engine

Classification label: mal56.linX86@0/0@0/0

Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/mempcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/memset.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strcat.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strlen.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strpbrk.S
Source: ELF static info symbol of initial sample	FILE: libc/string/x86_64/strspn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/x86_64/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/x86_64/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/x86_64/crtn.S

Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/5145/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/12/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/13/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/5153/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/14/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/15/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/16/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/5156/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/17/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/18/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/120/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/121/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/122/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/243/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/123/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/2/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/124/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/3/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/4/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/125/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/126/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/127/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/6/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/248/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/128/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/249/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/9/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/20/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/21/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1900/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/22/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/23/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/24/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/25/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/26/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/27/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/28/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/29/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/250/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/130/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/251/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/252/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/5040/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/132/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/253/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/4507/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/254/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/255/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/256/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/257/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/379/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/258/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/259/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/30/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/2208/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/35/maps	Jump to behavior
Source: /tmp/Fate.x86 (PID: 5250)	File opened: /proc/1809/maps	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Masquerading1	OS Credential Dumping1	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fate.x86	26%	Metadefender		Browse
Fate.x86	36%	ReversingLabs	Linux.Trojan.Mirai
Fate.x86	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
12.166.238.132	unknown	United States	7018	ATT-INTERNET4US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
149.202.251.226	unknown	France	16276	OVHFR	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Runtime Messages

Command:	/tmp/Fate.x86
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
109.202.202.202	7sNSROyY6Z	Get hash	malicious	Browse
	ZSbDircdwC	Get hash	malicious	Browse
	72F6putA7b	Get hash	malicious	Browse
	tvSR414FTn	Get hash	malicious	Browse
	2FsjsVYjdh	Get hash	malicious	Browse
	gNKKmwxWVA	Get hash	malicious	Browse
	qTSinrPpSB	Get hash	malicious	Browse
	QO7FskBRHD	Get hash	malicious	Browse
	NCxJ1ZqgUM	Get hash	malicious	Browse
	3JTerIMW7o	Get hash	malicious	Browse
	J4otkuWQXB	Get hash	malicious	Browse
	6LgR6awUtT	Get hash	malicious	Browse
	N71ioQbJlG	Get hash	malicious	Browse
	rEfn3kfDaV	Get hash	malicious	Browse
	hmsLm3zv4e	Get hash	malicious	Browse
	R5PzxEqDsk	Get hash	malicious	Browse
	WDPKg5l9gb	Get hash	malicious	Browse
	546pMMpBP6	Get hash	malicious	Browse
	x86	Get hash	malicious	Browse
	arm7	Get hash	malicious	Browse
149.202.251.226	NY63XZ2AXX	Get hash	malicious	Browse
	6P18Hcz5wx	Get hash	malicious	Browse
	9dQnpqTdYq	Get hash	malicious	Browse
	ePqON9nClf	Get hash	malicious	Browse
	EtSnbeRMQp	Get hash	malicious	Browse
91.189.91.43	7sNSROyY6Z	Get hash	malicious	Browse
	ZSbDircdwC	Get hash	malicious	Browse
	72F6putA7b	Get hash	malicious	Browse
	tvSR414FTn	Get hash	malicious	Browse
	2FsjsVYjdh	Get hash	malicious	Browse
	gNKKmwxWVA	Get hash	malicious	Browse
	qTSinrPpSB	Get hash	malicious	Browse
	QO7FskBRHD	Get hash	malicious	Browse
	NCxJ1ZqgUM	Get hash	malicious	Browse
	3JTerIMW7o	Get hash	malicious	Browse
	J4otkuWQXB	Get hash	malicious	Browse
	6LgR6awUtT	Get hash	malicious	Browse
	N71ioQbJlG	Get hash	malicious	Browse
	rEfn3kfDaV	Get hash	malicious	Browse
	hmsLm3zv4e	Get hash	malicious	Browse
	R5PzxEqDsk	Get hash	malicious	Browse
	WDPKg5l9gb	Get hash	malicious	Browse
	546pMMpBP6	Get hash	malicious	Browse
	x86	Get hash	malicious	Browse
	arm7	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ATT-INTERNET4US	GzcHogvIYP	Get hash	malicious	Browse	13.156.210.178
	L7PID7HuZy	Get hash	malicious	Browse	13.137.135.232
	gSqIRpsggd	Get hash	malicious	Browse	12.69.58.67
	D2ktdSmnhT	Get hash	malicious	Browse	13.176.170.243
	arm7	Get hash	malicious	Browse	13.171.173.243
	x86	Get hash	malicious	Browse	12.230.22.121
	arm	Get hash	malicious	Browse	13.46.1.121
	7qvn4qlmi3	Get hash	malicious	Browse	32.43.162.10
	JuofJwjQMT	Get hash	malicious	Browse	67.116.193.85
	GRPVtMlbK5	Get hash	malicious	Browse	108.230.82.192
	x86	Get hash	malicious	Browse	104.1.204.87
	arm	Get hash	malicious	Browse	172.124.106.235
	S3LjnqUKlm	Get hash	malicious	Browse	12.107.177.60
	eBQ4XSarFt	Get hash	malicious	Browse	99.112.251.53
	7vmT7Q2se0	Get hash	malicious	Browse	32.112.130.169
	V08TSD69fO	Get hash	malicious	Browse	99.183.124.74
	H9pX0VKTN5	Get hash	malicious	Browse	108.219.228.192
	ouMR5UDBpj	Get hash	malicious	Browse	12.207.24.53
	sora.arm	Get hash	malicious	Browse	12.70.123.142
	jew.arm7	Get hash	malicious	Browse	99.163.64.243
INIT7CH	7sNSROyY6Z	Get hash	malicious	Browse	109.202.202.202
	ZSbDircdwC	Get hash	malicious	Browse	109.202.202.202
	72F6putA7b	Get hash	malicious	Browse	109.202.202.202
	tvSR414FTn	Get hash	malicious	Browse	109.202.202.202
	2FsjsVYjdh	Get hash	malicious	Browse	109.202.202.202
	gNKKmwxWVA	Get hash	malicious	Browse	109.202.202.202
	qTSinrPpSB	Get hash	malicious	Browse	109.202.202.202
	QO7FskBRHD	Get hash	malicious	Browse	109.202.202.202
	NCxJ1ZqgUM	Get hash	malicious	Browse	109.202.202.202
	3JTerIMW7o	Get hash	malicious	Browse	109.202.202.202
	J4otkuWQXB	Get hash	malicious	Browse	109.202.202.202
	6LgR6awUtT	Get hash	malicious	Browse	109.202.202.202
	N71ioQbJlG	Get hash	malicious	Browse	109.202.202.202
	rEfn3kfDaV	Get hash	malicious	Browse	109.202.202.202
	hmsLm3zv4e	Get hash	malicious	Browse	109.202.202.202
	R5PzxEqDsk	Get hash	malicious	Browse	109.202.202.202
	WDPKg5l9gb	Get hash	malicious	Browse	109.202.202.202
	546pMMpBP6	Get hash	malicious	Browse	109.202.202.202
	x86	Get hash	malicious	Browse	109.202.202.202
	arm7	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.771368037850099
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fate.x86
File size:	56795
MD5:	4a5cbb0c859cd1e000ca58eb3edd125a
SHA1:	94e93a1253ae9bb2ad0bcbdf0b48b923236c2833
SHA256:	f99804291a44f9d785e7305a3c1499e1518ce820799dd8d3b137443c288604a8
SHA512:	5633a9b3fe2b47bfaed3cf994f3a9da2a352b335089f480c9f9d2243f3f4d5a7477ba8ebb14f449555e17421075276e93e9f45308a546acaf9bdf9fff801c1d5
SSDEEP:	768:/R/9ibT7kI8+MO80ueo9lj3CtkMIBa3mcm3MY28WkYKDYEZLFgLjD4wVZE:p/9mMI8J0uN94uMUa3PJmkElFYP4wVZE
File Content Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@.....T.......T.......................X.......X.P.....X.P.....8.......P0..............Q.td....................................................H...._.....b..H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	36824
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0x62c8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x4063c8	0x63c8	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x4063e0	0x63e0	0x1d70	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x408150	0x8150	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x508158	0x8158	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x508168	0x8168	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x508178	0x8178	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x508180	0x8180	0x610	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x5087a0	0x8790	0x2a08	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x8790	0x7e0	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x8f70	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x9398	0x3138	0x18	0x0		14	191	8
.strtab	STRTAB	0x0	0xc4d0	0x190b	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x8154	0x8154	3.9107	0x5	R E	0x100000	.init .text .fini .rodata .eh_frame
LOAD	0x8158	0x508158	0x508158	0x638	0x3050	1.7114	0x6	RW	0x100000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x4063c8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x4063e0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x408150	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x508158	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x508168	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x508178	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x508180	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x5087a0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x508160	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x508158	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x508770	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x407a40	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x508780	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x407d40	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x508170	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x508168	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x408150	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x408150	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x508770	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x407a40	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x508780	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x407d40	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x508778	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x508788	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x401208	6	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x4029c0	14	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x404bc0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_lseek	.symtab	0x404f40	45	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x400ef8	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x4047e4	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x404863	67	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x4029d0	194	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x400e24	42	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x403e18	276	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x4042fc	18	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x4061ac	43	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x404c24	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x400e50	41	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x401010	116	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x402bd0	43	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x50a85c	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x404488	92	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x404bc0	100	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x404bc0	100	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x400e7c	38	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x402244	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x406204	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40620c	218	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x404c50	82	FUNC	<unknown>	HIDDEN	2
__GI_fstat64	.symtab	0x404c50	82	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x40227c	134	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x404dd0	35	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x404df4	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x404e1c	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x404e44	38	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x404e6c	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x400ea4	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x404e80	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x404ea8	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x50a860	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x402bb4	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x406098	137	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x404243	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x404ed0	104	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x402b0c	25	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x400ecc	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x404f40	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x404f38	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x405df8	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x402310	102	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x405c80	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x405ee8	237	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x402380	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x404b90	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x404f70	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x404f9c	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x404fc4	38	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x400ef8	106	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x401084	243	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x406124	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x403f38	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x404140	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x405fd8	190	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x400f70	39	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x401178	143	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x400f98	39	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x404fec	74	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x402bfc	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x402c08	48	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x400fc0	38	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x404098	168	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x404a99	247	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x405038	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x4044e4	415	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x402c38	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x401210	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x40419a	169	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x402a94	48	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x402ac4	70	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x402460	428	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x402610	213	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x4026f0	225	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x4027d4	206	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x405ce0	140	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x405d70	135	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x4028a4	187	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x402960	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x404310	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x404310	10	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x404684	351	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x402b28	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x400fe8	39	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x4012a8	199	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x4051e8	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40523c	140	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40522c	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x4061d8	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x508178	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x508178	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x50a848	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x508740	40	OBJECT	<unknown>	DEFAULT	9
__bss_start	.symtab	0x508790	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40482e	53	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x508778	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x508788	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x50a868	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x508190	0	NOTYPE	<unknown>	DEFAULT	9
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x406390	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x508180	0	OBJECT	<unknown>	HIDDEN	9
__environ	.symtab	0x50a838	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x401208	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x50a828	8	OBJECT	<unknown>	HIDDEN	10
__fini_array_end	.symtab	0x508154	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x508154	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__getdents	.symtab	0x404ca4	300	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x404ca4	300	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x404e6c	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x4029c0	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x508154	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x508154	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__libc_close	.symtab	0x400e50	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x402bd0	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x400f62	14	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x404bc0	100	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x404bc0	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x400e7c	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x400ea4	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x404f40	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x404f38	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x404fc4	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x400ef8	106	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x400f70	39	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x402bfc	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x402c08	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x404a99	247	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x50a830	8	OBJECT	<unknown>	DEFAULT	10
__libc_write	.symtab	0x4061d8	42	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x403a9d	410	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x402ce8	96	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x5085c0	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x50aac0	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x403a04	153	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x50a840	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x508154	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x508154	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40482a	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x40482a	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x40482a	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x40482a	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x40482a	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x40482d	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x406124	18	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_rt	.symtab	0x404a90	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x50a850	8	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x406158	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x406174	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x406138	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x508398	8	OBJECT	<unknown>	DEFAULT	9
__stdio_WRITE	.symtab	0x4052c8	147	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x4062e8	133	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40535c	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x4013db	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4280	.symtab	0x4068e0	40	OBJECT	<unknown>	DEFAULT	4
__stdio_seek	.symtab	0x406370	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x405460	148	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x401474	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x5083a0	8	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__sysv_signal	.symtab	0x402c68	128	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x4047e4	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x404863	67	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x4048a6	489	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x508768	8	OBJECT	<unknown>	HIDDEN	9
__xpg_strerror_r	.symtab	0x4029d0	194	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat64_conv	.symtab	0x405090	172	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x40513c	172	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x40149c	68	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x406194	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x50b198	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x50b1a0	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x508790	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x50b1a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x50a85c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x400e24	42	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x4063c8	5	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x508820	8192	OBJECT	<unknown>	DEFAULT	10
_fp_out_narrow	.symtab	0x4014e0	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x405638	1608	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x50a860	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	5	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x4054f4	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x401b94	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x401e46	1022	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x401c08	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x401c4c	457	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x401e18	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x40482d	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40482d	1	FUNC	<unknown>	DEFAULT	2
_recv	.symtab	0x400d88	154	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_init	.symtab	0x401370	107	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x5083a8	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x5083c0	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_del_count	.symtab	0x508804	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x508400	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x508800	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x508440	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x4013ea	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x508428	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40431c	362	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40554c	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x4069e0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40557c	187	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x401558	1595	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x403e18	276	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x4042fc	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attacks.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x50a820	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.3160	.symtab	0x50a858	4	OBJECT	<unknown>	DEFAULT	10
binslist	.symtab	0x5081e0	40	OBJECT	<unknown>	DEFAULT	9
brk	.symtab	0x4061ac	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
calloc	.symtab	0x4035b0	248	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
check_maps	.symtab	0x4005fc	116	FUNC	<unknown>	DEFAULT	2
childpid	.symtab	0x50aaa0	4	OBJECT	<unknown>	DEFAULT	10
clock_getres	.symtab	0x404c24	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x400e50	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x401010	116	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2761	.symtab	0x5087a0	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x402bd0	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connection	.symtab	0x400980	124	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x400f62	14	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
data_start	.symtab	0x508190	0	NOTYPE	<unknown>	DEFAULT	9
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dstring	.symtab	0x50a880	30	OBJECT	<unknown>	DEFAULT	10
environ	.symtab	0x50a838	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x50a85c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exe_kill	.symtab	0x400715	284	FUNC	<unknown>	DEFAULT	2
exit	.symtab	0x404488	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x408080	208	OBJECT	<unknown>	DEFAULT	4
fcntl	.symtab	0x404bc0	100	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x404bc0	100	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x408060	20	OBJECT	<unknown>	DEFAULT	4
fork	.symtab	0x400e7c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x402244	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x403c37	452	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x406204	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x406204	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40620c	218	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x404c50	82	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat64	.symtab	0x404c50	82	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x40227c	134	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x404dd0	35	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x404df4	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x404e1c	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x404e44	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x404e6c	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x400ea4	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x404e80	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x404e80	40	FUNC	<unknown>	DEFAULT	2
getuid	.symtab	0x404ea8	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x50a860	4	OBJECT	<unknown>	DEFAULT	10
hide_proc	.symtab	0x4009fc	6	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x402ba0	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x402b98	8	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x402bb4	28	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x406098	137	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x403fe2	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x404243	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x404ed0	104	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x402b0c	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x400ecc	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x400954	42	FUNC	<unknown>	DEFAULT	2
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcat.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x404f40	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x404f38	5	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x400a02	329	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x402d48	2149	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x403dfb	28	FUNC	<unknown>	DEFAULT	2
maps_kill	.symtab	0x400831	291	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x405df8	240	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x402310	102	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x405c80	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x405ee8	237	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x402380	210	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x404b90	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x404f70	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x404f9c	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x508600	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x508640	40	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x404fc4	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohl	.symtab	0x402bad	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x402ba5	8	FUNC	<unknown>	DEFAULT	2
object.2814	.symtab	0x5087c0	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x400ef8	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x401084	243	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2759	.symtab	0x508188	0	OBJECT	<unknown>	DEFAULT	9
packet	.symtab	0x50a870	8	OBJECT	<unknown>	DEFAULT	10
parse.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
parse_cmds	.symtab	0x400bec	412	FUNC	<unknown>	DEFAULT	2
payload	.symtab	0x5081a0	46	OBJECT	<unknown>	DEFAULT	9
pidPath	.symtab	0x50a8a0	512	OBJECT	<unknown>	DEFAULT	10
prefix.4494	.symtab	0x406915	12	OBJECT	<unknown>	DEFAULT	4
qual_chars.4498	.symtab	0x406930	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x406124	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x403f2c	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_string	.symtab	0x4001c0	212	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x403f38	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x407540	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x404140	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x5086c0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x405fd8	190	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x400f70	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x401178	143	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x400f98	39	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x4036a8	857	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
report_to_cnc	.symtab	0x400670	165	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x404fec	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x402bfc	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send_bypass	.symtab	0x400363	263	FUNC	<unknown>	DEFAULT	2
send_std	.symtab	0x400294	207	FUNC	<unknown>	DEFAULT	2
send_tcp	.symtab	0x40046a	173	FUNC	<unknown>	DEFAULT	2
send_tcprand	.symtab	0x400517	229	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x402c08	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x400fc0	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x403f80	98	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x404098	168	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x404a99	247	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x405038	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x4044e4	415	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x402c38	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
spec_and_mask.4497	.symtab	0x406950	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4493	.symtab	0x406921	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4494	.symtab	0x406980	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4493	.symtab	0x406995	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4496	.symtab	0x406960	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4495	.symtab	0x406970	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x401210	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x404050	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x404050	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x40419a	169	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x508390	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x508380	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x508388	8	OBJECT	<unknown>	DEFAULT	9
str_split	.symtab	0x400b4c	160	FUNC	<unknown>	DEFAULT	2
strcasecmp	.symtab	0x402a94	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x402ac4	70	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcat	.symtab	0x402460	428	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x402610	213	FUNC	<unknown>	DEFAULT	2
strerror_r	.symtab	0x4029d0	194	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x4026f0	225	FUNC	<unknown>	DEFAULT	2
strnlen	.symtab	0x4027d4	206	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x405ce0	140	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x405d70	135	FUNC	<unknown>	DEFAULT	2
strstr	.symtab	0x4028a4	187	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoimax	.symtab	0x404310	10	FUNC	<unknown>	DEFAULT	2
strtok_r	.symtab	0x402960	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x404310	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x404310	10	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0x404684	351	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysv_signal	.symtab	0x402c68	128	FUNC	<unknown>	DEFAULT	2
sysv_signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x402b28	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x400fe8	39	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x4069a0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x4069b8	12	OBJECT	<unknown>	DEFAULT	4
unknown.2050	.symtab	0x4069c4	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x508680	48	OBJECT	<unknown>	DEFAULT	9
utils.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x4012a8	199	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x4051e8	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40523c	140	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40522c	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
whitelist	.symtab	0x508220	352	OBJECT	<unknown>	DEFAULT	9
write	.symtab	0x4061d8	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2021 10:04:33.421768904 CEST	47474	384	192.168.2.23	149.202.251.226
Oct 19, 2021 10:04:33.447587013 CEST	384	47474	149.202.251.226	192.168.2.23
Oct 19, 2021 10:04:33.447729111 CEST	47474	384	192.168.2.23	149.202.251.226
Oct 19, 2021 10:04:33.447757959 CEST	47474	384	192.168.2.23	149.202.251.226
Oct 19, 2021 10:04:33.473520041 CEST	384	47474	149.202.251.226	192.168.2.23
Oct 19, 2021 10:04:34.024975061 CEST	47476	384	192.168.2.23	149.202.251.226
Oct 19, 2021 10:04:34.051316023 CEST	384	47476	149.202.251.226	192.168.2.23
Oct 19, 2021 10:04:34.051558971 CEST	47476	384	192.168.2.23	149.202.251.226
Oct 19, 2021 10:04:34.051644087 CEST	47476	384	192.168.2.23	149.202.251.226
Oct 19, 2021 10:04:34.077464104 CEST	384	47476	149.202.251.226	192.168.2.23
Oct 19, 2021 10:04:34.077480078 CEST	384	47476	149.202.251.226	192.168.2.23
Oct 19, 2021 10:04:34.202003002 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 19, 2021 10:04:34.970688105 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 19, 2021 10:04:48.792597055 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 19, 2021 10:04:58.577132940 CEST	23	50368	12.166.238.132	192.168.2.23
Oct 19, 2021 10:04:58.577486038 CEST	50368	23	192.168.2.23	12.166.238.132
Oct 19, 2021 10:05:01.079180956 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 19, 2021 10:05:05.174725056 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 19, 2021 10:05:29.748075962 CEST	43928	443	192.168.2.23	91.189.91.42

System Behavior

Analysis Process: Fate.x86 PID: 5248 Parent PID: 5121

General

Start time:	10:04:32
Start date:	19/10/2021
Path:	/tmp/Fate.x86
Arguments:	/tmp/Fate.x86
File size:	56795 bytes
MD5 hash:	4a5cbb0c859cd1e000ca58eb3edd125a

Chronological Activities

Analysis Process: Fate.x86 PID: 5249 Parent PID: 5248

General

Start time:	10:04:32
Start date:	19/10/2021
Path:	/tmp/Fate.x86
Arguments:	n/a
File size:	56795 bytes
MD5 hash:	4a5cbb0c859cd1e000ca58eb3edd125a

Chronological Activities

Analysis Process: Fate.x86 PID: 5250 Parent PID: 5249

General

Start time:	10:04:32
Start date:	19/10/2021
Path:	/tmp/Fate.x86
Arguments:	n/a
File size:	56795 bytes
MD5 hash:	4a5cbb0c859cd1e000ca58eb3edd125a

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report Fate.x86

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Fate.x86 PID: 5248 Parent PID: 5121

General

Chronological Activities

Analysis Process: Fate.x86 PID: 5249 Parent PID: 5248

General

Chronological Activities

Analysis Process: Fate.x86 PID: 5250 Parent PID: 5249

General

Chronological Activities