Play interactive tour

Edit tour

Linux Analysis Report A2n1Xa05af

Overview

General Information

Sample Name:	A2n1Xa05af
Analysis ID:	534249
MD5:	38e081fe4be81df7329bb993314ff333
SHA1:	5487111b00e21e26d38e950e526fd7e3c842fadf
SHA256:	25ee849716371760f1b2e4585815345a38eaf22654e07340fd6c2dd3bd87113b
Tags:	32elfgafgytsparc
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	534249
Start date:	05.12.2021
Start time:	18:58:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	A2n1Xa05af
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal68.troj.lin@0/1@0/0

Process Tree

system is lnxubuntu20

A2n1Xa05af (PID: 5221, Parent: 5107, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/A2n1Xa05af

A2n1Xa05af New Fork (PID: 5223, Parent: 5221)

A2n1Xa05af New Fork (PID: 5225, Parent: 5223)

A2n1Xa05af New Fork (PID: 5227, Parent: 5225)

A2n1Xa05af New Fork (PID: 5228, Parent: 5225)

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
A2n1Xa05af	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5221.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5225.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5223.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: A2n1Xa05af

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: A2n1Xa05af	Virustotal: Detection: 59%			Perma Link
Source: A2n1Xa05af	ReversingLabs: Detection: 66%

Networking:

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 85.237.217.143 ports 42516,1,2,4,5,6

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:36272 -> 85.237.217.143:42516

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143

Source: A2n1Xa05af	String found in binary or memory: http://199.19.225.2/bins.sh;
Source: A2n1Xa05af	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: A2n1Xa05af	String found in binary or memory: http://feedback.redkolibri.com/
Source: A2n1Xa05af	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: A2n1Xa05af	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: A2n1Xa05af	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: ELF static info symbol of initial sample	Name: TelnetScanner
Source: ELF static info symbol of initial sample	Name: payload
Source: ELF static info symbol of initial sample	Name: tel_passwords
Source: ELF static info symbol of initial sample	Name: tel_usernames

Source: Initial sample

String containing 'busybox' found: busybox

Source: classification engine

Classification label: mal68.troj.lin@0/1@0/0

Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/memchr.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/memset.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strchr.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strcmp.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strlen.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/crtn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/fork.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/rem.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/udiv.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/umul.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/urem.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/vfork.S

Source: /tmp/A2n1Xa05af (PID: 5221)

Queries kernel information via 'uname':

Jump to behavior

Source: A2n1Xa05af, 5221.1.00000000d94ea98a.00000000c62a8e2f.rw-.sdmp, A2n1Xa05af, 5223.1.00000000d94ea98a.00000000c62a8e2f.rw-.sdmp, A2n1Xa05af, 5225.1.00000000d94ea98a.00000000c62a8e2f.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: A2n1Xa05af, 5221.1.00000000d94ea98a.00000000c62a8e2f.rw-.sdmp, A2n1Xa05af, 5223.1.00000000d94ea98a.00000000c62a8e2f.rw-.sdmp, A2n1Xa05af, 5225.1.00000000d94ea98a.00000000c62a8e2f.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: A2n1Xa05af, 5221.1.00000000290c09fa.0000000041b7166d.rw-.sdmp, A2n1Xa05af, 5223.1.00000000290c09fa.0000000041b7166d.rw-.sdmp, A2n1Xa05af, 5225.1.00000000290c09fa.0000000041b7166d.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/A2n1Xa05afSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/A2n1Xa05af
Source: A2n1Xa05af, 5221.1.00000000290c09fa.0000000041b7166d.rw-.sdmp, A2n1Xa05af, 5223.1.00000000290c09fa.0000000041b7166d.rw-.sdmp, A2n1Xa05af, 5225.1.00000000290c09fa.0000000041b7166d.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: A2n1Xa05af, type: SAMPLE
Source: Yara match	File source: 5221.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: A2n1Xa05af, type: SAMPLE
Source: Yara match	File source: 5221.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000000eda161b.000000008e1ac7e1.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Masquerading1	OS Credential Dumping	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
A2n1Xa05af	59%	Virustotal		Browse
A2n1Xa05af	67%	ReversingLabs	Linux.Trojan.Gafgyt
A2n1Xa05af	100%	Avira	LINUX/Agent.SH.B

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://199.19.225.2/bins.sh;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	A2n1Xa05af	false		high
http://www.billybobbot.com/crawler/)	A2n1Xa05af	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	A2n1Xa05af	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	A2n1Xa05af	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	A2n1Xa05af	false		high
http://199.19.225.2/bins.sh;	A2n1Xa05af	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
85.237.217.143	unknown	United Kingdom	21321	ARETI-ASGB	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Runtime Messages

Command:	/tmp/A2n1Xa05af
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
85.237.217.143	HF6zp1MUDf	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	xyLAkjzDP1	Get hash	malicious	Browse
	p9aYSEPY1g	Get hash	malicious	Browse
	J7OXgvNcYx	Get hash	malicious	Browse
	iCJoZJ1iF0	Get hash	malicious	Browse
	kMDTne1K4H	Get hash	malicious	Browse
	7evGU3Z12H	Get hash	malicious	Browse
	O0eBrHuHOR	Get hash	malicious	Browse
	lp4eZYDISa	Get hash	malicious	Browse
	utCF3oKE7j	Get hash	malicious	Browse
	9xmBK8Yk7L	Get hash	malicious	Browse
	5C68yKuI05	Get hash	malicious	Browse
	OuTRctwVMc	Get hash	malicious	Browse
	3h8hGqSxeZ	Get hash	malicious	Browse
	wjEACpPKod	Get hash	malicious	Browse
109.202.202.202	HF6zp1MUDf	Get hash	malicious	Browse
	ub46olxdcc	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	TtG027KDqC	Get hash	malicious	Browse
	Iif5nK0q3o	Get hash	malicious	Browse
	TTOSJWnF92	Get hash	malicious	Browse
	N2MGGp7k8b	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	7H8oT3jp4u	Get hash	malicious	Browse
	3Z3SEO82Tw	Get hash	malicious	Browse
	fhrRmQOge6	Get hash	malicious	Browse
	2k2LHrePaX	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	HuA8rX5Gnk	Get hash	malicious	Browse
	D5MDE1XXvY	Get hash	malicious	Browse
	cbr.arm7	Get hash	malicious	Browse
	cbr.x86	Get hash	malicious	Browse
91.189.91.43	HF6zp1MUDf	Get hash	malicious	Browse
	ub46olxdcc	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	TtG027KDqC	Get hash	malicious	Browse
	Iif5nK0q3o	Get hash	malicious	Browse
	TTOSJWnF92	Get hash	malicious	Browse
	N2MGGp7k8b	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	7H8oT3jp4u	Get hash	malicious	Browse
	3Z3SEO82Tw	Get hash	malicious	Browse
	fhrRmQOge6	Get hash	malicious	Browse
	2k2LHrePaX	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	HuA8rX5Gnk	Get hash	malicious	Browse
	D5MDE1XXvY	Get hash	malicious	Browse
	cbr.arm7	Get hash	malicious	Browse
	cbr.x86	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CANONICAL-ASGB	HF6zp1MUDf	Get hash	malicious	Browse	91.189.91.42
	ub46olxdcc	Get hash	malicious	Browse	91.189.91.42
	cDHvd1tp2x	Get hash	malicious	Browse	91.189.91.42
	TtG027KDqC	Get hash	malicious	Browse	91.189.91.42
	Iif5nK0q3o	Get hash	malicious	Browse	91.189.91.42
	TTOSJWnF92	Get hash	malicious	Browse	91.189.91.42
	N2MGGp7k8b	Get hash	malicious	Browse	91.189.91.42
	QwKoHC7f1c	Get hash	malicious	Browse	91.189.91.42
	iCRrgdO9hl	Get hash	malicious	Browse	91.189.91.42
	pvtH5neadB	Get hash	malicious	Browse	91.189.91.42
	My7DDV8cjV	Get hash	malicious	Browse	91.189.91.42
	7H8oT3jp4u	Get hash	malicious	Browse	91.189.91.42
	3Z3SEO82Tw	Get hash	malicious	Browse	91.189.91.42
	fhrRmQOge6	Get hash	malicious	Browse	91.189.91.42
	2k2LHrePaX	Get hash	malicious	Browse	91.189.91.42
	xMeY7xXFRE	Get hash	malicious	Browse	91.189.91.42
	HuA8rX5Gnk	Get hash	malicious	Browse	91.189.91.42
	D5MDE1XXvY	Get hash	malicious	Browse	91.189.91.42
	cbr.arm7	Get hash	malicious	Browse	91.189.91.42
	cbr.x86	Get hash	malicious	Browse	91.189.91.42
ARETI-ASGB	HF6zp1MUDf	Get hash	malicious	Browse	85.237.217.143
	cDHvd1tp2x	Get hash	malicious	Browse	85.237.217.143
	QwKoHC7f1c	Get hash	malicious	Browse	85.237.217.143
	iCRrgdO9hl	Get hash	malicious	Browse	85.237.217.143
	pvtH5neadB	Get hash	malicious	Browse	85.237.217.143
	xMeY7xXFRE	Get hash	malicious	Browse	85.237.217.143
	xyLAkjzDP1	Get hash	malicious	Browse	85.237.217.143
	p9aYSEPY1g	Get hash	malicious	Browse	85.237.217.143
	J7OXgvNcYx	Get hash	malicious	Browse	85.237.217.143
	iCJoZJ1iF0	Get hash	malicious	Browse	85.237.217.143
	kMDTne1K4H	Get hash	malicious	Browse	85.237.217.143
	7evGU3Z12H	Get hash	malicious	Browse	85.237.217.143
	O0eBrHuHOR	Get hash	malicious	Browse	85.237.217.143
	lp4eZYDISa	Get hash	malicious	Browse	85.237.217.143
	utCF3oKE7j	Get hash	malicious	Browse	85.237.217.143
	9xmBK8Yk7L	Get hash	malicious	Browse	85.237.217.143
	5C68yKuI05	Get hash	malicious	Browse	85.237.217.143
	OuTRctwVMc	Get hash	malicious	Browse	85.237.217.143
	3h8hGqSxeZ	Get hash	malicious	Browse	85.237.217.143
	wjEACpPKod	Get hash	malicious	Browse	85.237.217.143
INIT7CH	HF6zp1MUDf	Get hash	malicious	Browse	109.202.202.202
	ub46olxdcc	Get hash	malicious	Browse	109.202.202.202
	cDHvd1tp2x	Get hash	malicious	Browse	109.202.202.202
	TtG027KDqC	Get hash	malicious	Browse	109.202.202.202
	Iif5nK0q3o	Get hash	malicious	Browse	109.202.202.202
	TTOSJWnF92	Get hash	malicious	Browse	109.202.202.202
	N2MGGp7k8b	Get hash	malicious	Browse	109.202.202.202
	QwKoHC7f1c	Get hash	malicious	Browse	109.202.202.202
	iCRrgdO9hl	Get hash	malicious	Browse	109.202.202.202
	pvtH5neadB	Get hash	malicious	Browse	109.202.202.202
	My7DDV8cjV	Get hash	malicious	Browse	109.202.202.202
	7H8oT3jp4u	Get hash	malicious	Browse	109.202.202.202
	3Z3SEO82Tw	Get hash	malicious	Browse	109.202.202.202
	fhrRmQOge6	Get hash	malicious	Browse	109.202.202.202
	2k2LHrePaX	Get hash	malicious	Browse	109.202.202.202
	xMeY7xXFRE	Get hash	malicious	Browse	109.202.202.202
	HuA8rX5Gnk	Get hash	malicious	Browse	109.202.202.202
	D5MDE1XXvY	Get hash	malicious	Browse	109.202.202.202
	cbr.arm7	Get hash	malicious	Browse	109.202.202.202
	cbr.x86	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf Download File
Process:	/tmp/A2n1Xa05af
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.3918926446809334
Encrypted:	false
SSDEEP:	3:KkZRAkd:KaAu
MD5:	C7EA09D26E26605227076E0514A33038
SHA1:	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E
SHA-256:	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
SHA-512:	17D0088725EB9991E9EB82E8A3DE0878E45E6F394BBC2AD260AA59C786FF0AD565E145E21256425D1C0ABE15F3ECB402EBB0A6A5E1C2D5BA7A4D95EC93A2861F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	nameserver 8.8.8.8.nameserver 8.8.4.4.

Static File Info

General
File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.9800011309790175
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	A2n1Xa05af
File size:	126929
MD5:	38e081fe4be81df7329bb993314ff333
SHA1:	5487111b00e21e26d38e950e526fd7e3c842fadf
SHA256:	25ee849716371760f1b2e4585815345a38eaf22654e07340fd6c2dd3bd87113b
SHA512:	e96d2e5b937511492d4bc7424e5e88de36e67c1d81b9f557826e2c0bf4dbb1509c75035d1c99728c4b36f4188a4b6653e62a5c0850a2209a7d8ae460cca5f73a
SSDEEP:	3072:/YNa/GLBNPoQuphakpiQ9/nYEP/UnSQf/R:6a/ylo9phakp39/nYEP/UnSQf/R
File Content Preview:	.ELF...........................4...(.....4. ...(..........................................................iD........dt.Q................................@..(....@.Q.................#.....cx..`.....!.....!...@.....".........`......$!...!...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	104488
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100b0	0xb0	0x147d4	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x24884	0x14884	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x24898	0x14898	0x3918	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x281b0	0x181b0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x381b4	0x181b4	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x381bc	0x181bc	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x381c4	0x181c4	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x381c8	0x181c8	0x5ac	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x38778	0x18774	0x6380	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x18774	0xaf8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1926c	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x1928c	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x192ab	0x16e	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x19419	0xfb	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x19514	0x7c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x19590	0x28	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x195b8	0x10b	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x196c3	0x6e	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x19731	0x18	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x19749	0xdc	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x19be8	0x2f80	0x10	0x0		23	274	4
.strtab	STRTAB	0x0	0x1cb68	0x2469	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x181b4	0x181b4	3.6867	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x181b4	0x381b4	0x381b4	0x5c0	0x6944	2.4338	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x24884	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x24898	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x281b0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x381b4	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x381bc	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x381c4	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x381c8	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x38778	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
.rem	.symtab	0x1a434	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x1a414	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x1a428	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x1a3f4	32	FUNC	<unknown>	DEFAULT	2
C.261.5961	.symtab	0x26470	104	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x387bc	16384	OBJECT	<unknown>	DEFAULT	10
SendDOMINATE	.symtab	0x15ebc	1552	FUNC	<unknown>	DEFAULT	2
SendHTTP	.symtab	0x164cc	420	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x16670	416	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x14988	428	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0x15188	1756	FUNC	<unknown>	DEFAULT	2
TelnetIPRanges	.symtab	0x12770	1508	FUNC	<unknown>	DEFAULT	2
TelnetScanner	.symtab	0x13108	6036	FUNC	<unknown>	DEFAULT	2
UpdateBins	.symtab	0x173f4	112	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0x195c4	168	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x381b8	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x381b4	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x3840c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x26a28	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x38738	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x27d4a	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x38414	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x26d28	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x381c0	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x381bc	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x281b0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x281b0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x3840c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x26a28	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x38738	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x27d4a	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x38414	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x26d28	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x38410	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x3873c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x38418	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x1ab40	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x243b0	328	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1e510	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x20908	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1a460	136	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x1a4e8	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1a794	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x20150	132	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x20228	104	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1e530	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1a54c	64	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x22618	316	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1f8cc	24	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x1f8cc	24	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x22770	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x1a5d4	68	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x20578	72	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1a618	68	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1eb90	76	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x3e9f4	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x1fb24	152	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x205c0	76	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1faa4	128	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x22848	324	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1a460	136	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x1a4e8	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x2305c	420	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x243b0	328	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x22ee4	100	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x23200	192	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x2298c	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a3c0	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1bdd4	60	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x229a4	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x229c8	272	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1be10	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x243b0	328	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1a65c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x2060c	64	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x2064c	64	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x2068c	64	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1e854	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1e890	768	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x206cc	32	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1a684	64	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1a704	72	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x206ec	64	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x3e9f8	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x1e82c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x21a40	220	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1e808	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1e798	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x239a4	684	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x235e0	544	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1f6a8	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x2072c	100	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1e6e0	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1a74c	72	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x2431c	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x2172c	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1c4ec	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1bf08	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x21844	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x21864	272	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1d594	416	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x20790	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1a794	120	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x227fc	76	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x1ab4c	56	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x24304	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1f2a8	80	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1f528	156	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x232c0	204	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1a878	76	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1ec30	32	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x207d8	84	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1a8c4	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1ec50	32	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1ec70	88	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x1a918	108	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x1a984	76	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x1a9d0	72	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1ecc8	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1f404	292	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x22578	160	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1ed40	188	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x2082c	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1fbbc	428	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1ecf4	76	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1ab84	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1f5c4	228	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x244f8	92	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x1e64c	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1d7a8	524	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1db08	648	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1db08	648	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1ddf8	804	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x234dc	56	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1e184	120	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x2338c	224	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1e1fc	248	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1e2f4	252	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x219f0	80	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1d9b4	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x2346c	112	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1e3f0	288	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1e6c8	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x21974	124	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1f8e4	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1ffc0	400	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1e700	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1aa5c	72	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x2438c	36	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1ab1c	36	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x204fc	52	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1adb8	148	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1abb8	156	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x208b8	80	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1aaa4	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x20914	72	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x20978	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x2095c	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1aab8	76	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x381c4	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x381c4	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x3e9e8	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x3871c	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x1ed40	188	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x38774	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x201e4	68	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x38410	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x3873c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x38418	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x3ea1c	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x381d0	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x23ed8	240	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x245f8	196	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x23d6c	208	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x21b1c	1852	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x2483c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x381c8	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x24554	164	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x23c50	284	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x23e3c	120	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x3e9e0	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x1ab40	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x3e9d8	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x243b0	328	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x381b4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x381b4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x22540	56	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x206cc	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1e510	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x20908	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x1f0a4	160	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1f18c	268	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x1f144	48	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1f174	24	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x381b4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x381b4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x246bc	72	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x23eb4	36	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x1a618	68	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1eb90	76	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x1a80c	24	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1a460	136	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x1a4e8	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a3c0	52	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x1a684	64	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x2431c	112	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x20790	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1a794	120	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x227fc	76	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1a878	76	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1ec30	32	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1a8c4	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1ec50	32	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1ec70	88	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x22578	160	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x3e9dc	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x1f78c	320	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1aaa4	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1aab8	76	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x38558	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x3e9c0	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x3eab0	24	OBJECT	<unknown>	DEFAULT	10
__muldi3	.symtab	0x1a2ec	212	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x3ead8	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x3eae4	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x23fc8	56	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x22258	744	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x3e9e4	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x381b4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x381b4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x201d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x201d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x201d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x201d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x201d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x201dc	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x24304	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x24000	772	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x38744	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x3e9ec	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x3eac8	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x3eae8	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x1ee24	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1ee50	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1edfc	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x20530	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x38428	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x24704	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x20a34	196	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x22ad8	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x20af8	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1acb4	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3860	.symtab	0x27028	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x2476c	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x22eb0	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x247a4	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x20c38	252	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1ad80	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x3842c	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x227ac	80	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x20150	132	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x20228	104	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x20290	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x2172c	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x38734	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x204fc	52	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1e530	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x1ae4c	60	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x22754	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x3eaec	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x3eaf0	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x38774	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x3eaf8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x3e9f4	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x1a54c	64	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x24884	8	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x3c7c8	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1ae88	128	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x20f38	1908	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x3e9f8	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x10094	8	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x20d34	144	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1b584	164	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1b88c	1352	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1b628	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1b664	480	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1b844	72	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x201dc	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x201dc	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x3ea30	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x101a4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x22bd4	732	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1ac54	96	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x38430	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x38434	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x22f48	276	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x3c7c4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x3844c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x3c7c0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x38468	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x1acd0	176	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x38464	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1f8f8	428	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x20dc4	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x27188	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x20e00	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1af08	1660	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x22618	316	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x1a58c	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x107fc	116	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x38234	64	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x382e8	44	OBJECT	<unknown>	DEFAULT	9
atoi	.symtab	0x1f8cc	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1f8cc	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x14b34	1620	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x1befc	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x3ea18	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2818	.symtab	0x3e9f0	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x22770	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1ed40	188	FUNC	<unknown>	DEFAULT	2
buf.2628	.symtab	0x3e7d0	16	OBJECT	<unknown>	DEFAULT	10
buf.4861	.symtab	0x3e7e0	460	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x1d560	52	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x38404	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x24878	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1012c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x10198	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x1a5d4	68	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x20578	72	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1a618	68	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x381d4	4	OBJECT	<unknown>	DEFAULT	9
completed.2248	.symtab	0x38778	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x1eb90	76	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x11a38	672	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x10568	48	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x10598	104	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x10464	212	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x10538	48	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x1a80c	24	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x12db4	312	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x38314	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x381d0	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x3e9e0	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x3e9f4	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x270f8	126	OBJECT	<unknown>	DEFAULT	4
execl	.symtab	0x1fb24	152	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x205c0	76	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1faa4	128	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x280a8	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x38274	44	OBJECT	<unknown>	DEFAULT	9
fclose	.symtab	0x22848	324	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1a460	136	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x1a4e8	100	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x2305c	420	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x243b0	328	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x22ee4	100	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x23200	192	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x28090	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x2298c	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1a3c0	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked	.symtab	0x1bdd4	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10138	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1efbc	232	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x229a4	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x229a4	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x229c8	272	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1be10	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x10200	28	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0x1966c	288	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x11664	100	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x12d54	96	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x12214	1372	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x107bc	64	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x243b0	328	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x1a65c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x2060c	64	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x2064c	64	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x2068c	64	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1e854	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1e890	768	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x206cc	32	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1a684	64	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1a6c4	64	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1a704	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1ebdc	84	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x206ec	64	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4860	.symtab	0x3e9ac	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x3e9f8	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x1e784	8	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1e78c	12	FUNC	<unknown>	DEFAULT	2
i.4294	.symtab	0x38408	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x1d7a8	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1e82c	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x21a40	220	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x1e808	36	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1e798	112	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x239a4	684	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x23800	420	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x235e0	544	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x23514	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x192d8	464	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x1021c	228	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x38560	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x1f358	96	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1f6a8	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x2072c	100	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5073	.symtab	0x387b0	4	OBJECT	<unknown>	DEFAULT	10
ipState.5175	.symtab	0x387b8	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x1e6e0	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x1ab04	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x1a74c	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/fork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/rem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/udiv.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/umul.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/urem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x11cd8	432	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x2431c	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x387a8	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x1978c	2912	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x38798	4	OBJECT	<unknown>	DEFAULT	10
makeFukdString	.symtab	0x194a8	156	FUNC	<unknown>	DEFAULT	2
makeIPPacket	.symtab	0x12fe0	220	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x116c8	128	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1ee7c	320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x1205c	440	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x2172c	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x1c4ec	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x1bf08	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x21844	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x21864	272	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1d594	416	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x38668	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x3e9fc	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x3875c	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x20790	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x11e88	468	FUNC	<unknown>	DEFAULT	2
next_start.1092	.symtab	0x3e7c8	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x1e770	8	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1e778	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x387a0	8	OBJECT	<unknown>	DEFAULT	10
object.2329	.symtab	0x3877c	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x1a794	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x3ea20	4	OBJECT	<unknown>	DEFAULT	10
ourPublicIP	.symtab	0x3ea24	4	OBJECT	<unknown>	DEFAULT	10
p.2246	.symtab	0x381cc	0	OBJECT	<unknown>	DEFAULT	9
payload	.symtab	0x381d8	4	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x3ea2c	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x227fc	76	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x1a824	84	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4072	.symtab	0x27050	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10e38	1144	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x109f8	108	FUNC	<unknown>	DEFAULT	2
printf	.symtab	0x1ab4c	56	FUNC	<unknown>	DEFAULT	2
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printi	.symtab	0x10c20	536	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10a64	444	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x17464	7796	FUNC	<unknown>	DEFAULT	2
qual_chars.4078	.symtab	0x27068	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x24304	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1f298	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10300	356	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1f2a8	80	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x27d00	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1f528	156	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x3869c	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x232c0	204	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x1a878	76	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x10720	156	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x10600	288	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x1ec30	32	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x11748	752	FUNC	<unknown>	DEFAULT	2
reset_telstate	.symtab	0x10870	48	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x1d9b4	192	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x159b0	1292	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x207d8	84	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x3ea28	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x130bc	76	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x1a8c4	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1ec50	32	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendCNC	.symtab	0x1489c	236	FUNC	<unknown>	DEFAULT	2
sendHOLD	.symtab	0x16db8	1596	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x16810	1448	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1ec70	88	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0x1a918	108	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0x1a984	76	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0x1a9d0	72	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1ecc8	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1f2f8	96	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1f404	292	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0x1aa18	68	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x22578	160	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x1ed40	188	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x2082c	140	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1fbbc	428	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1ecf4	76	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x15864	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x11354	264	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4077	.symtab	0x2707c	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4071	.symtab	0x27060	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4074	.symtab	0x270b0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4073	.symtab	0x270c8	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4076	.symtab	0x2708c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4075	.symtab	0x270a0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x1ab84	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x1f3b8	76	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x1f3b8	76	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x1f5c4	228	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x38740	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x3ea14	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x38424	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x3841c	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x38420	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x244f8	92	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x1e64c	124	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x1d7a8	524	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x1db08	648	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1db08	648	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1ddf8	804	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x234dc	56	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1e530	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1e184	120	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x2338c	224	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1e1fc	248	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1e2f4	252	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x219f0	80	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1d9b4	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x2346c	112	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x1e3f0	288	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1e6c8	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x21974	124	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1f8e4	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
successes	.symtab	0x382a0	72	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x1ffc0	400	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x1f78c	320	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x11300	84	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1e700	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x12eec	244	FUNC	<unknown>	DEFAULT	2
tel_passwords	.symtab	0x381f4	24	OBJECT	<unknown>	DEFAULT	9
tel_usernames	.symtab	0x381dc	24	OBJECT	<unknown>	DEFAULT	9
tempdirs	.symtab	0x3820c	40	OBJECT	<unknown>	DEFAULT	9
time	.symtab	0x1aa5c	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x2438c	36	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x19544	128	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x1ab1c	36	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x108a0	344	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x270d0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x270e8	12	OBJECT	<unknown>	DEFAULT	4
unknown.1115	.symtab	0x27178	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x38680	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x38318	236	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x204fc	52	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x1adb8	148	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x1abb8	156	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x208b8	80	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x1aaa4	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x20914	72	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x20978	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x2095c	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x1145c	520	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x1aab8	76	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3071	.symtab	0x28168	17	OBJECT	<unknown>	DEFAULT	4
zprintf	.symtab	0x112b0	80	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2021 18:59:05.621335030 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:59:05.647700071 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:59:05.647802114 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:59:06.303848028 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:59:06.332084894 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:59:06.924042940 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 18:59:07.692095041 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 18:59:22.285149097 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 18:59:32.525743961 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 18:59:36.151670933 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:59:36.151985884 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:59:36.178121090 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:59:36.178386927 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:59:38.670293093 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 19:00:03.248018026 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 19:00:23.729415894 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 19:00:36.215125084 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:00:36.215426922 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:00:36.241363049 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:00:36.241570950 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:01:36.155522108 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:01:36.155795097 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:01:36.181804895 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:01:36.181927919 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:02:36.157805920 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:02:36.158025026 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:02:36.184025049 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:02:36.184293985 CET	36272	42516	192.168.2.23	85.237.217.143

System Behavior

Analysis Process: A2n1Xa05af PID: 5221 Parent PID: 5107

General

Start time:	18:59:05
Start date:	05/12/2021
Path:	/tmp/A2n1Xa05af
Arguments:	/tmp/A2n1Xa05af
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: A2n1Xa05af PID: 5223 Parent PID: 5221

General

Start time:	18:59:05
Start date:	05/12/2021
Path:	/tmp/A2n1Xa05af
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: A2n1Xa05af PID: 5225 Parent PID: 5223

General

Start time:	18:59:05
Start date:	05/12/2021
Path:	/tmp/A2n1Xa05af
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: A2n1Xa05af PID: 5227 Parent PID: 5225

General

Start time:	18:59:05
Start date:	05/12/2021
Path:	/tmp/A2n1Xa05af
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: A2n1Xa05af PID: 5228 Parent PID: 5225

General

Start time:	18:59:05
Start date:	05/12/2021
Path:	/tmp/A2n1Xa05af
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report A2n1Xa05af

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: A2n1Xa05af PID: 5221 Parent PID: 5107

General

Chronological Activities

Analysis Process: A2n1Xa05af PID: 5223 Parent PID: 5221

General

Chronological Activities

Analysis Process: A2n1Xa05af PID: 5225 Parent PID: 5223

General

Chronological Activities

Analysis Process: A2n1Xa05af PID: 5227 Parent PID: 5225

General

Analysis Process: A2n1Xa05af PID: 5228 Parent PID: 5225

General

Chronological Activities