Play interactive tour

Edit tour

Linux Analysis Report bma2DVxLJU

Overview

General Information

Sample Name:	bma2DVxLJU
Analysis ID:	534258
MD5:	09c1353cc4eeb91eb01f7db6a5104e5c
SHA1:	9204da939afbdfcb12262fe318df9cf12195a952
SHA256:	c7bb07aa85d39e30001cb631ca2a8132d24557040338ff1d66aeba4de1c3e379
Tags:	32armelfgafgyt
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	534258
Start date:	05.12.2021
Start time:	19:22:35
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	bma2DVxLJU
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal68.troj.lin@0/1@0/0

Process Tree

system is lnxubuntu20

bma2DVxLJU (PID: 5215, Parent: 5110, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/bma2DVxLJU

bma2DVxLJU New Fork (PID: 5217, Parent: 5215)

bma2DVxLJU New Fork (PID: 5219, Parent: 5217)

bma2DVxLJU New Fork (PID: 5221, Parent: 5219)

bma2DVxLJU New Fork (PID: 5222, Parent: 5219)

dash New Fork (PID: 5257, Parent: 4331)

rm (PID: 5257, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.5JyNPT6mIk /tmp/tmp.TnzWmQLzoK /tmp/tmp.iRD5EJv67W

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
bma2DVxLJU	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5219.1.00000000fc366953.000000004c5df7fc.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5217.1.00000000fc366953.000000004c5df7fc.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5215.1.00000000fc366953.000000004c5df7fc.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5221.1.00000000fc366953.000000004c5df7fc.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: bma2DVxLJU

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: bma2DVxLJU	Virustotal: Detection: 61%			Perma Link
Source: bma2DVxLJU	ReversingLabs: Detection: 68%

Networking:

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 85.237.217.143 ports 42516,1,2,4,5,6

Source: global traffic

TCP traffic: 192.168.2.23:36272 -> 85.237.217.143:42516

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33608
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 41.84.238.158
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143

Source: bma2DVxLJU	String found in binary or memory: http://199.19.225.2/bins.sh;
Source: bma2DVxLJU	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: bma2DVxLJU	String found in binary or memory: http://feedback.redkolibri.com/
Source: bma2DVxLJU	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: bma2DVxLJU	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: bma2DVxLJU	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: ELF static info symbol of initial sample	Name: TelnetScanner
Source: ELF static info symbol of initial sample	Name: payload

Source: Initial sample

String containing 'busybox' found: busybox

Source: classification engine

Classification label: mal68.troj.lin@0/1@0/0

Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/_memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/bcopy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memmove.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/memset.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/strcmp.S
Source: ELF static info symbol of initial sample	FILE: libc/string/arm/strlen.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/crtn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/sigrestorer.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/arm/vfork.S

Source: /usr/bin/dash (PID: 5257)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.5JyNPT6mIk /tmp/tmp.TnzWmQLzoK /tmp/tmp.iRD5EJv67W

Jump to behavior

Source: submitted sample

Stderr: qemu: uncaught target signal 11 (Segmentation fault) - core dumped: exit code = 0

Source: /tmp/bma2DVxLJU (PID: 5215)

Queries kernel information via 'uname':

Jump to behavior

Source: bma2DVxLJU, 5215.1.000000004a01e997.00000000e701d09a.rw-.sdmp, bma2DVxLJU, 5217.1.000000004a01e997.00000000e701d09a.rw-.sdmp, bma2DVxLJU, 5219.1.000000004a01e997.00000000e701d09a.rw-.sdmp, bma2DVxLJU, 5221.1.000000004a01e997.00000000e701d09a.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: bma2DVxLJU, 5215.1.000000004321529a.0000000083867b0a.rw-.sdmp, bma2DVxLJU, 5217.1.000000004321529a.0000000083867b0a.rw-.sdmp, bma2DVxLJU, 5219.1.000000004321529a.0000000083867b0a.rw-.sdmp, bma2DVxLJU, 5221.1.000000004321529a.0000000083867b0a.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/bma2DVxLJUSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bma2DVxLJU
Source: bma2DVxLJU, 5215.1.000000004a01e997.00000000e701d09a.rw-.sdmp, bma2DVxLJU, 5217.1.000000004a01e997.00000000e701d09a.rw-.sdmp, bma2DVxLJU, 5219.1.000000004a01e997.00000000e701d09a.rw-.sdmp, bma2DVxLJU, 5221.1.000000004a01e997.00000000e701d09a.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: bma2DVxLJU, 5215.1.000000004321529a.0000000083867b0a.rw-.sdmp, bma2DVxLJU, 5217.1.000000004321529a.0000000083867b0a.rw-.sdmp, bma2DVxLJU, 5219.1.000000004321529a.0000000083867b0a.rw-.sdmp, bma2DVxLJU, 5221.1.000000004321529a.0000000083867b0a.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: bma2DVxLJU, 5221.1.000000004321529a.0000000083867b0a.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: bma2DVxLJU, type: SAMPLE
Source: Yara match	File source: 5219.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5217.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5215.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5221.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: bma2DVxLJU, type: SAMPLE
Source: Yara match	File source: 5219.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5217.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5215.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5221.1.00000000fc366953.000000004c5df7fc.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Masquerading1	OS Credential Dumping	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	File Deletion1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bma2DVxLJU	62%	Virustotal		Browse
bma2DVxLJU	69%	ReversingLabs	Linux.Trojan.Gafgyt
bma2DVxLJU	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://199.19.225.2/bins.sh;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	bma2DVxLJU	false		high
http://www.billybobbot.com/crawler/)	bma2DVxLJU	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	bma2DVxLJU	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	bma2DVxLJU	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	bma2DVxLJU	false		high
http://199.19.225.2/bins.sh;	bma2DVxLJU	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
41.84.238.158	unknown	Swaziland	19711	SWAZINETSZ	false
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
85.237.217.143	unknown	United Kingdom	21321	ARETI-ASGB	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Runtime Messages

Command:	/tmp/bma2DVxLJU
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	[97m[[38;5;202mORBIT[97m] [38;5;202mArch: [97mARM3 [38;5;202mType: [97mLITTLE_ENDIAN
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
54.171.230.55	N2MGGp7k8b	Get hash	malicious	Browse
	7H8oT3jp4u	Get hash	malicious	Browse
	sora.arm	Get hash	malicious	Browse
	sora.arm7	Get hash	malicious	Browse
	6zSiGCDasa	Get hash	malicious	Browse
	vgyyuv0rbB	Get hash	malicious	Browse
	YEzAruTNql	Get hash	malicious	Browse
	IHBlr47ubD	Get hash	malicious	Browse
	a-r.m-4.Sakura	Get hash	malicious	Browse
	oeOZvHnuaU	Get hash	malicious	Browse
	bscbcOPL3h	Get hash	malicious	Browse
	F8YPW1P3c9	Get hash	malicious	Browse
	Mips	Get hash	malicious	Browse
	dnPvdw44MX	Get hash	malicious	Browse
	l4CMAgnQ8I	Get hash	malicious	Browse
	Dl1TFSfQd7	Get hash	malicious	Browse
	a.r.m.v.6.l	Get hash	malicious	Browse
	uSY5H9rWjc	Get hash	malicious	Browse
	mirai.x86	Get hash	malicious	Browse
	GRlRUtO6hC	Get hash	malicious	Browse
85.237.217.143	Y4oxs3w2uO	Get hash	malicious	Browse
	A2n1Xa05af	Get hash	malicious	Browse
	HF6zp1MUDf	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	xyLAkjzDP1	Get hash	malicious	Browse
	p9aYSEPY1g	Get hash	malicious	Browse
	J7OXgvNcYx	Get hash	malicious	Browse
	iCJoZJ1iF0	Get hash	malicious	Browse
	kMDTne1K4H	Get hash	malicious	Browse
	7evGU3Z12H	Get hash	malicious	Browse
	O0eBrHuHOR	Get hash	malicious	Browse
	lp4eZYDISa	Get hash	malicious	Browse
	utCF3oKE7j	Get hash	malicious	Browse
	9xmBK8Yk7L	Get hash	malicious	Browse
	5C68yKuI05	Get hash	malicious	Browse
	OuTRctwVMc	Get hash	malicious	Browse
109.202.202.202	Y4oxs3w2uO	Get hash	malicious	Browse
	A2n1Xa05af	Get hash	malicious	Browse
	HF6zp1MUDf	Get hash	malicious	Browse
	ub46olxdcc	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	TtG027KDqC	Get hash	malicious	Browse
	Iif5nK0q3o	Get hash	malicious	Browse
	TTOSJWnF92	Get hash	malicious	Browse
	N2MGGp7k8b	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	7H8oT3jp4u	Get hash	malicious	Browse
	3Z3SEO82Tw	Get hash	malicious	Browse
	fhrRmQOge6	Get hash	malicious	Browse
	2k2LHrePaX	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	HuA8rX5Gnk	Get hash	malicious	Browse
	D5MDE1XXvY	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARETI-ASGB	Y4oxs3w2uO	Get hash	malicious	Browse	85.237.217.143
	A2n1Xa05af	Get hash	malicious	Browse	85.237.217.143
	HF6zp1MUDf	Get hash	malicious	Browse	85.237.217.143
	cDHvd1tp2x	Get hash	malicious	Browse	85.237.217.143
	QwKoHC7f1c	Get hash	malicious	Browse	85.237.217.143
	iCRrgdO9hl	Get hash	malicious	Browse	85.237.217.143
	pvtH5neadB	Get hash	malicious	Browse	85.237.217.143
	xMeY7xXFRE	Get hash	malicious	Browse	85.237.217.143
	xyLAkjzDP1	Get hash	malicious	Browse	85.237.217.143
	p9aYSEPY1g	Get hash	malicious	Browse	85.237.217.143
	J7OXgvNcYx	Get hash	malicious	Browse	85.237.217.143
	iCJoZJ1iF0	Get hash	malicious	Browse	85.237.217.143
	kMDTne1K4H	Get hash	malicious	Browse	85.237.217.143
	7evGU3Z12H	Get hash	malicious	Browse	85.237.217.143
	O0eBrHuHOR	Get hash	malicious	Browse	85.237.217.143
	lp4eZYDISa	Get hash	malicious	Browse	85.237.217.143
	utCF3oKE7j	Get hash	malicious	Browse	85.237.217.143
	9xmBK8Yk7L	Get hash	malicious	Browse	85.237.217.143
	5C68yKuI05	Get hash	malicious	Browse	85.237.217.143
	OuTRctwVMc	Get hash	malicious	Browse	85.237.217.143
SWAZINETSZ	41n4ENhbOS	Get hash	malicious	Browse	41.84.248.46
	kXqGXU4kX2	Get hash	malicious	Browse	41.84.228.65
	2dcq81Lgzt	Get hash	malicious	Browse	41.84.247.99
	OJZQHntp1y	Get hash	malicious	Browse	41.84.235.237
	jkQ4kKwd53	Get hash	malicious	Browse	41.84.238.114
	jE208RVF59	Get hash	malicious	Browse	41.84.237.16
	Check.vbs	Get hash	malicious	Browse	69.63.65.50
AMAZON-02US	5K9q55OzDu	Get hash	malicious	Browse	100.21.235.140
	PO NO. 019-B.K2021.xlsx	Get hash	malicious	Browse	44.227.76.166
	HF6zp1MUDf	Get hash	malicious	Browse	34.249.145.219
	R8G2kiLTEj	Get hash	malicious	Browse	18.182.39.181
	Iif5nK0q3o	Get hash	malicious	Browse	34.249.145.219
	N2MGGp7k8b	Get hash	malicious	Browse	54.171.230.55
	eaGU6Cv0gg.exe	Get hash	malicious	Browse	52.216.92.51
	My7DDV8cjV	Get hash	malicious	Browse	34.249.145.219
	7H8oT3jp4u	Get hash	malicious	Browse	54.171.230.55
	EZ7OmyYi89	Get hash	malicious	Browse	34.223.83.102
	Ro4o8Vo8fo	Get hash	malicious	Browse	63.34.74.38
	2k2LHrePaX	Get hash	malicious	Browse	34.249.145.219
	oFoByyFHMA	Get hash	malicious	Browse	35.74.129.56
	cbr.arm7	Get hash	malicious	Browse	34.249.145.219
	ljykUFS2Jn	Get hash	malicious	Browse	108.131.163.86
	911.x86	Get hash	malicious	Browse	108.151.82.201
	IU65U1j0PR	Get hash	malicious	Browse	184.169.138.28
	QQBGV828134.VBS	Get hash	malicious	Browse	13.225.74.45
	HCLGT440605.VBS	Get hash	malicious	Browse	13.225.74.45
	911.arm	Get hash	malicious	Browse	18.252.179.124
INIT7CH	Y4oxs3w2uO	Get hash	malicious	Browse	109.202.202.202
	A2n1Xa05af	Get hash	malicious	Browse	109.202.202.202
	HF6zp1MUDf	Get hash	malicious	Browse	109.202.202.202
	ub46olxdcc	Get hash	malicious	Browse	109.202.202.202
	cDHvd1tp2x	Get hash	malicious	Browse	109.202.202.202
	TtG027KDqC	Get hash	malicious	Browse	109.202.202.202
	Iif5nK0q3o	Get hash	malicious	Browse	109.202.202.202
	TTOSJWnF92	Get hash	malicious	Browse	109.202.202.202
	N2MGGp7k8b	Get hash	malicious	Browse	109.202.202.202
	QwKoHC7f1c	Get hash	malicious	Browse	109.202.202.202
	iCRrgdO9hl	Get hash	malicious	Browse	109.202.202.202
	pvtH5neadB	Get hash	malicious	Browse	109.202.202.202
	My7DDV8cjV	Get hash	malicious	Browse	109.202.202.202
	7H8oT3jp4u	Get hash	malicious	Browse	109.202.202.202
	3Z3SEO82Tw	Get hash	malicious	Browse	109.202.202.202
	fhrRmQOge6	Get hash	malicious	Browse	109.202.202.202
	2k2LHrePaX	Get hash	malicious	Browse	109.202.202.202
	xMeY7xXFRE	Get hash	malicious	Browse	109.202.202.202
	HuA8rX5Gnk	Get hash	malicious	Browse	109.202.202.202
	D5MDE1XXvY	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf Download File
Process:	/tmp/bma2DVxLJU
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.3918926446809334
Encrypted:	false
SSDEEP:	3:KkZRAkd:KaAu
MD5:	C7EA09D26E26605227076E0514A33038
SHA1:	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E
SHA-256:	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
SHA-512:	17D0088725EB9991E9EB82E8A3DE0878E45E6F394BBC2AD260AA59C786FF0AD565E145E21256425D1C0ABE15F3ECB402EBB0A6A5E1C2D5BA7A4D95EC93A2861F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	nameserver 8.8.8.8.nameserver 8.8.4.4.

Static File Info

General
File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.951846153620754
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bma2DVxLJU
File size:	120771
MD5:	09c1353cc4eeb91eb01f7db6a5104e5c
SHA1:	9204da939afbdfcb12262fe318df9cf12195a952
SHA256:	c7bb07aa85d39e30001cb631ca2a8132d24557040338ff1d66aeba4de1c3e379
SHA512:	d2bd7e2ce39bca89ea145b7f3f3ae79529d826d131907c01e88437f4af01bd23f8857101e74a35ae9b0e11978523057a980fa22a269b754b30490932ebf7218e
SSDEEP:	3072:0JDZ+6lJQTnoo3AK5nnyXxfWx5hLFWuXUSP4eoC9DQlD6ObAF5R:7nyBux5hLFWuVhoC9DQlD6ObAF5R
File Content Preview:	.ELF...a..........(.........4....i......4. ...(......................M...M...............P...P...P......(i..........Q.td..................................-...L."....E..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	92576
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x11690	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19740	0x11740	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19754	0x11754	0x36a4	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1cdf8	0x14df8	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x25000	0x15000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x25008	0x15008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x25010	0x15010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x25014	0x15014	0x5ac	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x255c0	0x155c0	0x6368	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x155c0	0xb9e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x16160	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x16200	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1650c	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x16570	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x16858	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x168f8	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16cc0	0x45f0	0x10	0x0		19	624	4
.strtab	STRTAB	0x0	0x1b2b0	0x2513	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x14dfc	0x14dfc	3.7206	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x15000	0x25000	0x25000	0x5c0	0x6928	1.8980	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19740	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19754	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1cdf8	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x25000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x25008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x25010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x25014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x255c0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19740	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1974c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19750	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x852c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa2bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xada4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd15c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdde8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfbdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1152c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1169c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1171c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1180c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1183c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1192c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1309c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1332c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1389c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1404c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1426c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1432c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1469c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1495c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1559c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1600c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1765c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1824c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1907c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x25008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2501c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x912c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x928c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9c08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc218	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b24c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc4d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd13c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xddd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfb6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10614	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x107c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2525c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x25264	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2526c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1bd90	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11d70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ee0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x133c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13880	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x253a8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x13d30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1403c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x254b0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x140b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x254c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1447c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1454c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c9bc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1467c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2557c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14afc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ea0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x151d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25594	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x152e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15444	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25598	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x2b82c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x155d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd14	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x167f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x255a4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x175fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1763c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ce4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17dc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18244	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1866c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192bc	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.261.5946	.symtab	0x1b24c	104	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0x12da8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x12dc4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x255f8	16384	OBJECT	<unknown>	DEFAULT	10
SendDOMINATE	.symtab	0xd7b4	1588	FUNC	<unknown>	DEFAULT	2
SendHTTP	.symtab	0xdde8	364	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0xdf54	356	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xc330	420	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0xcae8	1652	FUNC	<unknown>	DEFAULT	2
TelnetIPRanges	.symtab	0xa2bc	1016	FUNC	<unknown>	DEFAULT	2
TelnetScanner	.symtab	0xaadc	6008	FUNC	<unknown>	DEFAULT	2
UpdateBins	.symtab	0xeb90	92	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0x10728	168	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x25004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x25000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x2525c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1b790	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x25598	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1c9fe	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x25264	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1ba90	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2500c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x25008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1cdf8	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1cdf8	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x2525c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1b790	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x25598	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1c9fe	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x25264	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1ba90	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x25260	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x2559c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x25268	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x11a30	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x19114	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13194	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x155c8	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1152c	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x115a0	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x117a0	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14eb0	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14f60	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x131a8	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x115f0	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x13f04	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x14688	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x14688	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17604	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x11644	44	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x15354	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x11670	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1389c	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2b82c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x148c8	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x15380	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x14834	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x17688	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1152c	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x115a0	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17f18	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x19114	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17d44	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x180fc	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x17808	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1169c	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12bc0	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17814	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17820	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12bf4	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x19114	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x116c8	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x153ac	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x153d8	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x15404	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x134e4	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x13528	884	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x15430	24	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x116f0	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11748	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x15448	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2b830	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x134c0	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x169b4	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x134b4	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x13434	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x187d4	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x18460	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x14488	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x15474	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x13338	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11774	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1907c	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16700	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x12cb0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x166f0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x167fc	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16814	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x12cc0	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x154c4	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x117a0	92	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1765c	44	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x11a3c	60	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x175c8	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x14050	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1432c	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x18194	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1183c	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x138f8	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x154f0	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11868	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13924	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13950	52	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x11898	104	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x11900	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x1192c	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13984	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1426c	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x15208	228	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x139e0	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x15548	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1495c	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x139b4	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11a78	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x143bc	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x19244	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x13290	156	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x12de0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x12d60	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x12d60	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x12ee8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x18364	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x12d80	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x1824c	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x12f04	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x12fbc	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x16974	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x18314	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1309c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1332c	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16900	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x14694	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x14b00	944	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x13358	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11984	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x190e0	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x119fc	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x152f0	40	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x11cc4	188	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11aac	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1559c	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x119b0	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x155d4	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15644	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15624	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x119b8	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x25010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x25010	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x195c4	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x114d8	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x196ec	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x114d8	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x11218	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x11310	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2b820	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x2557c	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x139e0	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x2b928	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x255c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x255c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14f28	56	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x25260	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x2559c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x25268	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2b850	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x25014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x18c44	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x19368	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18b1c	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x15324	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x15320	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x114d8	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x195c4	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x16aa0	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x19704	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x25018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x192c0	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x18a34	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x18bd4	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2b928	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2b818	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x11a30	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x15314	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2b810	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x19114	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x17580	72	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x15430	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x13194	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x155c8	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x13d48	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x13e10	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x13ddc	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x13dfc	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x19434	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x18c30	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x11670	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1389c	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x117fc	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1152c	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x115a0	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1169c	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x116f0	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1907c	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x154c4	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x117a0	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x1765c	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1183c	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x138f8	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11868	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13924	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13950	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x15208	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2b814	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x14550	312	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x119b0	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x119b8	44	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x253a8	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x2b7f4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x2b8e4	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x113f4	228	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x114dc	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x2b90c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2b918	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x18d20	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x172ac	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2b81c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x14f1c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14f1c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14f1c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14f1c	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14f1c	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x14f24	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x175c8	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x18d54	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x255a4	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2b824	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2b8fc	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2b91c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x13abc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13ae0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13a98	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x25278	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x19480	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x15700	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17950	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x157bc	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x11bcc	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1bd90	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x194dc	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17d14	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x19508	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x158f4	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x11c94	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2527c	4	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x17640	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x15328	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x14eb0	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14f60	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14fbc	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x25594	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x11218	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x11328	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x152f0	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x131a8	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x2b928	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x11d80	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x175e0	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2b920	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2b924	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x255c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2b928	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2b82c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x115f0	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19740	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x29600	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x11dcc	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x15bec	1640	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2b830	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x159f8	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16260	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x12444	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x126fc	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x124dc	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x12514	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x126b0	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x14f24	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14f24	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2b864	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x17a1c	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x11b5c	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x25280	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x25284	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x17dd8	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x295fc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x2529c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x295f8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x252b8	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x11bdc	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x252b4	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1469c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15a68	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1be60	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x15a9c	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x11e50	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x13f04	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x11618	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x8798	112	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x25084	64	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x25138	44	OBJECT	<unknown>	DEFAULT	9
atoi	.symtab	0x14688	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x14688	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0xc4d4	1556	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x12ca0	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2b80c	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x2b828	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x17604	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x139e0	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x2b604	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x2b614	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x25254	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x19738	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x11644	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x15354	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x11670	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x25024	4	OBJECT	<unknown>	DEFAULT	9
completed.2555	.symtab	0x255c0	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x1389c	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x97f8	640	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x84fc	48	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x852c	96	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x83f4	216	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x84cc	48	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x117fc	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xa714	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x25164	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x25020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2b818	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2b82c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x148c8	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x15380	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x14834	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1cd14	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x250c4	44	OBJECT	<unknown>	DEFAULT	9
fclose	.symtab	0x17688	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1152c	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x115a0	80	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x17f18	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x19114	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17d44	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x180fc	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1cd00	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x17808	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x25014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x255bc	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x1169c	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x12bc0	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x13c58	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x17814	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x17814	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17820	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x12bf4	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x81cc	28	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0x107d0	276	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x9438	100	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0xa6b4	96	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x9f0c	944	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x8760	56	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x19114	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x116c8	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x153ac	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x153d8	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x15404	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x134e4	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x13528	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x15430	24	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x116f0	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1171c	44	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x11748	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x138c8	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x15448	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4900	.symtab	0x2b7e0	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2b830	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x133fc	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x13420	20	FUNC	<unknown>	DEFAULT	2
i.4277	.symtab	0x25258	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x12de0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x134c0	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x169b4	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x134b4	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x13434	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x187d4	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x18670	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x18460	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x18394	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10498	392	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81e8	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x253ac	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x14158	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x14488	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x15474	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5058	.symtab	0x255ee	4	OBJECT	<unknown>	DEFAULT	10
ipState.5160	.symtab	0x255f2	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x13338	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x119e4	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x11774	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9a78	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x1907c	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x255e8	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x108e4	2356	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x255dc	4	OBJECT	<unknown>	DEFAULT	10
makeFukdString	.symtab	0x10620	156	FUNC	<unknown>	DEFAULT	2
makeIPPacket	.symtab	0xa97c	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x949c	136	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x13b04	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x9d9c	368	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x16700	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x12cb0	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x166f0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x167fc	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x16814	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x12cc0	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x254b0	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x254c8	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2b834	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x154c4	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x9c10	396	FUNC	<unknown>	DEFAULT	2
next_start.1066	.symtab	0x2b600	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x133c4	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x133e8	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x255e0	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x255c4	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x117a0	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2b854	4	OBJECT	<unknown>	DEFAULT	10
ourPublicIP	.symtab	0x2b858	4	OBJECT	<unknown>	DEFAULT	10
p.2553	.symtab	0x2501c	0	OBJECT	<unknown>	DEFAULT	9
payload	.symtab	0x25028	4	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x2b860	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x1765c	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x1180c	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x1bdb8	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8d40	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8968	108	FUNC	<unknown>	DEFAULT	2
printf	.symtab	0x11a3c	60	FUNC	<unknown>	DEFAULT	2
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printi	.symtab	0x8b58	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x89d4	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xebec	6316	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x1bdcc	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x175c8	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1404c	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82bc	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x14050	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1c9bc	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1432c	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x254fc	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x18194	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x1183c	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x86b4	172	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x858c	296	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x138f8	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x9524	724	FUNC	<unknown>	DEFAULT	2
reset_telstate	.symtab	0x8808	48	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0xd2a8	1292	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x154f0	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x2b85c	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0xaa90	76	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x11868	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x13924	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendCNC	.symtab	0xc254	220	FUNC	<unknown>	DEFAULT	2
sendHOLD	.symtab	0xe5d0	1472	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0xe0b8	1304	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x13950	52	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0x11898	104	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0x11900	44	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0x1192c	44	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x13984	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x140cc	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1426c	192	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0x11958	44	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x15208	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x139e0	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x15548	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1495c	420	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x139b4	44	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2021 19:23:18.421430111 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:23:18.448729992 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:23:18.448817015 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:23:19.028733969 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 19:23:19.796753883 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 19:23:20.824223995 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:23:20.850667000 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:23:22.100780964 CET	33608	443	192.168.2.23	54.171.230.55
Dec 5, 2021 19:23:25.434561014 CET	23	53068	41.84.238.158	192.168.2.23
Dec 5, 2021 19:23:25.434910059 CET	53068	23	192.168.2.23	41.84.238.158
Dec 5, 2021 19:23:34.388164043 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 19:23:36.581018925 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:23:36.581340075 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:23:38.317878008 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:23:38.318136930 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:23:44.627453089 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 19:23:49.127473116 CET	33608	443	192.168.2.23	54.171.230.55
Dec 5, 2021 19:23:49.184655905 CET	443	33608	54.171.230.55	192.168.2.23
Dec 5, 2021 19:23:50.771184921 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 19:24:15.345983028 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 19:24:35.824964046 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 19:24:36.248086929 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:24:36.248394966 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:24:36.274408102 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:24:36.274672031 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:25:36.250592947 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:25:36.250919104 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:25:36.277065039 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:25:36.277317047 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:26:36.252670050 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:26:36.252975941 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:26:36.279233932 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:26:36.279475927 CET	36272	42516	192.168.2.23	85.237.217.143

System Behavior

Analysis Process: bma2DVxLJU PID: 5215 Parent PID: 5110

General

Start time:	19:23:17
Start date:	05/12/2021
Path:	/tmp/bma2DVxLJU
Arguments:	/tmp/bma2DVxLJU
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5217 Parent PID: 5215

General

Start time:	19:23:17
Start date:	05/12/2021
Path:	/tmp/bma2DVxLJU
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5219 Parent PID: 5217

General

Start time:	19:23:17
Start date:	05/12/2021
Path:	/tmp/bma2DVxLJU
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5221 Parent PID: 5219

General

Start time:	19:23:17
Start date:	05/12/2021
Path:	/tmp/bma2DVxLJU
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5222 Parent PID: 5219

General

Start time:	19:23:17
Start date:	05/12/2021
Path:	/tmp/bma2DVxLJU
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dash PID: 5257 Parent PID: 4331

General

Start time:	19:23:48
Start date:	05/12/2021
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5257 Parent PID: 4331

General

Start time:	19:23:48
Start date:	05/12/2021
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.5JyNPT6mIk /tmp/tmp.TnzWmQLzoK /tmp/tmp.iRD5EJv67W
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report bma2DVxLJU

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: bma2DVxLJU PID: 5215 Parent PID: 5110

General

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5217 Parent PID: 5215

General

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5219 Parent PID: 5217

General

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5221 Parent PID: 5219

General

Chronological Activities

Analysis Process: bma2DVxLJU PID: 5222 Parent PID: 5219

General

Chronological Activities

Analysis Process: dash PID: 5257 Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 5257 Parent PID: 4331

General

Chronological Activities