Play interactive tour

Edit tour

Linux Analysis Report o31VFjGke4

Overview

General Information

Sample Name:	o31VFjGke4
Analysis ID:	534268
MD5:	66ac7264d14cc5ed8579bee0cbed5eca
SHA1:	b410f7ea3b80e765acf666e4afb93e4aab156c3e
SHA256:	c75d0198821ad75b24d4ad3853e39d3d2f0b7fd04c88b1205ceaef6bb1f53857
Tags:	32elfgafgytrenesas
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	534268
Start date:	05.12.2021
Start time:	19:55:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	o31VFjGke4
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal68.troj.lin@0/1@0/0

Process Tree

system is lnxubuntu20

o31VFjGke4 (PID: 5222, Parent: 5119, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/o31VFjGke4

o31VFjGke4 New Fork (PID: 5224, Parent: 5222)

o31VFjGke4 New Fork (PID: 5226, Parent: 5224)

o31VFjGke4 New Fork (PID: 5228, Parent: 5226)

o31VFjGke4 New Fork (PID: 5229, Parent: 5226)

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
o31VFjGke4	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5226.1.00000000bd10e271.0000000075583f93.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5222.1.00000000bd10e271.0000000075583f93.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5224.1.00000000bd10e271.0000000075583f93.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: o31VFjGke4

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: o31VFjGke4	Virustotal: Detection: 61%			Perma Link
Source: o31VFjGke4	ReversingLabs: Detection: 71%

Networking:

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 85.237.217.143 ports 42516,1,2,4,5,6

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:36272 -> 85.237.217.143:42516

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 114.36.216.158

Source: o31VFjGke4	String found in binary or memory: http://199.19.225.2/bins.sh;
Source: o31VFjGke4	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: o31VFjGke4	String found in binary or memory: http://feedback.redkolibri.com/
Source: o31VFjGke4	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: o31VFjGke4	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: o31VFjGke4	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: ELF static info symbol of initial sample	Name: TelnetScanner
Source: ELF static info symbol of initial sample	Name: payload
Source: ELF static info symbol of initial sample	Name: tel_passwords
Source: ELF static info symbol of initial sample	Name: tel_usernames

Source: Initial sample

String containing 'busybox' found: busybox

Source: classification engine

Classification label: mal68.troj.lin@0/1@0/0

Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: libc/string/sh/sh4/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sh/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sh/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sh/crtn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sh/vfork.S

Source: /tmp/o31VFjGke4 (PID: 5222)

Queries kernel information via 'uname':

Jump to behavior

Source: o31VFjGke4, 5222.1.00000000a5d1894e.000000009b74a1fd.rw-.sdmp, o31VFjGke4, 5224.1.00000000a5d1894e.000000009b74a1fd.rw-.sdmp, o31VFjGke4, 5226.1.00000000a5d1894e.000000009b74a1fd.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: o31VFjGke4, 5222.1.00000000a5d1894e.000000009b74a1fd.rw-.sdmp, o31VFjGke4, 5224.1.00000000a5d1894e.000000009b74a1fd.rw-.sdmp, o31VFjGke4, 5226.1.00000000a5d1894e.000000009b74a1fd.rw-.sdmp	Binary or memory string: ~x86_64/usr/bin/qemu-sh4/tmp/o31VFjGke4SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/o31VFjGke4
Source: o31VFjGke4, 5222.1.00000000beced9b9.00000000d68c4594.rw-.sdmp, o31VFjGke4, 5224.1.00000000beced9b9.00000000d68c4594.rw-.sdmp, o31VFjGke4, 5226.1.00000000beced9b9.00000000d68c4594.rw-.sdmp	Binary or memory string: 2SV5!/etc/qemu-binfmt/sh4
Source: o31VFjGke4, 5222.1.00000000beced9b9.00000000d68c4594.rw-.sdmp, o31VFjGke4, 5224.1.00000000beced9b9.00000000d68c4594.rw-.sdmp, o31VFjGke4, 5226.1.00000000beced9b9.00000000d68c4594.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: o31VFjGke4, type: SAMPLE
Source: Yara match	File source: 5226.1.00000000bd10e271.0000000075583f93.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5222.1.00000000bd10e271.0000000075583f93.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5224.1.00000000bd10e271.0000000075583f93.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: o31VFjGke4, type: SAMPLE
Source: Yara match	File source: 5226.1.00000000bd10e271.0000000075583f93.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5222.1.00000000bd10e271.0000000075583f93.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5224.1.00000000bd10e271.0000000075583f93.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Masquerading1	OS Credential Dumping	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
o31VFjGke4	62%	Virustotal		Browse
o31VFjGke4	71%	ReversingLabs	Linux.Trojan.Gafgyt
o31VFjGke4	100%	Avira	LINUX/Agent.SH.B

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://199.19.225.2/bins.sh;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	o31VFjGke4	false		high
http://www.billybobbot.com/crawler/)	o31VFjGke4	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	o31VFjGke4	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	o31VFjGke4	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	o31VFjGke4	false		high
http://199.19.225.2/bins.sh;	o31VFjGke4	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
85.237.217.143	unknown	United Kingdom	21321	ARETI-ASGB	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
114.36.216.158	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Runtime Messages

Command:	/tmp/o31VFjGke4
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	[97m[[38;5;202mORBIT[97m] [38;5;202mArch: [97mSUPERH [38;5;202mType: [97mLITTLE_ENDIAN
Standard Error:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
85.237.217.143	RreGDgoc6K	Get hash	malicious	Browse
	bma2DVxLJU	Get hash	malicious	Browse
	Y4oxs3w2uO	Get hash	malicious	Browse
	A2n1Xa05af	Get hash	malicious	Browse
	HF6zp1MUDf	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	xyLAkjzDP1	Get hash	malicious	Browse
	p9aYSEPY1g	Get hash	malicious	Browse
	J7OXgvNcYx	Get hash	malicious	Browse
	iCJoZJ1iF0	Get hash	malicious	Browse
	kMDTne1K4H	Get hash	malicious	Browse
	7evGU3Z12H	Get hash	malicious	Browse
	O0eBrHuHOR	Get hash	malicious	Browse
	lp4eZYDISa	Get hash	malicious	Browse
	utCF3oKE7j	Get hash	malicious	Browse
	9xmBK8Yk7L	Get hash	malicious	Browse
109.202.202.202	PfHYV05wuX	Get hash	malicious	Browse
	RreGDgoc6K	Get hash	malicious	Browse
	bma2DVxLJU	Get hash	malicious	Browse
	Y4oxs3w2uO	Get hash	malicious	Browse
	A2n1Xa05af	Get hash	malicious	Browse
	HF6zp1MUDf	Get hash	malicious	Browse
	ub46olxdcc	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	TtG027KDqC	Get hash	malicious	Browse
	Iif5nK0q3o	Get hash	malicious	Browse
	TTOSJWnF92	Get hash	malicious	Browse
	N2MGGp7k8b	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	7H8oT3jp4u	Get hash	malicious	Browse
	3Z3SEO82Tw	Get hash	malicious	Browse
	fhrRmQOge6	Get hash	malicious	Browse
	2k2LHrePaX	Get hash	malicious	Browse
91.189.91.43	PfHYV05wuX	Get hash	malicious	Browse
	RreGDgoc6K	Get hash	malicious	Browse
	bma2DVxLJU	Get hash	malicious	Browse
	Y4oxs3w2uO	Get hash	malicious	Browse
	A2n1Xa05af	Get hash	malicious	Browse
	HF6zp1MUDf	Get hash	malicious	Browse
	ub46olxdcc	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	TtG027KDqC	Get hash	malicious	Browse
	Iif5nK0q3o	Get hash	malicious	Browse
	TTOSJWnF92	Get hash	malicious	Browse
	N2MGGp7k8b	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	7H8oT3jp4u	Get hash	malicious	Browse
	3Z3SEO82Tw	Get hash	malicious	Browse
	fhrRmQOge6	Get hash	malicious	Browse
	2k2LHrePaX	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HINETDataCommunicationBusinessGroupTW	dAiS5AtJMh	Get hash	malicious	Browse	211.20.192.191
	E16TvLJm2w	Get hash	malicious	Browse	1.169.140.33
	IQLcuS0QV5	Get hash	malicious	Browse	111.250.252.40
	5U20tqaX3b	Get hash	malicious	Browse	118.163.46.251
	AlgaXNcGVm	Get hash	malicious	Browse	36.229.124.243
	#Uc9c8#Ubcd1#Uad00#Ub9ac#Uccad COOV.apk	Get hash	malicious	Browse	114.44.231.229
	#Uad50#Ud1b5#Ubbfc#Uc6d024(#Uc774#Ud30c#Uc778).apk	Get hash	malicious	Browse	114.44.231.229
	8BIKTv5wXr	Get hash	malicious	Browse	211.20.10.75
	5r63A9I65E	Get hash	malicious	Browse	211.23.119.114
	GuSrMsLH0y	Get hash	malicious	Browse	125.236.11.229
	arm7	Get hash	malicious	Browse	59.116.185.7
	arm	Get hash	malicious	Browse	61.225.11.74
	2dcCZuwb6G.exe	Get hash	malicious	Browse	59.120.105.223
	oNQGFI5lP0	Get hash	malicious	Browse	61.218.1.240
	sora.x86	Get hash	malicious	Browse	218.171.14.117
	HQW8IDsXuQ	Get hash	malicious	Browse	59.120.183.244
	nKv4cxjIx6	Get hash	malicious	Browse	122.121.178.24
	77ZNda8ADY	Get hash	malicious	Browse	125.226.158.58
	LT3PftxFsP	Get hash	malicious	Browse	118.165.34.134
	trynagetmybinsufucker98575.arm7	Get hash	malicious	Browse	111.245.251.7
ARETI-ASGB	RreGDgoc6K	Get hash	malicious	Browse	85.237.217.143
	bma2DVxLJU	Get hash	malicious	Browse	85.237.217.143
	Y4oxs3w2uO	Get hash	malicious	Browse	85.237.217.143
	A2n1Xa05af	Get hash	malicious	Browse	85.237.217.143
	HF6zp1MUDf	Get hash	malicious	Browse	85.237.217.143
	cDHvd1tp2x	Get hash	malicious	Browse	85.237.217.143
	QwKoHC7f1c	Get hash	malicious	Browse	85.237.217.143
	iCRrgdO9hl	Get hash	malicious	Browse	85.237.217.143
	pvtH5neadB	Get hash	malicious	Browse	85.237.217.143
	xMeY7xXFRE	Get hash	malicious	Browse	85.237.217.143
	xyLAkjzDP1	Get hash	malicious	Browse	85.237.217.143
	p9aYSEPY1g	Get hash	malicious	Browse	85.237.217.143
	J7OXgvNcYx	Get hash	malicious	Browse	85.237.217.143
	iCJoZJ1iF0	Get hash	malicious	Browse	85.237.217.143
	kMDTne1K4H	Get hash	malicious	Browse	85.237.217.143
	7evGU3Z12H	Get hash	malicious	Browse	85.237.217.143
	O0eBrHuHOR	Get hash	malicious	Browse	85.237.217.143
	lp4eZYDISa	Get hash	malicious	Browse	85.237.217.143
	utCF3oKE7j	Get hash	malicious	Browse	85.237.217.143
	9xmBK8Yk7L	Get hash	malicious	Browse	85.237.217.143
INIT7CH	PfHYV05wuX	Get hash	malicious	Browse	109.202.202.202
	RreGDgoc6K	Get hash	malicious	Browse	109.202.202.202
	bma2DVxLJU	Get hash	malicious	Browse	109.202.202.202
	Y4oxs3w2uO	Get hash	malicious	Browse	109.202.202.202
	A2n1Xa05af	Get hash	malicious	Browse	109.202.202.202
	HF6zp1MUDf	Get hash	malicious	Browse	109.202.202.202
	ub46olxdcc	Get hash	malicious	Browse	109.202.202.202
	cDHvd1tp2x	Get hash	malicious	Browse	109.202.202.202
	TtG027KDqC	Get hash	malicious	Browse	109.202.202.202
	Iif5nK0q3o	Get hash	malicious	Browse	109.202.202.202
	TTOSJWnF92	Get hash	malicious	Browse	109.202.202.202
	N2MGGp7k8b	Get hash	malicious	Browse	109.202.202.202
	QwKoHC7f1c	Get hash	malicious	Browse	109.202.202.202
	iCRrgdO9hl	Get hash	malicious	Browse	109.202.202.202
	pvtH5neadB	Get hash	malicious	Browse	109.202.202.202
	My7DDV8cjV	Get hash	malicious	Browse	109.202.202.202
	7H8oT3jp4u	Get hash	malicious	Browse	109.202.202.202
	3Z3SEO82Tw	Get hash	malicious	Browse	109.202.202.202
	fhrRmQOge6	Get hash	malicious	Browse	109.202.202.202
	2k2LHrePaX	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf Download File
Process:	/tmp/o31VFjGke4
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.3918926446809334
Encrypted:	false
SSDEEP:	3:KkZRAkd:KaAu
MD5:	C7EA09D26E26605227076E0514A33038
SHA1:	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E
SHA-256:	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
SHA-512:	17D0088725EB9991E9EB82E8A3DE0878E45E6F394BBC2AD260AA59C786FF0AD565E145E21256425D1C0ABE15F3ECB402EBB0A6A5E1C2D5BA7A4D95EC93A2861F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	nameserver 8.8.8.8.nameserver 8.8.4.4.

Static File Info

General
File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.680648449837015
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	o31VFjGke4
File size:	108419
MD5:	66ac7264d14cc5ed8579bee0cbed5eca
SHA1:	b410f7ea3b80e765acf666e4afb93e4aab156c3e
SHA256:	c75d0198821ad75b24d4ad3853e39d3d2f0b7fd04c88b1205ceaef6bb1f53857
SHA512:	78ca4c1c5a0a7b1d6a9708f1bb3180ff4cb626d645a6866ceb034cfe664d5052f6513f7ce5472415c51d134e2926a25dbb93b739c6969e1cca3d26e232f4ba55
SSDEEP:	3072:moNToIWzKoFIon14X5hLwfecr68LkY0Px9gQNfR:TNUz2Ej4X5hLwfecrfLkY0Px9gQNfR
File Content Preview:	.ELF.....................@.4....R......4. ...(...............@...@..A...A...............A...AB..AB.....0i..........Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	86740
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x4000e0	0xe0	0x109c0	0x0	0x6	AX	0	0	32
.fini	PROGBITS	0x410aa0	0x10aa0	0x24	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x410ac4	0x10ac4	0x363c	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x414100	0x14100	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x424104	0x14104	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x42410c	0x1410c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x424114	0x14114	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x424118	0x14118	0x5a4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x4246bc	0x146bc	0x10	0x4	0x3	WA	0	0	4
.bss	NOBITS	0x4246cc	0x146cc	0x6368	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x146cc	0xb9a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x15266	0x6b	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x15554	0x2eb0	0x10	0x0		15	269	4
.strtab	STRTAB	0x0	0x18404	0x237f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x14104	0x14104	5.0680	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x14104	0x424104	0x424104	0x5c8	0x6930	2.6139	0x6	RW	0x10000	.ctors .dtors .jcr .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x400094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x4000e0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x410aa0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x410ac4	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x414100	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x424104	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x42410c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x424114	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x424118	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x4246bc	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x4246cc	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
L1	.symtab	0x4097d8	0	NOTYPE	<unknown>	DEFAULT	2
L_abort	.symtab	0x4001d0	0	NOTYPE	<unknown>	DEFAULT	2
L_fini	.symtab	0x4001c8	0	NOTYPE	<unknown>	DEFAULT	2
L_init	.symtab	0x4001c4	0	NOTYPE	<unknown>	DEFAULT	2
L_main	.symtab	0x4001c0	0	NOTYPE	<unknown>	DEFAULT	2
L_uClibc_main	.symtab	0x4001cc	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x424704	16384	OBJECT	<unknown>	DEFAULT	11
SendDOMINATE	.symtab	0x4057b8	1392	FUNC	<unknown>	DEFAULT	2
SendHTTP	.symtab	0x405d28	524	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x405f34	508	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x4043d0	912	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0x404c9c	1452	FUNC	<unknown>	DEFAULT	2
TelnetIPRanges	.symtab	0x402508	1152	FUNC	<unknown>	DEFAULT	2
TelnetScanner	.symtab	0x402d08	5604	FUNC	<unknown>	DEFAULT	2
UpdateBins	.symtab	0x406d84	108	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0x408e50	164	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x4246bc	0	OBJECT	<unknown>	HIDDEN	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x424108	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x424104	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x42435c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x412a98	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x424698	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x413d06	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x424364	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x412d98	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x424110	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x42410c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x414100	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x414100	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x42435c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x412a98	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x424698	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x413d06	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x424364	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x412d98	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x424360	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x42469c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x424368	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x409e7c	20	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x410688	216	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x40b658	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x40d5ec	20	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x4097e0	172	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x40988c	152	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x409b48	160	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x40cf30	104	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40cffc	80	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x40b678	200	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x409924	48	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x40c244	244	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x40c898	24	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x40c898	24	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x40998c	56	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x40d328	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x4099c4	56	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x40bc9c	40	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x42a938	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x40ca78	228	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x40d360	56	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x40ca08	112	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x40f148	272	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x4097e0	172	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x40988c	152	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40f7cc	320	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x410688	216	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x40f674	120	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x40f90c	128	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x40f258	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x4099fc	56	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x40ae98	68	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x40f270	28	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x40f28c	232	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x40aedc	156	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x410688	216	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x409a34	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x40d398	56	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x40d3d0	56	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x40d408	56	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x40b9a8	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x40b9f0	684	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x40d440	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x409a68	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x409ad8	56	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x40d45c	56	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x42a93c	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x40b97c	44	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x40e5d8	204	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x40b964	24	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x40b8ec	120	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40feac	492	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40fbd8	408	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x40c6f8	176	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x40d494	148	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x40b7c8	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x409b10	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x410600	96	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40dfa8	204	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x40b000	636	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x40e074	978	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40e448	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x40e46c	204	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x40b280	124	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x40d528	56	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x409b48	160	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x40f110	56	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x409e90	132	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x40ef74	40	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x40c34c	100	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x40c5cc	104	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x40f98c	152	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x409c34	56	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x40bcf0	40	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40d220	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x409c6c	52	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x40bd18	40	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x40bd40	48	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x409ca0	108	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x409d0c	56	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x409d44	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x40bd70	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x40c4f4	216	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x40ef9c	160	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x40bdc4	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x40d560	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x40cb5c	376	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x40bd9c	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x409f14	132	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x40c634	196	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x410760	64	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x40b758	88	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x40b2fc	192	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x40b3bc	34	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x40b3bc	34	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x40b3de	30	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40faf0	76	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x40b3fc	136	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x40fa24	154	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x40b484	142	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x40b514	132	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x40e5b0	40	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x40fabe	48	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x40b598	192	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x40b7b0	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x40e538	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40c8b0	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x40ccd4	604	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x40b7ec	116	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x409db4	56	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x410660	40	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x409e54	40	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x40d280	54	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x40a190	164	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x409f98	168	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40d5b4	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x409dec	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40d600	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40d664	112	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40d644	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x409e00	56	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x424114	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x424114	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x42a92c	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x42467c	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x40bdc4	184	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x4246cc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40cfb2	74	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x424360	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x42469c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x424368	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x42a95c	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x424118	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x410274	228	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x41084c	200	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x410158	148	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x40e6a4	1604	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x410a60	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x4000e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x424118	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x4107a0	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x410098	192	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x4101ec	104	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x42a924	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x409e7c	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x42a91c	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x410688	216	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x424104	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x424104	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x40ef40	52	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x40d440	28	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x40b658	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x40d5ec	20	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x40c0f4	98	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x40c194	176	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x40c158	34	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x40c17a	26	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x424104	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x424104	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_brk	.symtab	0x40f094	68	FUNC	<unknown>	HIDDEN	2
__init_brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__length_dotted	.symtab	0x410914	64	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x410254	32	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x4099c4	56	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x40bc9c	40	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x409be8	24	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x4097e0	172	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x40988c	152	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x4099fc	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x409a68	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x410600	96	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x40d528	56	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x409b48	160	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x40f110	56	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x409c34	56	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x40bcf0	40	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x409c6c	52	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x40bd18	40	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x40bd40	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x40ef9c	160	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x42a920	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x40c7a8	240	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x409dec	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x409e00	56	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x4244a8	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x42a900	24	OBJECT	<unknown>	DEFAULT	11
__malloc_sbrk_lock	.symtab	0x42a9f0	24	OBJECT	<unknown>	DEFAULT	11
__nameserver	.symtab	0x42aa18	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x42aa24	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x410358	68	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x40ece8	600	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x42a928	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x424104	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x424104	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40cf98	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x40cf98	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x40cf98	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x40cf98	14	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x40cf98	14	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x40cfa6	12	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x40ef74	40	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x41039c	612	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x4246a4	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x42a930	4	OBJECT	<unknown>	HIDDEN	11
__sdivsi3_i4	.symtab	0x410a4c	14	FUNC	<unknown>	HIDDEN	2
__searchdomain	.symtab	0x42aa08	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x42aa28	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x40bea8	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x40bed0	42	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x40be7c	44	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x40d2f0	56	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x424378	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x410954	80	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40d6d4	148	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x40f374	180	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40d768	264	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x40a0ac	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3812	.symtab	0x413098	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x4109a4	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x40f640	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x4109d4	120	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40d870	176	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x40a15c	52	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x42437c	4	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x40d2c0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x40f0d8	56	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x40cf30	104	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40cffc	80	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x40d04c	468	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x424694	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3_i4	.symtab	0x4097b0	48	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x40d280	54	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x40b678	200	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_brk	.symtab	0x40f05c	56	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x40a234	80	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x40f03c	32	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x42aa2c	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x42aa30	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x4246cc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x42aa34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x42a938	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x409924	48	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x410aa0	12	FUNC	<unknown>	HIDDEN	3
_fixed_buffers	.symtab	0x42870c	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x40a284	124	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40dab8	1264	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x42a93c	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x400094	12	FUNC	<unknown>	HIDDEN	1
_load_inttype	.symtab	0x40d920	92	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x40a844	120	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x40ab10	902	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x40a8bc	72	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x40a904	464	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x40aad4	60	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x40cfa6	12	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40cfa6	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x42a970	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x4001a0	30	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40f428	536	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x40a040	108	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x424380	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x424384	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40f6ec	224	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x428708	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x42439c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x428704	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x4243b8	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x40a0c8	148	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x4243b4	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40c8c4	324	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40d97c	56	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x413168	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40d9b4	260	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x40a300	1348	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x40c244	244	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x409954	56	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x400790	120	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x424184	64	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x424238	44	OBJECT	<unknown>	DEFAULT	9
atoi	.symtab	0x40c898	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x40c898	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x404760	1340	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x40b740	24	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x42a918	4	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2753	.symtab	0x42a934	4	OBJECT	<unknown>	DEFAULT	11
bsd_signal	.symtab	0x40bdc4	184	FUNC	<unknown>	DEFAULT	2
buf.2577	.symtab	0x42a710	16	OBJECT	<unknown>	DEFAULT	11
buf.4814	.symtab	0x42a720	460	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x424354	4	OBJECT	<unknown>	DEFAULT	9
chdir	.symtab	0x40998c	56	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
client.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x40d328	56	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x4099c4	56	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x424124	4	OBJECT	<unknown>	DEFAULT	9
completed.2217	.symtab	0x4246cc	1	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x40bc9c	40	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x4019ac	772	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x4004a8	56	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x4004e0	88	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x4003ac	196	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x400470	56	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x409be8	24	FUNC	<unknown>	DEFAULT	2
crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x4029e4	232	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x424264	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x424120	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x42a924	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x42a938	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x40ca78	228	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x40d360	56	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x40ca08	112	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x41401c	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x4241c4	44	OBJECT	<unknown>	DEFAULT	9
fclose	.symtab	0x40f148	272	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x4097e0	172	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x40988c	152	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x40f7cc	320	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x410688	216	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40f674	120	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40f90c	128	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x414008	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x40f258	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x4099fc	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x40ae98	68	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400140	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x40c004	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x40f270	28	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x40f270	28	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x40f28c	232	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x40aedc	156	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x4001d4	20	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0x408ef4	200	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x401554	84	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x402988	92	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x4020c8	1088	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x400750	64	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x410688	216	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x409a34	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x40d398	56	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x40d3d0	56	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40d408	56	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x40b9a8	72	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x40b9f0	684	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x40d440	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x409a68	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x409aa0	56	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x409ad8	56	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x40bcc4	44	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40d45c	56	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4813	.symtab	0x42a8ec	20	OBJECT	<unknown>	DEFAULT	11
h_errno	.symtab	0x42a93c	4	OBJECT	<unknown>	DEFAULT	11
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x40b8a6	46	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x40b8d4	22	FUNC	<unknown>	DEFAULT	2
i.4233	.symtab	0x424358	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x40b2fc	192	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x40b97c	44	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x40e5d8	204	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x40b964	24	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x40b8ec	120	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40feac	492	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40fd70	316	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40fbd8	408	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40fb3c	156	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x408bac	340	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x4001e8	180	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x4244ac	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x40c41c	120	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x40c6f8	176	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x40d494	148	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5054	.symtab	0x4246fc	4	OBJECT	<unknown>	DEFAULT	11
ipState.5156	.symtab	0x424700	4	OBJECT	<unknown>	DEFAULT	11
isatty	.symtab	0x40b7c8	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x409e38	28	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x409b10	56	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sh/sh4/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sh/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x401cb0	308	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x410600	96	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x4246f4	6	OBJECT	<unknown>	DEFAULT	11
main	.symtab	0x408fbc	2036	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x4246e8	4	OBJECT	<unknown>	DEFAULT	11
makeFukdString	.symtab	0x408d00	208	FUNC	<unknown>	DEFAULT	2
makeIPPacket	.symtab	0x402be0	224	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x4015a8	156	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x40befc	264	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x401f60	360	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x40dfa8	204	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x40b000	636	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x40e074	978	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40e448	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x40e46c	204	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x40b280	124	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x4245b0	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x4245c8	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x42a940	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x40d528	56	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x401de4	380	FUNC	<unknown>	DEFAULT	2
next_start.1030	.symtab	0x42a70c	4	OBJECT	<unknown>	DEFAULT	11
ntohl	.symtab	0x40b860	48	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x40b890	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x4246ec	8	OBJECT	<unknown>	DEFAULT	11
object.2270	.symtab	0x4246d0	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x409b48	160	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x42a960	4	OBJECT	<unknown>	DEFAULT	11
ourPublicIP	.symtab	0x42a964	4	OBJECT	<unknown>	DEFAULT	11
p.2215	.symtab	0x42411c	0	OBJECT	<unknown>	DEFAULT	9
payload	.symtab	0x424128	4	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x42a96c	4	OBJECT	<unknown>	DEFAULT	11
poll	.symtab	0x40f110	56	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x409c00	52	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4023	.symtab	0x4130c0	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x400cd0	1072	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x400978	104	FUNC	<unknown>	DEFAULT	2
printf	.symtab	0x409e90	132	FUNC	<unknown>	DEFAULT	2
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printi	.symtab	0x400b38	408	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x4009e0	344	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x406df0	7612	FUNC	<unknown>	DEFAULT	2
qual_chars.4029	.symtab	0x4130d4	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x40ef74	40	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x40c338	20	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x40029c	272	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x40c34c	100	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x413cc4	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x40c5cc	104	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x4245fc	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x40f98c	152	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x409c34	56	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x4006b0	160	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x400538	376	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x40bcf0	40	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x401644	872	FUNC	<unknown>	DEFAULT	2
reset_telstate	.symtab	0x400808	60	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x405368	1104	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x40d220	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x42a968	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x402cc0	72	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x409c6c	52	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x40bd18	40	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendCNC	.symtab	0x4042ec	228	FUNC	<unknown>	DEFAULT	2
sendHOLD	.symtab	0x4066f0	1684	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x406130	1472	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x40bd40	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0x409ca0	108	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0x409d0c	56	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0x409d44	56	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x40bd70	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x40c3b0	108	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x40c4f4	216	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0x409d7c	56	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x40ef9c	160	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x40bdc4	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x40d560	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x40cb5c	376	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x40bd9c	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x405248	288	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x401270	388	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4028	.symtab	0x4130e8	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4022	.symtab	0x4130cc	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4025	.symtab	0x413114	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4024	.symtab	0x41312c	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4027	.symtab	0x4130f8	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4026	.symtab	0x413108	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x409f14	132	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x40c494	96	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x40c494	96	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x40c634	196	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x4246a0	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x42a958	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x424374	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x42436c	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x424370	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x410760	64	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x40b758	88	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x40b2fc	192	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x40b3bc	34	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x40b3bc	34	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x40b3de	30	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x40faf0	76	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x40b678	200	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x40b3fc	136	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x40fa24	154	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x40b484	142	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x40b514	132	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x40e5b0	40	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x40fabe	48	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x40b598	192	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x40b7b0	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x40e538	120	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40c8b0	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
successes	.symtab	0x4241f0	72	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x40ccd4	604	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x40c7a8	240	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x4011b4	188	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x40b7ec	116	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x402acc	276	FUNC	<unknown>	DEFAULT	2
tel_passwords	.symtab	0x424144	24	OBJECT	<unknown>	DEFAULT	9
tel_usernames	.symtab	0x42412c	24	OBJECT	<unknown>	DEFAULT	9
tempdirs	.symtab	0x42415c	40	OBJECT	<unknown>	DEFAULT	9
time	.symtab	0x409db4	56	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x410660	40	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x408dd0	128	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x409e54	40	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x400844	308	FUNC	<unknown>	DEFAULT	2
trivial	.symtab	0x4097d4	0	NOTYPE	<unknown>	DEFAULT	2
type_codes	.symtab	0x413134	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x41314c	12	OBJECT	<unknown>	DEFAULT	4
unknown.1072	.symtab	0x413158	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x4245e0	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x424268	236	OBJECT	<unknown>	DEFAULT	9
vfork	.symtab	0x40d280	54	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x40a190	164	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x409f98	168	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x40d5b4	56	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x409dec	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40d600	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40d664	112	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40d644	32	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x4013f4	352	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x409e00	56	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3026	.symtab	0x4140c8	17	OBJECT	<unknown>	DEFAULT	4
zprintf	.symtab	0x401100	180	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2021 19:55:53.241592884 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:55:53.267916918 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:55:53.268049955 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:55:53.553455114 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:55:53.580734015 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:55:55.622204065 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 19:55:56.390360117 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 19:56:10.727550983 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 19:56:23.016819000 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 19:56:27.113141060 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 19:56:36.340233088 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:56:36.340549946 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:56:36.370615005 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:56:36.370805025 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:56:51.691489935 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 19:57:36.340078115 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:57:36.340488911 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:57:36.366630077 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:57:36.367005110 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:58:36.355612040 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:58:36.355827093 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:58:36.413182974 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 19:58:36.413321018 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 19:59:09.231950045 CET	23	53680	114.36.216.158	192.168.2.23
Dec 5, 2021 19:59:09.232306957 CET	53680	23	192.168.2.23	114.36.216.158

System Behavior

Analysis Process: o31VFjGke4 PID: 5222 Parent PID: 5119

General

Start time:	19:55:52
Start date:	05/12/2021
Path:	/tmp/o31VFjGke4
Arguments:	/tmp/o31VFjGke4
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: o31VFjGke4 PID: 5224 Parent PID: 5222

General

Start time:	19:55:52
Start date:	05/12/2021
Path:	/tmp/o31VFjGke4
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: o31VFjGke4 PID: 5226 Parent PID: 5224

General

Start time:	19:55:52
Start date:	05/12/2021
Path:	/tmp/o31VFjGke4
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: o31VFjGke4 PID: 5228 Parent PID: 5226

General

Start time:	19:55:52
Start date:	05/12/2021
Path:	/tmp/o31VFjGke4
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: o31VFjGke4 PID: 5229 Parent PID: 5226

General

Start time:	19:55:52
Start date:	05/12/2021
Path:	/tmp/o31VFjGke4
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report o31VFjGke4

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: o31VFjGke4 PID: 5222 Parent PID: 5119

General

Chronological Activities

Analysis Process: o31VFjGke4 PID: 5224 Parent PID: 5222

General

Chronological Activities

Analysis Process: o31VFjGke4 PID: 5226 Parent PID: 5224

General

Chronological Activities

Analysis Process: o31VFjGke4 PID: 5228 Parent PID: 5226

General

Analysis Process: o31VFjGke4 PID: 5229 Parent PID: 5226

General

Chronological Activities