Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
cayo.i486.elf

Overview

General Information

Sample name:cayo.i486.elf
Analysis ID:1521417
MD5:79510a83213cde59c1c632bb6bdcb9c0
SHA1:a0a3057a26ca1054c94a4c27f644f992642f1f67
SHA256:f5efef378c943e90573562bcc5ba254872259303fe7c0a44092c57ef9e88d836
Tags:cayoelfuser-NDA0E
Infos:

Detection

Mirai, Gafgyt
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Gafgyt
Yara detected Mirai
Contains symbols with names commonly found in malware
Machine Learning detection for sample
Opens /proc/net/* files useful for finding connected devices and routers
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample contains strings that are user agent strings indicative of HTTP manipulation
Yara signature match

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1521417
Start date and time:2024-09-28 10:34:08 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 53s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:cayo.i486.elf
Detection:MAL
Classification:mal100.spre.troj.linELF@0/0@2/0

Warnings

  • VT rate limit hit for: cayo.i486.elf

Runtime Messages

Command:/tmp/cayo.i486.elf
PID:5433
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 5412, Parent: 3579)
  • rm (PID: 5412, Parent: 3579, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.gwY62oDfHc /tmp/tmp.eq3MmwQRU8 /tmp/tmp.4pNKbmBgxQ
  • dash New Fork (PID: 5413, Parent: 3579)
  • cat (PID: 5413, Parent: 3579, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.gwY62oDfHc
  • dash New Fork (PID: 5414, Parent: 3579)
  • head (PID: 5414, Parent: 3579, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5415, Parent: 3579)
  • tr (PID: 5415, Parent: 3579, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5416, Parent: 3579)
  • cut (PID: 5416, Parent: 3579, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5419, Parent: 3579)
  • cat (PID: 5419, Parent: 3579, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.gwY62oDfHc
  • dash New Fork (PID: 5420, Parent: 3579)
  • head (PID: 5420, Parent: 3579, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5421, Parent: 3579)
  • tr (PID: 5421, Parent: 3579, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5422, Parent: 3579)
  • cut (PID: 5422, Parent: 3579, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5423, Parent: 3579)
  • rm (PID: 5423, Parent: 3579, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.gwY62oDfHc /tmp/tmp.eq3MmwQRU8 /tmp/tmp.4pNKbmBgxQ
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
cayo.i486.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    cayo.i486.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      cayo.i486.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xf17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf21c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf26c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf2a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf2bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf2d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf2e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf2f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf30c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      cayo.i486.elfLinux_Trojan_Gafgyt_c573932bunknownunknown
      • 0x957:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
      cayo.i486.elfLinux_Trojan_Gafgyt_7167d08funknownunknown
      • 0x9f4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
      Click to see the 3 entries

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      5435.1.0000000008048000.000000000805b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5435.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xf17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf1e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf1f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf21c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf26c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf2a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf2bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf2d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf2e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf2f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf30c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        5435.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_c573932bunknownunknown
        • 0x957:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
        5435.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_7167d08funknownunknown
        • 0x9f4:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
        5435.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_9127f7beunknownunknown
        • 0x126e:$a: E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1
        Click to see the 22 entries

        Suricata Signatures

        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2024-09-28T10:34:54.975022+020028405151Malware Command and Control Activity Detected192.168.2.1337354207.244.199.838008TCP
        2024-09-28T10:35:10.543421+020028405151Malware Command and Control Activity Detected192.168.2.1337356207.244.199.838008TCP
        2024-09-28T10:35:26.105890+020028405151Malware Command and Control Activity Detected192.168.2.1337358207.244.199.838008TCP
        2024-09-28T10:35:41.688246+020028405151Malware Command and Control Activity Detected192.168.2.1337360207.244.199.838008TCP
        2024-09-28T10:35:57.266201+020028405151Malware Command and Control Activity Detected192.168.2.1337362207.244.199.838008TCP
        2024-09-28T10:36:12.840797+020028405151Malware Command and Control Activity Detected192.168.2.1337364207.244.199.838008TCP
        2024-09-28T10:36:28.433814+020028405151Malware Command and Control Activity Detected192.168.2.1337366207.244.199.838008TCP
        2024-09-28T10:36:44.035450+020028405151Malware Command and Control Activity Detected192.168.2.1337368207.244.199.838008TCP
        2024-09-28T10:36:59.751331+020028405151Malware Command and Control Activity Detected192.168.2.1337370207.244.199.838008TCP
        2024-09-28T10:37:15.395625+020028405151Malware Command and Control Activity Detected192.168.2.1337372207.244.199.838008TCP
        2024-09-28T10:37:30.978352+020028405151Malware Command and Control Activity Detected192.168.2.1337374207.244.199.838008TCP
        2024-09-28T10:37:46.530769+020028405151Malware Command and Control Activity Detected192.168.2.1337376207.244.199.838008TCP
        2024-09-28T10:38:02.113477+020028405151Malware Command and Control Activity Detected192.168.2.1337378207.244.199.838008TCP
        2024-09-28T10:38:17.673880+020028405151Malware Command and Control Activity Detected192.168.2.1337380207.244.199.838008TCP
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2024-09-28T10:34:55.533836+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337354TCP
        2024-09-28T10:35:11.094063+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337356TCP
        2024-09-28T10:35:26.676734+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337358TCP
        2024-09-28T10:35:42.254395+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337360TCP
        2024-09-28T10:35:57.829286+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337362TCP
        2024-09-28T10:36:13.409713+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337364TCP
        2024-09-28T10:36:29.023774+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337366TCP
        2024-09-28T10:36:44.738630+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337368TCP
        2024-09-28T10:37:00.382929+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337370TCP
        2024-09-28T10:37:15.965672+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337372TCP
        2024-09-28T10:37:31.516655+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337374TCP
        2024-09-28T10:37:47.103768+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337376TCP
        2024-09-28T10:38:02.661821+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337378TCP
        2024-09-28T10:38:18.229964+020028405161Malware Command and Control Activity Detected207.244.199.838008192.168.2.1337380TCP

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: cayo.i486.elfAvira: detected
        Multi AV Scanner detection for submitted file
        Source: cayo.i486.elfReversingLabs: Detection: 68%
        Machine Learning detection for sample
        Source: cayo.i486.elfJoe Sandbox ML: detected

        Spreading

        barindex
        Opens /proc/net/* files useful for finding connected devices and routers
        Source: /tmp/cayo.i486.elf (PID: 5433)Opens: /proc/net/routeJump to behavior

        Networking

        barindex
        Suricata IDS alerts for network traffic
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37364 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37380 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37374 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37356 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37366 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37354 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37364
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37360 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37366
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37374
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37380
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37356
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37358 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37362 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37354
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37362
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37360
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37358
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37368 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37372 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37378 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37370 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37368
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37378
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37370
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37372
        Source: Network trafficSuricata IDS: 2840515 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586) : 192.168.2.13:37376 -> 207.244.199.83:8008
        Source: Network trafficSuricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.13:37376
        Source: global trafficTCP traffic: 192.168.2.13:37354 -> 207.244.199.83:8008
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: unknownTCP traffic detected without corresponding DNS query: 207.244.199.83
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be Author: unknown
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
        Source: Process Memory Space: cayo.i486.elf PID: 5433, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: cayo.i486.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: cayo.i486.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Contains symbols with names commonly found in malware
        Source: ELF static info symbol of initial sampleName: vseattack
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
        Source: cayo.i486.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
        Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
        Source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9127f7be reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375, id = 9127f7be-6e82-46a1-9f11-0b3570b0cd76, last_modified = 2021-09-16
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
        Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
        Source: Process Memory Space: cayo.i486.elf PID: 5433, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: cayo.i486.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: cayo.i486.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: classification engineClassification label: mal100.spre.troj.linELF@0/0@2/0
        Source: /usr/bin/dash (PID: 5412)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.gwY62oDfHc /tmp/tmp.eq3MmwQRU8 /tmp/tmp.4pNKbmBgxQJump to behavior
        Source: /usr/bin/dash (PID: 5423)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.gwY62oDfHc /tmp/tmp.eq3MmwQRU8 /tmp/tmp.4pNKbmBgxQJump to behavior

        Stealing of Sensitive Information

        barindex
        Yara detected Gafgyt
        Source: Yara matchFile source: cayo.i486.elf, type: SAMPLE
        Yara detected Mirai
        Source: Yara matchFile source: cayo.i486.elf, type: SAMPLE
        Source: Yara matchFile source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: cayo.i486.elf PID: 5433, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: cayo.i486.elf PID: 5435, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: cayo.i486.elf PID: 5436, type: MEMORYSTR
        Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
        Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
        Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
        Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
        Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
        Source: Initial sampleUser agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
        Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
        Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
        Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
        Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

        Remote Access Functionality

        barindex
        Detected Mirai
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Source: TrafficSuricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
        Yara detected Gafgyt
        Source: Yara matchFile source: cayo.i486.elf, type: SAMPLE
        Yara detected Mirai
        Source: Yara matchFile source: cayo.i486.elf, type: SAMPLE
        Source: Yara matchFile source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5433.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: cayo.i486.elf PID: 5433, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: cayo.i486.elf PID: 5435, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: cayo.i486.elf PID: 5436, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
        File Deletion        		OS Credential Dumping1
        Remote System Discovery        		Remote ServicesData from Local System1
        Data Obfuscation        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Standard Port        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Non-Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Application Layer Protocol        		Traffic DuplicationData Destruction

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1521417 Sample: cayo.i486.elf Startdate: 28/09/2024 Architecture: LINUX Score: 100 23 207.244.199.83, 37354, 37356, 37358 CDMUS United States 2->23 25 daisy.ubuntu.com 2->25 27 Suricata IDS alerts for network traffic 2->27 29 Malicious sample detected (through community Yara rule) 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 6 other signatures 2->33 8 dash rm cayo.i486.elf 2->8         started        11 dash rm 2->11         started        13 dash tr 2->13         started        15 7 other processes 2->15 signatures3 process4 signatures5 35 Opens /proc/net/* files useful for finding connected devices and routers 8->35 17 cayo.i486.elf 8->17         started        19 cayo.i486.elf 8->19         started        process6 process7 21 cayo.i486.elf 17->21         started       

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        cayo.i486.elf68%ReversingLabsLinux.Trojan.LnxGafgyt
        cayo.i486.elf100%AviraEXP/ELF.Mirai.Z
        cayo.i486.elf100%Joe Sandbox ML

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        		162.213.35.25
        		truefalse
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          207.244.199.83
          		unknownUnited States
          		6428CDMUStrue

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          daisy.ubuntu.comeWOLEi2hJg.elfGet hashmaliciousConnectBackBrowse
          • 162.213.35.24
          SecuriteInfo.com.ELF.FastReverseProxy-D.16458.15476.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25
          pl.spc.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.25
          pl.x86.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.24
          pl.arm5.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.24
          pl.m68.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.25
          pl.mips.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.25
          pl.ppc.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.25
          pl.sh4.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.25
          pl.arm4t.elfGet hashmaliciousGafgytBrowse
          • 162.213.35.24

          ASNs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          CDMUS0umBa15TaN.exeGet hashmaliciousUnknownBrowse
          • 209.145.55.141
          0umBa15TaN.exeGet hashmaliciousUnknownBrowse
          • 209.145.55.141
          file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
          • 209.145.56.187
          file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
          • 209.145.56.187
          file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
          • 209.145.56.187
          mirai.mpsl.elfGet hashmaliciousMiraiBrowse
          • 206.225.9.249
          ExeFile (38).exeGet hashmaliciousNjratBrowse
          • 209.145.56.0
          x86.elfGet hashmaliciousUnknownBrowse
          • 205.242.185.140
          axVz9A9D3U.exeGet hashmaliciousUnknownBrowse
          • 209.145.48.30
          axVz9A9D3U.exeGet hashmaliciousUnknownBrowse
          • 209.145.48.30

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
          Entropy (8bit):6.471973408773856
          TrID:
          • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
          • ELF Executable and Linkable format (generic) (4004/1) 49.84%
          File name:cayo.i486.elf
          File size:107'030 bytes
          MD5:79510a83213cde59c1c632bb6bdcb9c0
          SHA1:a0a3057a26ca1054c94a4c27f644f992642f1f67
          SHA256:f5efef378c943e90573562bcc5ba254872259303fe7c0a44092c57ef9e88d836
          SHA512:57d7a6c4d1e20636c90734c7ccbdc6a26851e18a3a8887b527ce79c6192f52464d54b1adb4c53fb98dc84fd00eaf1d6fac667eda51509dcb267da1bde53e4b48
          SSDEEP:3072:6d2D8qziU7ybdp2I5JJ9wN8GR3qmFK0AXF3kY:6d2RziYydpZJKN8GR3qmFK0AXF3kY
          TLSH:1AA33A72A261C073C58306B601E79F2A0D31EEF72B4A5917E36C3EF0AE36580B555E6D
          File Content Preview:.ELF........................4....;......4. ...(......................"..."..............."..........0...x{...............(..........................Q.td............................U..S.......'8...x....C...[]...$.............U......=.....t..D..............

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:Intel 80386
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x8048194
          Flags:0x0
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:4
          Section Header Offset:80664
          Section Header Size:40
          Number of Section Headers:19
          Header String Table Index:16

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x80480b40xb40x1c0x00x6AX001
          .textPROGBITS0x80480d00xd00xdf740x00x6AX0016
          .finiPROGBITS0x80560440xe0440x170x00x6AX001
          .rodataPROGBITS0x80560600xe0600x42640x00x2A0032
          .eh_framePROGBITS0x805b2c40x122c40x60c0x00x3WA004
          .tbssNOBITS0x805b8d00x128d00x80x00x403WAT004
          .ctorsPROGBITS0x805b8d00x128d00x80x00x3WA004
          .dtorsPROGBITS0x805b8d80x128d80x80x00x3WA004
          .jcrPROGBITS0x805b8e00x128e00x40x00x3WA004
          .got.pltPROGBITS0x805b8e40x128e40xc0x40x3WA004
          .dataPROGBITS0x805b9000x129000x2f40x00x3WA0032
          .bssNOBITS0x805bc000x12bf40x723c0x00x3WA0032
          .stabPROGBITS0x00x12bf40x1380xc0x01404
          .stabstrSTRTAB0x00x12d2c0xf60x00x0001
          .commentPROGBITS0x00x12e220xc720x00x0001
          .shstrtabSTRTAB0x00x13a940x840x00x0001
          .symtabSYMTAB0x00x13e100x38f00x100x0183444
          .strtabSTRTAB0x00x177000x2b160x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x80480000x80480000x122c40x122c46.63290x5R E0x1000.init .text .fini .rodata
          LOAD0x122c40x805b2c40x805b2c40x9300x7b784.79090x6RW 0x1000.eh_frame .tbss .ctors .dtors .jcr .got.plt .data .bss
          TLS0x128d00x805b8d00x805b8d00x00x80.00000x4R 0x4.tbss
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

          Symbols

          NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
          .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          .symtab0x80480b40SECTION<unknown>DEFAULT1
          .symtab0x80480d00SECTION<unknown>DEFAULT2
          .symtab0x80560440SECTION<unknown>DEFAULT3
          .symtab0x80560600SECTION<unknown>DEFAULT4
          .symtab0x805b2c40SECTION<unknown>DEFAULT5
          .symtab0x805b8d00SECTION<unknown>DEFAULT6
          .symtab0x805b8d00SECTION<unknown>DEFAULT7
          .symtab0x805b8d80SECTION<unknown>DEFAULT8
          .symtab0x805b8e00SECTION<unknown>DEFAULT9
          .symtab0x805b8e40SECTION<unknown>DEFAULT10
          .symtab0x805b9000SECTION<unknown>DEFAULT11
          .symtab0x805bc000SECTION<unknown>DEFAULT12
          .symtab0x00SECTION<unknown>DEFAULT13
          .symtab0x00SECTION<unknown>DEFAULT14
          .symtab0x00SECTION<unknown>DEFAULT15
          C.11.5136.symtab0x8059e2824OBJECT<unknown>DEFAULT4
          C.147.6966.symtab0x8057e4044OBJECT<unknown>DEFAULT4
          C.177.7258.symtab0x8057ea812OBJECT<unknown>DEFAULT4
          C.178.7259.symtab0x8057e8420OBJECT<unknown>DEFAULT4
          KHcommSOCK.symtab0x805bc204OBJECT<unknown>DEFAULT12
          KHserverHACKER.symtab0x805b9d04OBJECT<unknown>DEFAULT11
          POPBX1.symtab0x805149f0NOTYPE<unknown>DEFAULT2
          POPBX1.symtab0x80514ff0NOTYPE<unknown>DEFAULT2
          POPBX1.symtab0x805155f0NOTYPE<unknown>DEFAULT2
          POPBX1.symtab0x80515bf0NOTYPE<unknown>DEFAULT2
          PUSHBX1.symtab0x805148b0NOTYPE<unknown>DEFAULT2
          PUSHBX1.symtab0x80514eb0NOTYPE<unknown>DEFAULT2
          PUSHBX1.symtab0x805154b0NOTYPE<unknown>DEFAULT2
          PUSHBX1.symtab0x80515ab0NOTYPE<unknown>DEFAULT2
          Q.symtab0x805bc4016384OBJECT<unknown>DEFAULT12
          RESTBX1.symtab0x80514490NOTYPE<unknown>DEFAULT2
          SAVEBX1.symtab0x805143c0NOTYPE<unknown>DEFAULT2
          UserAgents.symtab0x805b940144OBJECT<unknown>DEFAULT11
          _Exit.symtab0x804de1866FUNC<unknown>DEFAULT2
          _GLOBAL_OFFSET_TABLE_.symtab0x805b8e40OBJECT<unknown>HIDDEN10
          _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          _L_lock_103.symtab0x805240616FUNC<unknown>DEFAULT2
          _L_lock_12.symtab0x805353f16FUNC<unknown>DEFAULT2
          _L_lock_140.symtab0x805357f16FUNC<unknown>DEFAULT2
          _L_lock_160.symtab0x805359f16FUNC<unknown>DEFAULT2
          _L_lock_17.symtab0x805322a10FUNC<unknown>DEFAULT2
          _L_lock_18.symtab0x80523cc13FUNC<unknown>DEFAULT2
          _L_lock_191.symtab0x80535bf13FUNC<unknown>DEFAULT2
          _L_lock_198.symtab0x80526d416FUNC<unknown>DEFAULT2
          _L_lock_209.symtab0x80526e416FUNC<unknown>DEFAULT2
          _L_lock_27.symtab0x80512ac16FUNC<unknown>DEFAULT2
          _L_lock_29.symtab0x805354f16FUNC<unknown>DEFAULT2
          _L_lock_32.symtab0x805319d10FUNC<unknown>DEFAULT2
          _L_lock_34.symtab0x805437e13FUNC<unknown>DEFAULT2
          _L_lock_54.symtab0x80523d916FUNC<unknown>DEFAULT2
          _L_lock_70.symtab0x80511ac16FUNC<unknown>DEFAULT2
          _L_unlock_101.symtab0x805438b10FUNC<unknown>DEFAULT2
          _L_unlock_102.symtab0x805356f16FUNC<unknown>DEFAULT2
          _L_unlock_113.symtab0x805241613FUNC<unknown>DEFAULT2
          _L_unlock_152.symtab0x805358f16FUNC<unknown>DEFAULT2
          _L_unlock_167.symtab0x80511bc13FUNC<unknown>DEFAULT2
          _L_unlock_170.symtab0x80535af16FUNC<unknown>DEFAULT2
          _L_unlock_225.symtab0x80526f413FUNC<unknown>DEFAULT2
          _L_unlock_232.symtab0x80535cc13FUNC<unknown>DEFAULT2
          _L_unlock_235.symtab0x805270113FUNC<unknown>DEFAULT2
          _L_unlock_40.symtab0x805323410FUNC<unknown>DEFAULT2
          _L_unlock_61.symtab0x80531a710FUNC<unknown>DEFAULT2
          _L_unlock_66.symtab0x80523e916FUNC<unknown>DEFAULT2
          _L_unlock_83.symtab0x80523f913FUNC<unknown>DEFAULT2
          _L_unlock_86.symtab0x805355f16FUNC<unknown>DEFAULT2
          _L_unlock_89.symtab0x80512bc13FUNC<unknown>DEFAULT2
          _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __CTOR_END__.symtab0x805b8d40OBJECT<unknown>DEFAULT7
          __CTOR_LIST__.symtab0x805b8d00OBJECT<unknown>DEFAULT7
          __C_ctype_b.symtab0x805b9e44OBJECT<unknown>DEFAULT11
          __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_b_data.symtab0x80587f8768OBJECT<unknown>DEFAULT4
          __C_ctype_tolower.symtab0x805bbec4OBJECT<unknown>DEFAULT11
          __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_tolower_data.symtab0x8059fc4768OBJECT<unknown>DEFAULT4
          __C_ctype_toupper.symtab0x805b9ec4OBJECT<unknown>DEFAULT11
          __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_toupper_data.symtab0x8058af8768OBJECT<unknown>DEFAULT4
          __DTOR_END__.symtab0x805b8dc0OBJECT<unknown>DEFAULT8
          __DTOR_LIST__.symtab0x805b8d80OBJECT<unknown>DEFAULT8
          __EH_FRAME_BEGIN__.symtab0x805b2c40OBJECT<unknown>DEFAULT5
          __FRAME_END__.symtab0x805b8cc0OBJECT<unknown>DEFAULT5
          __GI___C_ctype_b.symtab0x805b9e44OBJECT<unknown>HIDDEN11
          __GI___C_ctype_tolower.symtab0x805bbec4OBJECT<unknown>HIDDEN11
          __GI___C_ctype_toupper.symtab0x805b9ec4OBJECT<unknown>HIDDEN11
          __GI___close.symtab0x805143080FUNC<unknown>HIDDEN2
          __GI___close_nocancel.symtab0x805143a27FUNC<unknown>HIDDEN2
          __GI___ctype_b.symtab0x805b9e84OBJECT<unknown>HIDDEN11
          __GI___ctype_tolower.symtab0x805bbf04OBJECT<unknown>HIDDEN11
          __GI___ctype_toupper.symtab0x805b9f04OBJECT<unknown>HIDDEN11
          __GI___errno_location.symtab0x804e16813FUNC<unknown>HIDDEN2
          __GI___fcntl_nocancel.symtab0x804dd2c83FUNC<unknown>HIDDEN2
          __GI___fgetc_unlocked.symtab0x80535dc204FUNC<unknown>HIDDEN2
          __GI___glibc_strerror_r.symtab0x804f17426FUNC<unknown>HIDDEN2
          __GI___libc_close.symtab0x805143080FUNC<unknown>HIDDEN2
          __GI___libc_fcntl.symtab0x804dd7f153FUNC<unknown>HIDDEN2
          __GI___libc_open.symtab0x805148091FUNC<unknown>HIDDEN2
          __GI___libc_read.symtab0x805154091FUNC<unknown>HIDDEN2
          __GI___libc_waitpid.symtab0x80515a091FUNC<unknown>HIDDEN2
          __GI___libc_write.symtab0x80514e091FUNC<unknown>HIDDEN2
          __GI___open.symtab0x805148091FUNC<unknown>HIDDEN2
          __GI___open_nocancel.symtab0x805148a33FUNC<unknown>HIDDEN2
          __GI___read.symtab0x805154091FUNC<unknown>HIDDEN2
          __GI___read_nocancel.symtab0x805154a33FUNC<unknown>HIDDEN2
          __GI___register_atfork.symtab0x80511e9195FUNC<unknown>HIDDEN2
          __GI___sigaddset.symtab0x804f6b032FUNC<unknown>HIDDEN2
          __GI___sigdelset.symtab0x804f6d032FUNC<unknown>HIDDEN2
          __GI___sigismember.symtab0x804f68c36FUNC<unknown>HIDDEN2
          __GI___uClibc_fini.symtab0x80516d356FUNC<unknown>HIDDEN2
          __GI___uClibc_init.symtab0x805173739FUNC<unknown>HIDDEN2
          __GI___waitpid.symtab0x80515a091FUNC<unknown>HIDDEN2
          __GI___write.symtab0x80514e091FUNC<unknown>HIDDEN2
          __GI___write_nocancel.symtab0x80514ea33FUNC<unknown>HIDDEN2
          __GI___xpg_strerror_r.symtab0x804f190191FUNC<unknown>HIDDEN2
          __GI__exit.symtab0x804de1866FUNC<unknown>HIDDEN2
          __GI_abort.symtab0x805062c191FUNC<unknown>HIDDEN2
          __GI_atoi.symtab0x8050a5c17FUNC<unknown>HIDDEN2
          __GI_brk.symtab0x8053fb444FUNC<unknown>HIDDEN2
          __GI_close.symtab0x805143080FUNC<unknown>HIDDEN2
          __GI_closedir.symtab0x8051c30130FUNC<unknown>HIDDEN2
          __GI_config_close.symtab0x805211a44FUNC<unknown>HIDDEN2
          __GI_config_open.symtab0x805214644FUNC<unknown>HIDDEN2
          __GI_config_read.symtab0x8051eb0618FUNC<unknown>HIDDEN2
          __GI_connect.symtab0x804f32884FUNC<unknown>HIDDEN2
          __GI_dup2.symtab0x804de8843FUNC<unknown>HIDDEN2
          __GI_execl.symtab0x8050c00101FUNC<unknown>HIDDEN2
          __GI_execve.symtab0x8051ab447FUNC<unknown>HIDDEN2
          __GI_exit.symtab0x8050ba093FUNC<unknown>HIDDEN2
          __GI_fclose.symtab0x8052250380FUNC<unknown>HIDDEN2
          __GI_fcntl.symtab0x804dd7f153FUNC<unknown>HIDDEN2
          __GI_fflush_unlocked.symtab0x8053380447FUNC<unknown>HIDDEN2
          __GI_fgetc.symtab0x805310c145FUNC<unknown>HIDDEN2
          __GI_fgetc_unlocked.symtab0x80535dc204FUNC<unknown>HIDDEN2
          __GI_fgets.symtab0x80531b4118FUNC<unknown>HIDDEN2
          __GI_fgets_unlocked.symtab0x80536a894FUNC<unknown>HIDDEN2
          __GI_fopen.symtab0x805242421FUNC<unknown>HIDDEN2
          __GI_fork.symtab0x8050fa0524FUNC<unknown>HIDDEN2
          __GI_fputs_unlocked.symtab0x804eefc45FUNC<unknown>HIDDEN2
          __GI_fseek.symtab0x805427024FUNC<unknown>HIDDEN2
          __GI_fseeko64.symtab0x8054288246FUNC<unknown>HIDDEN2
          __GI_fstat.symtab0x8053fe070FUNC<unknown>HIDDEN2
          __GI_fwrite_unlocked.symtab0x804ef2c111FUNC<unknown>HIDDEN2
          __GI_getc_unlocked.symtab0x80535dc204FUNC<unknown>HIDDEN2
          __GI_getdtablesize.symtab0x804deb432FUNC<unknown>HIDDEN2
          __GI_getegid.symtab0x8051ae48FUNC<unknown>HIDDEN2
          __GI_geteuid.symtab0x804ded48FUNC<unknown>HIDDEN2
          __GI_getgid.symtab0x8051aec8FUNC<unknown>HIDDEN2
          __GI_gethostbyname.symtab0x804f2dc14FUNC<unknown>HIDDEN2
          __GI_gethostbyname2.symtab0x804f2ec57FUNC<unknown>HIDDEN2
          __GI_gethostbyname2_r.symtab0x80539fc666FUNC<unknown>HIDDEN2
          __GI_gethostbyname_r.symtab0x8055748684FUNC<unknown>HIDDEN2
          __GI_gethostname.symtab0x80559f489FUNC<unknown>HIDDEN2
          __GI_getpagesize.symtab0x8051af419FUNC<unknown>HIDDEN2
          __GI_getpid.symtab0x80512cc49FUNC<unknown>HIDDEN2
          __GI_getrlimit.symtab0x804dee443FUNC<unknown>HIDDEN2
          __GI_getsockname.symtab0x804f37c40FUNC<unknown>HIDDEN2
          __GI_getuid.symtab0x8051b088FUNC<unknown>HIDDEN2
          __GI_htonl.symtab0x804f2a07FUNC<unknown>HIDDEN2
          __GI_htons.symtab0x804f29412FUNC<unknown>HIDDEN2
          __GI_inet_addr.symtab0x804f2bc31FUNC<unknown>HIDDEN2
          __GI_inet_aton.symtab0x8053968148FUNC<unknown>HIDDEN2
          __GI_inet_ntop.symtab0x8054912432FUNC<unknown>HIDDEN2
          __GI_inet_pton.symtab0x805465f459FUNC<unknown>HIDDEN2
          __GI_initstate_r.symtab0x805091f155FUNC<unknown>HIDDEN2
          __GI_ioctl.symtab0x804df10139FUNC<unknown>HIDDEN2
          __GI_isatty.symtab0x80538ec27FUNC<unknown>HIDDEN2
          __GI_kill.symtab0x804df9c43FUNC<unknown>HIDDEN2
          __GI_lseek64.symtab0x8055b3890FUNC<unknown>HIDDEN2
          __GI_memcpy.symtab0x804ef9c41FUNC<unknown>HIDDEN2
          __GI_memmove.symtab0x805370837FUNC<unknown>HIDDEN2
          __GI_mempcpy.symtab0x80545c830FUNC<unknown>HIDDEN2
          __GI_memrchr.symtab0x8053768177FUNC<unknown>HIDDEN2
          __GI_memset.symtab0x804efc850FUNC<unknown>HIDDEN2
          __GI_mmap.symtab0x8051a3427FUNC<unknown>HIDDEN2
          __GI_mremap.symtab0x8051b1059FUNC<unknown>HIDDEN2
          __GI_munmap.symtab0x8051b4c43FUNC<unknown>HIDDEN2
          __GI_nanosleep.symtab0x8051ba161FUNC<unknown>HIDDEN2
          __GI_ntohl.symtab0x804f2b37FUNC<unknown>HIDDEN2
          __GI_ntohs.symtab0x804f2a712FUNC<unknown>HIDDEN2
          __GI_open.symtab0x805148091FUNC<unknown>HIDDEN2
          __GI_opendir.symtab0x8051d3c132FUNC<unknown>HIDDEN2
          __GI_pipe.symtab0x804dfc839FUNC<unknown>HIDDEN2
          __GI_poll.symtab0x8055a7d72FUNC<unknown>HIDDEN2
          __GI_raise.symtab0x8051300100FUNC<unknown>HIDDEN2
          __GI_random.symtab0x80506f466FUNC<unknown>HIDDEN2
          __GI_random_r.symtab0x805082095FUNC<unknown>HIDDEN2
          __GI_rawmemchr.symtab0x80545b419FUNC<unknown>HIDDEN2
          __GI_read.symtab0x805154091FUNC<unknown>HIDDEN2
          __GI_readdir64.symtab0x8051e2c129FUNC<unknown>HIDDEN2
          __GI_recv.symtab0x804f3dc92FUNC<unknown>HIDDEN2
          __GI_recvfrom.symtab0x804f438108FUNC<unknown>HIDDEN2
          __GI_sbrk.symtab0x8051be064FUNC<unknown>HIDDEN2
          __GI_select.symtab0x804e065108FUNC<unknown>HIDDEN2
          __GI_send.symtab0x804f4a492FUNC<unknown>HIDDEN2
          __GI_sendto.symtab0x804f500108FUNC<unknown>HIDDEN2
          __GI_setsockopt.symtab0x804f56c56FUNC<unknown>HIDDEN2
          __GI_setstate_r.symtab0x80509ba161FUNC<unknown>HIDDEN2
          __GI_sigaction.symtab0x80519bf80FUNC<unknown>HIDDEN2
          __GI_sigaddset.symtab0x804f5cc34FUNC<unknown>HIDDEN2
          __GI_sigemptyset.symtab0x804f5f020FUNC<unknown>HIDDEN2
          __GI_signal.symtab0x804f604136FUNC<unknown>HIDDEN2
          __GI_sigprocmask.symtab0x804e0d497FUNC<unknown>HIDDEN2
          __GI_sleep.symtab0x8051364195FUNC<unknown>HIDDEN2
          __GI_socket.symtab0x804f5a440FUNC<unknown>HIDDEN2
          __GI_sprintf.symtab0x804e19c30FUNC<unknown>HIDDEN2
          __GI_srandom_r.symtab0x805087f160FUNC<unknown>HIDDEN2
          __GI_stat.symtab0x8055ac870FUNC<unknown>HIDDEN2
          __GI_strcasecmp.symtab0x8055f4854FUNC<unknown>HIDDEN2
          __GI_strchr.symtab0x804effc30FUNC<unknown>HIDDEN2
          __GI_strchrnul.symtab0x805373025FUNC<unknown>HIDDEN2
          __GI_strcmp.symtab0x804f01c29FUNC<unknown>HIDDEN2
          __GI_strcoll.symtab0x804f01c29FUNC<unknown>HIDDEN2
          __GI_strcpy.symtab0x804f03c27FUNC<unknown>HIDDEN2
          __GI_strcspn.symtab0x805381c45FUNC<unknown>HIDDEN2
          __GI_strdup.symtab0x8055b9448FUNC<unknown>HIDDEN2
          __GI_strlen.symtab0x804f05819FUNC<unknown>HIDDEN2
          __GI_strncpy.symtab0x804f06c38FUNC<unknown>HIDDEN2
          __GI_strnlen.symtab0x804f09424FUNC<unknown>HIDDEN2
          __GI_strpbrk.symtab0x80538c835FUNC<unknown>HIDDEN2
          __GI_strrchr.symtab0x805374c26FUNC<unknown>HIDDEN2
          __GI_strspn.symtab0x805384c42FUNC<unknown>HIDDEN2
          __GI_strstr.symtab0x804f0ac197FUNC<unknown>HIDDEN2
          __GI_strtok.symtab0x804f27c22FUNC<unknown>HIDDEN2
          __GI_strtok_r.symtab0x805387880FUNC<unknown>HIDDEN2
          __GI_strtol.symtab0x8050a7023FUNC<unknown>HIDDEN2
          __GI_sysconf.symtab0x8050d2c523FUNC<unknown>HIDDEN2
          __GI_tcgetattr.symtab0x805390896FUNC<unknown>HIDDEN2
          __GI_time.symtab0x804e13816FUNC<unknown>HIDDEN2
          __GI_times.symtab0x8051c2016FUNC<unknown>HIDDEN2
          __GI_toupper.symtab0x804e14829FUNC<unknown>HIDDEN2
          __GI_uname.symtab0x8055b1039FUNC<unknown>HIDDEN2
          __GI_vfork.symtab0x8050f6856FUNC<unknown>HIDDEN2
          __GI_vsnprintf.symtab0x804e1bc172FUNC<unknown>HIDDEN2
          __GI_waitpid.symtab0x80515a091FUNC<unknown>HIDDEN2
          __GI_wcrtomb.symtab0x805217463FUNC<unknown>HIDDEN2
          __GI_wcsnrtombs.symtab0x80521d0128FUNC<unknown>HIDDEN2
          __GI_wcsrtombs.symtab0x80521b427FUNC<unknown>HIDDEN2
          __GI_write.symtab0x80514e091FUNC<unknown>HIDDEN2
          __JCR_END__.symtab0x805b8e00OBJECT<unknown>DEFAULT9
          __JCR_LIST__.symtab0x805b8e00OBJECT<unknown>DEFAULT9
          __app_fini.symtab0x806038c4OBJECT<unknown>HIDDEN12
          __atexit_lock.symtab0x805bad424OBJECT<unknown>DEFAULT11
          __bss_start.symtab0x805bbf40NOTYPE<unknown>DEFAULTSHN_ABS
          __check_one_fd.symtab0x805170b44FUNC<unknown>DEFAULT2
          __close.symtab0x805143080FUNC<unknown>DEFAULT2
          __close_nameservers.symtab0x80556bc96FUNC<unknown>HIDDEN2
          __close_nocancel.symtab0x805143a27FUNC<unknown>DEFAULT2
          __ctype_b.symtab0x805b9e84OBJECT<unknown>DEFAULT11
          __ctype_tolower.symtab0x805bbf04OBJECT<unknown>DEFAULT11
          __ctype_toupper.symtab0x805b9f04OBJECT<unknown>DEFAULT11
          __curbrk.symtab0x80628f04OBJECT<unknown>HIDDEN12
          __data_start.symtab0x805b9080NOTYPE<unknown>DEFAULT11
          __decode_dotted.symtab0x8054ac4259FUNC<unknown>HIDDEN2
          __decode_header.symtab0x8055c7c166FUNC<unknown>HIDDEN2
          __deregister_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __dns_lookup.symtab0x8054bc81842FUNC<unknown>HIDDEN2
          __do_global_ctors_aux.symtab0x80560100FUNC<unknown>DEFAULT2
          __do_global_dtors_aux.symtab0x80480e00FUNC<unknown>DEFAULT2
          __dso_handle.symtab0x805b9000OBJECT<unknown>HIDDEN11
          __encode_dotted.symtab0x8055f80130FUNC<unknown>HIDDEN2
          __encode_header.symtab0x8055bc4182FUNC<unknown>HIDDEN2
          __encode_question.symtab0x8055d2482FUNC<unknown>HIDDEN2
          __environ.symtab0x80603844OBJECT<unknown>DEFAULT12
          __errno_location.symtab0x804e16813FUNC<unknown>DEFAULT2
          __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __exit_cleanup.symtab0x805fe344OBJECT<unknown>HIDDEN12
          __fcntl_nocancel.symtab0x804dd2c83FUNC<unknown>DEFAULT2
          __fgetc_unlocked.symtab0x80535dc204FUNC<unknown>DEFAULT2
          __fini_array_end.symtab0x805b8d00NOTYPE<unknown>HIDDEN6
          __fini_array_start.symtab0x805b8d00NOTYPE<unknown>HIDDEN6
          __fork.symtab0x8050fa0524FUNC<unknown>DEFAULT2
          __fork_generation_pointer.symtab0x8062df84OBJECT<unknown>HIDDEN12
          __fork_handlers.symtab0x8062dfc4OBJECT<unknown>HIDDEN12
          __fork_lock.symtab0x805fe384OBJECT<unknown>HIDDEN12
          __get_hosts_byname_r.symtab0x805571c41FUNC<unknown>HIDDEN2
          __get_pc_thunk_bx.symtab0x80480d00FUNC<unknown>HIDDEN2
          __getdents64.symtab0x8054158280FUNC<unknown>HIDDEN2
          __getpagesize.symtab0x8051af419FUNC<unknown>DEFAULT2
          __getpid.symtab0x80512cc49FUNC<unknown>DEFAULT2
          __glibc_strerror_r.symtab0x804f17426FUNC<unknown>DEFAULT2
          __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __h_errno_location.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __init_array_end.symtab0x805b8d00NOTYPE<unknown>HIDDEN6
          __init_array_start.symtab0x805b8d00NOTYPE<unknown>HIDDEN6
          __libc_close.symtab0x805143080FUNC<unknown>DEFAULT2
          __libc_connect.symtab0x804f32884FUNC<unknown>DEFAULT2
          __libc_disable_asynccancel.symtab0x80515fc86FUNC<unknown>HIDDEN2
          __libc_enable_asynccancel.symtab0x805165279FUNC<unknown>HIDDEN2
          __libc_errno.symtab0x04TLS<unknown>HIDDEN6
          __libc_fcntl.symtab0x804dd7f153FUNC<unknown>DEFAULT2
          __libc_fork.symtab0x8050fa0524FUNC<unknown>DEFAULT2
          __libc_h_errno.symtab0x44TLS<unknown>HIDDEN6
          __libc_nanosleep.symtab0x8051ba161FUNC<unknown>DEFAULT2
          __libc_open.symtab0x805148091FUNC<unknown>DEFAULT2
          __libc_read.symtab0x805154091FUNC<unknown>DEFAULT2
          __libc_recv.symtab0x804f3dc92FUNC<unknown>DEFAULT2
          __libc_recvfrom.symtab0x804f438108FUNC<unknown>DEFAULT2
          __libc_select.symtab0x804e065108FUNC<unknown>DEFAULT2
          __libc_send.symtab0x804f4a492FUNC<unknown>DEFAULT2
          __libc_sendto.symtab0x804f500108FUNC<unknown>DEFAULT2
          __libc_setup_tls.symtab0x8053d4a513FUNC<unknown>DEFAULT2
          __libc_sigaction.symtab0x80519bf80FUNC<unknown>DEFAULT2
          __libc_stack_end.symtab0x80603804OBJECT<unknown>DEFAULT12
          __libc_waitpid.symtab0x80515a091FUNC<unknown>DEFAULT2
          __libc_write.symtab0x80514e091FUNC<unknown>DEFAULT2
          __linkin_atfork.symtab0x80511cc29FUNC<unknown>HIDDEN2
          __lll_lock_wait_private.symtab0x8053ca040FUNC<unknown>HIDDEN2
          __lll_unlock_wake_private.symtab0x8053cd032FUNC<unknown>HIDDEN2
          __local_nameserver.symtab0x8059fa416OBJECT<unknown>HIDDEN4
          __malloc_consolidate.symtab0x8050305379FUNC<unknown>HIDDEN2
          __malloc_largebin_index.symtab0x804f6f038FUNC<unknown>DEFAULT2
          __malloc_lock.symtab0x805b9f824OBJECT<unknown>DEFAULT11
          __malloc_state.symtab0x8062a80888OBJECT<unknown>DEFAULT12
          __malloc_trim.symtab0x8050288125FUNC<unknown>DEFAULT2
          __nameserver.symtab0x8062e304OBJECT<unknown>HIDDEN12
          __nameservers.symtab0x8062e344OBJECT<unknown>HIDDEN12
          __nptl_deallocate_tsd.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __nptl_nthreads.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __open.symtab0x805148091FUNC<unknown>DEFAULT2
          __open_etc_hosts.symtab0x8055d7812FUNC<unknown>HIDDEN2
          __open_nameservers.symtab0x805534f876FUNC<unknown>HIDDEN2
          __open_nocancel.symtab0x805148a33FUNC<unknown>DEFAULT2
          __pagesize.symtab0x80603884OBJECT<unknown>DEFAULT12
          __preinit_array_end.symtab0x805b8d00NOTYPE<unknown>HIDDEN6
          __preinit_array_start.symtab0x805b8d00NOTYPE<unknown>HIDDEN6
          __progname.symtab0x805baf04OBJECT<unknown>DEFAULT11
          __progname_full.symtab0x805baf44OBJECT<unknown>DEFAULT11
          __pthread_initialize_minimal.symtab0x8053f4b15FUNC<unknown>DEFAULT2
          __pthread_mutex_init.symtab0x80516a73FUNC<unknown>DEFAULT2
          __pthread_mutex_lock.symtab0x80516a43FUNC<unknown>DEFAULT2
          __pthread_mutex_trylock.symtab0x80516a43FUNC<unknown>DEFAULT2
          __pthread_mutex_unlock.symtab0x80516a43FUNC<unknown>DEFAULT2
          __pthread_return_0.symtab0x80516a43FUNC<unknown>DEFAULT2
          __pthread_unwind.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __read.symtab0x805154091FUNC<unknown>DEFAULT2
          __read_etc_hosts_r.symtab0x8055d84451FUNC<unknown>HIDDEN2
          __read_nocancel.symtab0x805154a33FUNC<unknown>DEFAULT2
          __register_atfork.symtab0x80511e9195FUNC<unknown>DEFAULT2
          __register_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __res_sync.symtab0x8062e284OBJECT<unknown>HIDDEN12
          __resolv_attempts.symtab0x805bbe91OBJECT<unknown>HIDDEN11
          __resolv_lock.symtab0x80628f824OBJECT<unknown>DEFAULT12
          __resolv_timeout.symtab0x805bbe81OBJECT<unknown>HIDDEN11
          __restore.symtab0x80519b70NOTYPE<unknown>DEFAULT2
          __restore_rt.symtab0x80519b00NOTYPE<unknown>DEFAULT2
          __rtld_fini.symtab0x80603904OBJECT<unknown>HIDDEN12
          __searchdomain.symtab0x8062e2c4OBJECT<unknown>HIDDEN12
          __searchdomains.symtab0x8062e384OBJECT<unknown>HIDDEN12
          __sigaddset.symtab0x804f6b032FUNC<unknown>DEFAULT2
          __sigdelset.symtab0x804f6d032FUNC<unknown>DEFAULT2
          __sigismember.symtab0x804f68c36FUNC<unknown>DEFAULT2
          __socketcall.symtab0x8051a5043FUNC<unknown>HIDDEN2
          __socketcall.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __stdin.symtab0x805bb044OBJECT<unknown>DEFAULT11
          __stdio_READ.symtab0x805439862FUNC<unknown>HIDDEN2
          __stdio_WRITE.symtab0x80543d8139FUNC<unknown>HIDDEN2
          __stdio_adjust_position.symtab0x8054464154FUNC<unknown>HIDDEN2
          __stdio_fwrite.symtab0x8052710232FUNC<unknown>HIDDEN2
          __stdio_rfill.symtab0x805450037FUNC<unknown>HIDDEN2
          __stdio_seek.symtab0x805458446FUNC<unknown>HIDDEN2
          __stdio_trans2r_o.symtab0x805452892FUNC<unknown>HIDDEN2
          __stdio_trans2w_o.symtab0x8052904154FUNC<unknown>HIDDEN2
          __stdio_wcommit.symtab0x80529a037FUNC<unknown>HIDDEN2
          __stdout.symtab0x805bb084OBJECT<unknown>DEFAULT11
          __syscall_error.symtab0x80519a015FUNC<unknown>HIDDEN2
          __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_nanosleep.symtab0x8051b7841FUNC<unknown>DEFAULT2
          __syscall_poll.symtab0x8055a5045FUNC<unknown>DEFAULT2
          __syscall_rt_sigaction.symtab0x8051a7c53FUNC<unknown>DEFAULT2
          __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_select.symtab0x804e02c57FUNC<unknown>DEFAULT2
          __uClibc_fini.symtab0x80516d356FUNC<unknown>DEFAULT2
          __uClibc_init.symtab0x805173739FUNC<unknown>DEFAULT2
          __uClibc_main.symtab0x805175e577FUNC<unknown>DEFAULT2
          __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __uclibc_progname.symtab0x805baec4OBJECT<unknown>HIDDEN11
          __vfork.symtab0x8050f6856FUNC<unknown>HIDDEN2
          __waitpid.symtab0x80515a091FUNC<unknown>DEFAULT2
          __waitpid_nocancel.symtab0x80515aa33FUNC<unknown>DEFAULT2
          __write.symtab0x80514e091FUNC<unknown>DEFAULT2
          __write_nocancel.symtab0x80514ea33FUNC<unknown>DEFAULT2
          __xpg_strerror_r.symtab0x804f190191FUNC<unknown>DEFAULT2
          __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __xstat32_conv.symtab0x80540cb138FUNC<unknown>HIDDEN2
          __xstat64_conv.symtab0x8054028163FUNC<unknown>HIDDEN2
          _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _bss_custom_printf_spec.symtab0x805fc5410OBJECT<unknown>DEFAULT12
          _charpad.symtab0x804e26853FUNC<unknown>DEFAULT2
          _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _custom_printf_arginfo.symtab0x8062a2840OBJECT<unknown>HIDDEN12
          _custom_printf_handler.symtab0x8062a5040OBJECT<unknown>HIDDEN12
          _custom_printf_spec.symtab0x805b9f44OBJECT<unknown>HIDDEN11
          _dl_aux_init.symtab0x8053f5c18FUNC<unknown>DEFAULT2
          _dl_init_static_tls.symtab0x805bbe04OBJECT<unknown>DEFAULT11
          _dl_nothread_init_static_tls.symtab0x8053f6e68FUNC<unknown>HIDDEN2
          _dl_phdr.symtab0x8062e204OBJECT<unknown>DEFAULT12
          _dl_phnum.symtab0x8062e244OBJECT<unknown>DEFAULT12
          _dl_tls_dtv_gaps.symtab0x8062e141OBJECT<unknown>DEFAULT12
          _dl_tls_dtv_slotinfo_list.symtab0x8062e104OBJECT<unknown>DEFAULT12
          _dl_tls_generation.symtab0x8062e184OBJECT<unknown>DEFAULT12
          _dl_tls_max_dtv_idx.symtab0x8062e084OBJECT<unknown>DEFAULT12
          _dl_tls_setup.symtab0x8053d1a48FUNC<unknown>DEFAULT2
          _dl_tls_static_align.symtab0x8062e044OBJECT<unknown>DEFAULT12
          _dl_tls_static_nelem.symtab0x8062e1c4OBJECT<unknown>DEFAULT12
          _dl_tls_static_size.symtab0x8062e0c4OBJECT<unknown>DEFAULT12
          _dl_tls_static_used.symtab0x8062e004OBJECT<unknown>DEFAULT12
          _edata.symtab0x805bbf40NOTYPE<unknown>DEFAULTSHN_ABS
          _end.symtab0x8062e3c0NOTYPE<unknown>DEFAULTSHN_ABS
          _exit.symtab0x804de1866FUNC<unknown>DEFAULT2
          _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _fini.symtab0x80560440FUNC<unknown>DEFAULT3
          _fixed_buffers.symtab0x80603b48192OBJECT<unknown>DEFAULT12
          _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _fp_out_narrow.symtab0x804e29d94FUNC<unknown>DEFAULT2
          _fpmaxtostr.symtab0x8052b441479FUNC<unknown>HIDDEN2
          _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _init.symtab0x80480b40FUNC<unknown>DEFAULT1
          _load_inttype.symtab0x80529c886FUNC<unknown>HIDDEN2
          _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_init.symtab0x804e908103FUNC<unknown>HIDDEN2
          _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_parsespec.symtab0x804eaed1036FUNC<unknown>HIDDEN2
          _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_prepargs.symtab0x804e97057FUNC<unknown>HIDDEN2
          _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_setargs.symtab0x804e9ac277FUNC<unknown>HIDDEN2
          _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _promoted_size.symtab0x804eac441FUNC<unknown>DEFAULT2
          _pthread_cleanup_pop_restore.symtab0x80516bc23FUNC<unknown>DEFAULT2
          _pthread_cleanup_push_defer.symtab0x80516aa18FUNC<unknown>DEFAULT2
          _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _setjmp.symtab0x8051a1034FUNC<unknown>DEFAULT2
          _sigintr.symtab0x8062a788OBJECT<unknown>HIDDEN12
          _start.symtab0x804819434FUNC<unknown>DEFAULT2
          _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _stdio_fopen.symtab0x805243c664FUNC<unknown>HIDDEN2
          _stdio_init.symtab0x80527f859FUNC<unknown>HIDDEN2
          _stdio_openlist.symtab0x805bb0c4OBJECT<unknown>DEFAULT11
          _stdio_openlist_add_lock.symtab0x806039412OBJECT<unknown>DEFAULT12
          _stdio_openlist_dec_use.symtab0x8053240320FUNC<unknown>HIDDEN2
          _stdio_openlist_del_count.symtab0x80603b04OBJECT<unknown>DEFAULT12
          _stdio_openlist_del_lock.symtab0x80603a012OBJECT<unknown>DEFAULT12
          _stdio_openlist_use_count.symtab0x80603ac4OBJECT<unknown>DEFAULT12
          _stdio_streams.symtab0x805bb14204OBJECT<unknown>DEFAULT11
          _stdio_term.symtab0x8052833208FUNC<unknown>HIDDEN2
          _stdio_user_locking.symtab0x805bb104OBJECT<unknown>DEFAULT11
          _stdlib_strto_l.symtab0x8050a88278FUNC<unknown>HIDDEN2
          _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _store_inttype.symtab0x8052a2061FUNC<unknown>HIDDEN2
          _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _string_syserrmsgs.symtab0x8058eb02906OBJECT<unknown>HIDDEN4
          _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _uintmaxtostr.symtab0x8052a60228FUNC<unknown>HIDDEN2
          _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _vfprintf_internal.symtab0x804e2fb1546FUNC<unknown>HIDDEN2
          _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          abort.symtab0x805062c191FUNC<unknown>DEFAULT2
          abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          access.symtab0x804de5c43FUNC<unknown>DEFAULT2
          access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          acnc.symtab0x804ac77162FUNC<unknown>DEFAULT2
          add_entry.symtab0x804d45689FUNC<unknown>DEFAULT2
          atoi.symtab0x8050a5c17FUNC<unknown>DEFAULT2
          atol.symtab0x8050a5c17FUNC<unknown>DEFAULT2
          atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          bcopy.symtab0x804f25021FUNC<unknown>DEFAULT2
          bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          been_there_done_that.symtab0x805fe301OBJECT<unknown>DEFAULT12
          brk.symtab0x8053fb444FUNC<unknown>DEFAULT2
          brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          bsd_signal.symtab0x804f604136FUNC<unknown>DEFAULT2
          buf.6699.symtab0x805fc64440OBJECT<unknown>DEFAULT12
          bzero.symtab0x804f26819FUNC<unknown>DEFAULT2
          bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          c.symtab0x805b9d84OBJECT<unknown>DEFAULT11
          calloc.symtab0x804fea0236FUNC<unknown>DEFAULT2
          calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          checksum_generic.symtab0x80481b897FUNC<unknown>DEFAULT2
          checksum_tcp_udp.symtab0x8048219223FUNC<unknown>DEFAULT2
          checksum_tcpudp.symtab0x80482f8223FUNC<unknown>DEFAULT2
          clock.symtab0x804e17834FUNC<unknown>DEFAULT2
          clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          close.symtab0x805143080FUNC<unknown>DEFAULT2
          closedir.symtab0x8051c30130FUNC<unknown>DEFAULT2
          closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          closenameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          completed.4963.symtab0x805bc001OBJECT<unknown>DEFAULT12
          connect.symtab0x804f32884FUNC<unknown>DEFAULT2
          connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          connectTimeout.symtab0x804943a459FUNC<unknown>DEFAULT2
          crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          csum.symtab0x8049747168FUNC<unknown>DEFAULT2
          data_start.symtab0x805b9080NOTYPE<unknown>DEFAULT11
          decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          dup2.symtab0x804de8843FUNC<unknown>DEFAULT2
          dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          environ.symtab0x80603844OBJECT<unknown>DEFAULT12
          errno.symtab0x04TLS<unknown>DEFAULT6
          errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          execl.symtab0x8050c00101FUNC<unknown>DEFAULT2
          execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          execve.symtab0x8051ab447FUNC<unknown>DEFAULT2
          execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          exit.symtab0x8050ba093FUNC<unknown>DEFAULT2
          exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          exp10_table.symtab0x8059e60156OBJECT<unknown>DEFAULT4
          fclose.symtab0x8052250380FUNC<unknown>DEFAULT2
          fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fcntl.symtab0x804dd7f153FUNC<unknown>DEFAULT2
          fd_to_DIR.symtab0x8051cb4136FUNC<unknown>DEFAULT2
          fdgets.symtab0x8048fef104FUNC<unknown>DEFAULT2
          fdopen_pids.symtab0x805fc404OBJECT<unknown>DEFAULT12
          fdopendir.symtab0x8051dc0108FUNC<unknown>DEFAULT2
          fdpclose.symtab0x8048ec7296FUNC<unknown>DEFAULT2
          fdpopen.symtab0x8048cd2501FUNC<unknown>DEFAULT2
          fflush_unlocked.symtab0x8053380447FUNC<unknown>DEFAULT2
          fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgetc.symtab0x805310c145FUNC<unknown>DEFAULT2
          fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgetc_unlocked.symtab0x80535dc204FUNC<unknown>DEFAULT2
          fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgets.symtab0x80531b4118FUNC<unknown>DEFAULT2
          fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgets_unlocked.symtab0x80536a894FUNC<unknown>DEFAULT2
          fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          findRandIP.symtab0x804971748FUNC<unknown>DEFAULT2
          fmt.symtab0x8059e4020OBJECT<unknown>DEFAULT4
          fopen.symtab0x805242421FUNC<unknown>DEFAULT2
          fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fork.symtab0x8050fa0524FUNC<unknown>DEFAULT2
          fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fork_handler_pool.symtab0x805fe3c1348OBJECT<unknown>DEFAULT12
          fputs_unlocked.symtab0x804eefc45FUNC<unknown>DEFAULT2
          fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          frame_dummy.symtab0x80481400FUNC<unknown>DEFAULT2
          free.symtab0x8050480399FUNC<unknown>DEFAULT2
          free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fseek.symtab0x805427024FUNC<unknown>DEFAULT2
          fseeko.symtab0x805427024FUNC<unknown>DEFAULT2
          fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fseeko64.symtab0x8054288246FUNC<unknown>DEFAULT2
          fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fstat.symtab0x8053fe070FUNC<unknown>DEFAULT2
          fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fwrite_unlocked.symtab0x804ef2c111FUNC<unknown>DEFAULT2
          fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getBuild.symtab0x804c3405FUNC<unknown>DEFAULT2
          getHost.symtab0x80491d159FUNC<unknown>DEFAULT2
          getOurIP.symtab0x804c143509FUNC<unknown>DEFAULT2
          get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getc.symtab0x805310c145FUNC<unknown>DEFAULT2
          getc_unlocked.symtab0x80535dc204FUNC<unknown>DEFAULT2
          getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getdtablesize.symtab0x804deb432FUNC<unknown>DEFAULT2
          getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getegid.symtab0x8051ae48FUNC<unknown>DEFAULT2
          getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          geteuid.symtab0x804ded48FUNC<unknown>DEFAULT2
          geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getgid.symtab0x8051aec8FUNC<unknown>DEFAULT2
          getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gethostbyname.symtab0x804f2dc14FUNC<unknown>DEFAULT2
          gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gethostbyname2.symtab0x804f2ec57FUNC<unknown>DEFAULT2
          gethostbyname2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gethostbyname2_r.symtab0x80539fc666FUNC<unknown>DEFAULT2
          gethostbyname2_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gethostbyname_r.symtab0x8055748684FUNC<unknown>DEFAULT2
          gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gethostname.symtab0x80559f489FUNC<unknown>DEFAULT2
          gethostname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getpagesize.symtab0x8051af419FUNC<unknown>DEFAULT2
          getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getpid.symtab0x80512cc49FUNC<unknown>DEFAULT2
          getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getppid.symtab0x804dedc8FUNC<unknown>DEFAULT2
          getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getrlimit.symtab0x804dee443FUNC<unknown>DEFAULT2
          getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getsockname.symtab0x804f37c40FUNC<unknown>DEFAULT2
          getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getsockopt.symtab0x804f3a456FUNC<unknown>DEFAULT2
          getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getuid.symtab0x8051b088FUNC<unknown>DEFAULT2
          getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          h_errno.symtab0x44TLS<unknown>DEFAULT6
          hacks.symtab0x805b9204OBJECT<unknown>DEFAULT11
          hacks2.symtab0x805b9244OBJECT<unknown>DEFAULT11
          hacks3.symtab0x805b9284OBJECT<unknown>DEFAULT11
          hacks4.symtab0x805b92c4OBJECT<unknown>DEFAULT11
          hakai_bp.symtab0x805b9304OBJECT<unknown>DEFAULT11
          hextable.symtab0x8056d601024OBJECT<unknown>DEFAULT4
          hoste.6698.symtab0x805fe1c20OBJECT<unknown>DEFAULT12
          htonl.symtab0x804f2a07FUNC<unknown>DEFAULT2
          htons.symtab0x804f29412FUNC<unknown>DEFAULT2
          httphex.symtab0x804adfa1037FUNC<unknown>DEFAULT2
          i.5755.symtab0x805b9dc4OBJECT<unknown>DEFAULT11
          index.symtab0x804effc30FUNC<unknown>DEFAULT2
          inet_addr.symtab0x804f2bc31FUNC<unknown>DEFAULT2
          inet_aton.symtab0x8053968148FUNC<unknown>DEFAULT2
          inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          inet_ntop.symtab0x8054912432FUNC<unknown>DEFAULT2
          inet_ntop4.symtab0x805482a232FUNC<unknown>DEFAULT2
          inet_pton.symtab0x805465f459FUNC<unknown>DEFAULT2
          inet_pton4.symtab0x80545e8119FUNC<unknown>DEFAULT2
          initConnection.symtab0x804bfdb360FUNC<unknown>DEFAULT2
          init_rand.symtab0x80484ed111FUNC<unknown>DEFAULT2
          init_static_tls.symtab0x8053cf042FUNC<unknown>DEFAULT2
          initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          initstate.symtab0x805078d85FUNC<unknown>DEFAULT2
          initstate_r.symtab0x805091f155FUNC<unknown>DEFAULT2
          ioctl.symtab0x804df10139FUNC<unknown>DEFAULT2
          ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          isatty.symtab0x80538ec27FUNC<unknown>DEFAULT2
          isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          kill.symtab0x804df9c43FUNC<unknown>DEFAULT2
          kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          last_id.6756.symtab0x805bbe42OBJECT<unknown>DEFAULT11
          last_ns_num.6755.symtab0x80628f44OBJECT<unknown>DEFAULT12
          libc-cancellation.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc-tls.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          listFork.symtab0x8049605274FUNC<unknown>DEFAULT2
          llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          lseek64.symtab0x8055b3890FUNC<unknown>DEFAULT2
          macAddress.symtab0x805bc306OBJECT<unknown>DEFAULT12
          main.symtab0x804c3451663FUNC<unknown>DEFAULT2
          main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          makeIPPacket.symtab0x804989a126FUNC<unknown>DEFAULT2
          makeRandomStr.symtab0x804923f106FUNC<unknown>DEFAULT2
          makevsepacket.symtab0x804a704141FUNC<unknown>DEFAULT2
          malloc.symtab0x804f7161928FUNC<unknown>DEFAULT2
          malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          malloc_trim.symtab0x805060f29FUNC<unknown>DEFAULT2
          memcpy.symtab0x804ef9c41FUNC<unknown>DEFAULT2
          memcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memmove.symtab0x805370837FUNC<unknown>DEFAULT2
          memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          mempcpy.symtab0x80545c830FUNC<unknown>DEFAULT2
          mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memrchr.symtab0x8053768177FUNC<unknown>DEFAULT2
          memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memset.symtab0x804efc850FUNC<unknown>DEFAULT2
          memset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          mmap.symtab0x8051a3427FUNC<unknown>DEFAULT2
          mremap.symtab0x8051b1059FUNC<unknown>DEFAULT2
          mremap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          munmap.symtab0x8051b4c43FUNC<unknown>DEFAULT2
          munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          mylock.symtab0x805ba1024OBJECT<unknown>DEFAULT11
          mylock.symtab0x805ba2824OBJECT<unknown>DEFAULT11
          nanosleep.symtab0x8051ba161FUNC<unknown>DEFAULT2
          nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          next_start.1451.symtab0x805fc604OBJECT<unknown>DEFAULT12
          ngPid.symtab0x80629184OBJECT<unknown>DEFAULT12
          nprocessors_onln.symtab0x8050c68196FUNC<unknown>DEFAULT2
          ntohl.symtab0x804f2b37FUNC<unknown>DEFAULT2
          ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          ntohs.symtab0x804f2a712FUNC<unknown>DEFAULT2
          ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          numpids.symtab0x805bc288OBJECT<unknown>DEFAULT12
          object.4975.symtab0x805bc0424OBJECT<unknown>DEFAULT12
          open.symtab0x805148091FUNC<unknown>DEFAULT2
          opendir.symtab0x8051d3c132FUNC<unknown>DEFAULT2
          opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          ourIP.symtab0x80629144OBJECT<unknown>DEFAULT12
          p.4961.symtab0x805b9040OBJECT<unknown>DEFAULT11
          parseHex.symtab0x804905768FUNC<unknown>DEFAULT2
          parse_config.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          pids.symtab0x80629204OBJECT<unknown>DEFAULT12
          pipe.symtab0x804dfc839FUNC<unknown>DEFAULT2
          pipe.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          poll.symtab0x8055a7d72FUNC<unknown>DEFAULT2
          poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          prctl.symtab0x804dff059FUNC<unknown>DEFAULT2
          prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          prefix.6454.symtab0x8058e0812OBJECT<unknown>DEFAULT4
          print.symtab0x80489a9581FUNC<unknown>DEFAULT2
          printchar.symtab0x804877658FUNC<unknown>DEFAULT2
          printi.symtab0x8048887290FUNC<unknown>DEFAULT2
          prints.symtab0x80487b0215FUNC<unknown>DEFAULT2
          processCmd.symtab0x804b2073540FUNC<unknown>DEFAULT2
          program_invocation_name.symtab0x805baf44OBJECT<unknown>DEFAULT11
          program_invocation_short_name.symtab0x805baf04OBJECT<unknown>DEFAULT11
          pseudo_cancel.symtab0x80514550NOTYPE<unknown>DEFAULT2
          pseudo_cancel.symtab0x80514ab0NOTYPE<unknown>DEFAULT2
          pseudo_cancel.symtab0x805150b0NOTYPE<unknown>DEFAULT2
          pseudo_cancel.symtab0x805156b0NOTYPE<unknown>DEFAULT2
          pseudo_cancel.symtab0x80515cb0NOTYPE<unknown>DEFAULT2
          pseudo_end.symtab0x805147f0NOTYPE<unknown>DEFAULT2
          pseudo_end.symtab0x80514da0NOTYPE<unknown>DEFAULT2
          pseudo_end.symtab0x805153a0NOTYPE<unknown>DEFAULT2
          pseudo_end.symtab0x805159a0NOTYPE<unknown>DEFAULT2
          pseudo_end.symtab0x80515fa0NOTYPE<unknown>DEFAULT2
          qual_chars.6463.symtab0x8058e1c20OBJECT<unknown>DEFAULT4
          raise.symtab0x8051300100FUNC<unknown>DEFAULT2
          raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand.symtab0x80506ec5FUNC<unknown>DEFAULT2
          rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand__str.symtab0x804ca79102FUNC<unknown>DEFAULT2
          rand_alpha_str.symtab0x804cadf95FUNC<unknown>DEFAULT2
          rand_alphastr.symtab0x80486d1165FUNC<unknown>DEFAULT2
          rand_cmwc.symtab0x8048613190FUNC<unknown>DEFAULT2
          rand_init.symtab0x804c9c477FUNC<unknown>DEFAULT2
          rand_next.symtab0x804ca11104FUNC<unknown>DEFAULT2
          random.symtab0x80506f466FUNC<unknown>DEFAULT2
          random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          random_poly_info.symtab0x8059a0c10OBJECT<unknown>DEFAULT4
          random_r.symtab0x805082095FUNC<unknown>DEFAULT2
          random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          randtbl.symtab0x805ba54128OBJECT<unknown>DEFAULT11
          rawmemchr.symtab0x80545b419FUNC<unknown>DEFAULT2
          rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          read.symtab0x805154091FUNC<unknown>DEFAULT2
          read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          readdir64.symtab0x8051e2c129FUNC<unknown>DEFAULT2
          readdir64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          realloc.symtab0x804ff8c763FUNC<unknown>DEFAULT2
          realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          recv.symtab0x804f3dc92FUNC<unknown>DEFAULT2
          recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          recvLine.symtab0x80492a9401FUNC<unknown>DEFAULT2
          recvfrom.symtab0x804f438108FUNC<unknown>DEFAULT2
          recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          register-atfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          resolv_conf_mtime.6741.symtab0x80629104OBJECT<unknown>DEFAULT12
          resolv_domain_to_hostname.symtab0x804cb40125FUNC<unknown>DEFAULT2
          resolv_entries_free.symtab0x804d1ab56FUNC<unknown>DEFAULT2
          resolv_lookup.symtab0x804cc481379FUNC<unknown>DEFAULT2
          resolv_skip_name.symtab0x804cbbd139FUNC<unknown>DEFAULT2
          rindex.symtab0x805374c26FUNC<unknown>DEFAULT2
          rtcp.symtab0x804a237859FUNC<unknown>DEFAULT2
          sbrk.symtab0x8051be064FUNC<unknown>DEFAULT2
          sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          scanPid.symtab0x806291c4OBJECT<unknown>DEFAULT12
          select.symtab0x804e065108FUNC<unknown>DEFAULT2
          select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          send.symtab0x804f4a492FUNC<unknown>DEFAULT2
          send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sendSTD.symtab0x804a592370FUNC<unknown>DEFAULT2
          sendto.symtab0x804f500108FUNC<unknown>DEFAULT2
          sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          setsockopt.symtab0x804f56c56FUNC<unknown>DEFAULT2
          setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          setstate.symtab0x805073687FUNC<unknown>DEFAULT2
          setstate_r.symtab0x80509ba161FUNC<unknown>DEFAULT2
          sigaction.symtab0x80519bf80FUNC<unknown>DEFAULT2
          sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigaddset.symtab0x804f5cc34FUNC<unknown>DEFAULT2
          sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigemptyset.symtab0x804f5f020FUNC<unknown>DEFAULT2
          signal.symtab0x804f604136FUNC<unknown>DEFAULT2
          signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigprocmask.symtab0x804e0d497FUNC<unknown>DEFAULT2
          sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          skip_and_NUL_space.symtab0x805532443FUNC<unknown>DEFAULT2
          skip_nospace.symtab0x80552fc40FUNC<unknown>DEFAULT2
          sleep.symtab0x8051364195FUNC<unknown>DEFAULT2
          sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          socket.symtab0x804f5a440FUNC<unknown>DEFAULT2
          socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          socket_connect.symtab0x804ad19225FUNC<unknown>DEFAULT2
          sockprintf.symtab0x8048c34158FUNC<unknown>DEFAULT2
          spec_and_mask.6462.symtab0x8058e3016OBJECT<unknown>DEFAULT4
          spec_base.6453.symtab0x8058e147OBJECT<unknown>DEFAULT4
          spec_chars.6459.symtab0x8058e8021OBJECT<unknown>DEFAULT4
          spec_flags.6458.symtab0x8058e988OBJECT<unknown>DEFAULT4
          spec_or_mask.6461.symtab0x8058e4016OBJECT<unknown>DEFAULT4
          spec_ranges.6460.symtab0x8058e509OBJECT<unknown>DEFAULT4
          sprintf.symtab0x804e19c30FUNC<unknown>DEFAULT2
          sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          srand.symtab0x80507e261FUNC<unknown>DEFAULT2
          srandom.symtab0x80507e261FUNC<unknown>DEFAULT2
          srandom_r.symtab0x805087f160FUNC<unknown>DEFAULT2
          stat.symtab0x8055ac870FUNC<unknown>DEFAULT2
          stat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          static_dtv.symtab0x80623b4512OBJECT<unknown>DEFAULT12
          static_map.symtab0x80628bc52OBJECT<unknown>DEFAULT12
          static_slotinfo.symtab0x80625b4776OBJECT<unknown>DEFAULT12
          stderr.symtab0x805bb004OBJECT<unknown>DEFAULT11
          stdin.symtab0x805baf84OBJECT<unknown>DEFAULT11
          stdout.symtab0x805bafc4OBJECT<unknown>DEFAULT11
          strcasecmp.symtab0x8055f4854FUNC<unknown>DEFAULT2
          strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strchr.symtab0x804effc30FUNC<unknown>DEFAULT2
          strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strchrnul.symtab0x805373025FUNC<unknown>DEFAULT2
          strchrnul.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strcmp.symtab0x804f01c29FUNC<unknown>DEFAULT2
          strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strcoll.symtab0x804f01c29FUNC<unknown>DEFAULT2
          strcpy.symtab0x804f03c27FUNC<unknown>DEFAULT2
          strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strcspn.symtab0x805381c45FUNC<unknown>DEFAULT2
          strcspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strdup.symtab0x8055b9448FUNC<unknown>DEFAULT2
          strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strerror_r.symtab0x804f190191FUNC<unknown>DEFAULT2
          strlen.symtab0x804f05819FUNC<unknown>DEFAULT2
          strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strncpy.symtab0x804f06c38FUNC<unknown>DEFAULT2
          strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strnlen.symtab0x804f09424FUNC<unknown>DEFAULT2
          strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strpbrk.symtab0x80538c835FUNC<unknown>DEFAULT2
          strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strrchr.symtab0x805374c26FUNC<unknown>DEFAULT2
          strrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strspn.symtab0x805384c42FUNC<unknown>DEFAULT2
          strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strstr.symtab0x804f0ac197FUNC<unknown>DEFAULT2
          strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strtok.symtab0x804f27c22FUNC<unknown>DEFAULT2
          strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strtok_r.symtab0x805387880FUNC<unknown>DEFAULT2
          strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strtol.symtab0x8050a7023FUNC<unknown>DEFAULT2
          strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sysconf.symtab0x8050d2c523FUNC<unknown>DEFAULT2
          sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          szprintf.symtab0x8048c1036FUNC<unknown>DEFAULT2
          table.symtab0x8062940232OBJECT<unknown>DEFAULT12
          table.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          table_init.symtab0x804d1e4468FUNC<unknown>DEFAULT2
          table_key.symtab0x805b9e04OBJECT<unknown>DEFAULT11
          table_lock_val.symtab0x804d3ed53FUNC<unknown>DEFAULT2
          table_retrieve_val.symtab0x804d42252FUNC<unknown>DEFAULT2
          table_unlock_val.symtab0x804d3b853FUNC<unknown>DEFAULT2
          tcgetattr.symtab0x805390896FUNC<unknown>DEFAULT2
          tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          tcpFl00d.symtab0x8049dc51138FUNC<unknown>DEFAULT2
          tcpcsum.symtab0x80497ef171FUNC<unknown>DEFAULT2
          time.symtab0x804e13816FUNC<unknown>DEFAULT2
          time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          times.symtab0x8051c2016FUNC<unknown>DEFAULT2
          times.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          toggle_obf.symtab0x804d4af237FUNC<unknown>DEFAULT2
          toupper.symtab0x804e14829FUNC<unknown>DEFAULT2
          toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          trim.symtab0x804855c183FUNC<unknown>DEFAULT2
          type_codes.symtab0x8058e5c24OBJECT<unknown>DEFAULT4
          type_sizes.symtab0x8058e7412OBJECT<unknown>DEFAULT4
          udpfl00d.symtab0x80499181197FUNC<unknown>DEFAULT2
          uname.symtab0x8055b1039FUNC<unknown>DEFAULT2
          uname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          unknown.1474.symtab0x8058ea014OBJECT<unknown>DEFAULT4
          unsafe_state.symtab0x805ba4020OBJECT<unknown>DEFAULT11
          uppercase.symtab0x804920c51FUNC<unknown>DEFAULT2
          userID.symtab0x805b9d44OBJECT<unknown>DEFAULT11
          usleep.symtab0x8050f3847FUNC<unknown>DEFAULT2
          usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          util.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          util_atoi.symtab0x804d74c424FUNC<unknown>DEFAULT2
          util_fdgets.symtab0x804dbdf129FUNC<unknown>DEFAULT2
          util_isalpha.symtab0x804dc8d57FUNC<unknown>DEFAULT2
          util_isdigit.symtab0x804dcff45FUNC<unknown>DEFAULT2
          util_isspace.symtab0x804dcc657FUNC<unknown>DEFAULT2
          util_isupper.symtab0x804dc6045FUNC<unknown>DEFAULT2
          util_itoa.symtab0x804d8f4253FUNC<unknown>DEFAULT2
          util_local_addr.symtab0x804db2e177FUNC<unknown>DEFAULT2
          util_memcpy.symtab0x804d6fb47FUNC<unknown>DEFAULT2
          util_memsearch.symtab0x804d9f1116FUNC<unknown>DEFAULT2
          util_strcat.symtab0x804d6cf44FUNC<unknown>DEFAULT2
          util_strcmp.symtab0x804d636106FUNC<unknown>DEFAULT2
          util_strcpy.symtab0x804d6a047FUNC<unknown>DEFAULT2
          util_stristr.symtab0x804da65201FUNC<unknown>DEFAULT2
          util_strlen.symtab0x804d59c40FUNC<unknown>DEFAULT2
          util_strncmp.symtab0x804d5c4114FUNC<unknown>DEFAULT2
          util_zero.symtab0x804d72a34FUNC<unknown>DEFAULT2
          vfork.symtab0x8050f6856FUNC<unknown>DEFAULT2
          vseattack.symtab0x804a7911254FUNC<unknown>DEFAULT2
          vsnprintf.symtab0x804e1bc172FUNC<unknown>DEFAULT2
          vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          w.symtab0x805fc504OBJECT<unknown>DEFAULT12
          waitpid.symtab0x80515a091FUNC<unknown>DEFAULT2
          watchdog_maintain.symtab0x80483d8277FUNC<unknown>DEFAULT2
          watchdog_pid.symtab0x805bc244OBJECT<unknown>DEFAULT12
          wcrtomb.symtab0x805217463FUNC<unknown>DEFAULT2
          wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          wcsnrtombs.symtab0x80521d0128FUNC<unknown>DEFAULT2
          wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          wcsrtombs.symtab0x80521b427FUNC<unknown>DEFAULT2
          wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          wildString.symtab0x804909b310FUNC<unknown>DEFAULT2
          write.symtab0x80514e091FUNC<unknown>DEFAULT2
          x.symtab0x805fc444OBJECT<unknown>DEFAULT12
          xdigits.4985.symtab0x8059f4c17OBJECT<unknown>DEFAULT4
          xstatconv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          y.symtab0x805fc484OBJECT<unknown>DEFAULT12
          z.symtab0x805fc4c4OBJECT<unknown>DEFAULT12
          zprintf.symtab0x8048bee34FUNC<unknown>DEFAULT2

          Network Behavior

          Suricata IDS Alerts

          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
          2024-09-28T10:34:54.975022+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337354207.244.199.838008TCP
          2024-09-28T10:34:55.533836+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337354TCP
          2024-09-28T10:35:10.543421+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337356207.244.199.838008TCP
          2024-09-28T10:35:11.094063+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337356TCP
          2024-09-28T10:35:26.105890+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337358207.244.199.838008TCP
          2024-09-28T10:35:26.676734+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337358TCP
          2024-09-28T10:35:41.688246+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337360207.244.199.838008TCP
          2024-09-28T10:35:42.254395+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337360TCP
          2024-09-28T10:35:57.266201+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337362207.244.199.838008TCP
          2024-09-28T10:35:57.829286+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337362TCP
          2024-09-28T10:36:12.840797+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337364207.244.199.838008TCP
          2024-09-28T10:36:13.409713+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337364TCP
          2024-09-28T10:36:28.433814+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337366207.244.199.838008TCP
          2024-09-28T10:36:29.023774+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337366TCP
          2024-09-28T10:36:44.035450+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337368207.244.199.838008TCP
          2024-09-28T10:36:44.738630+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337368TCP
          2024-09-28T10:36:59.751331+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337370207.244.199.838008TCP
          2024-09-28T10:37:00.382929+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337370TCP
          2024-09-28T10:37:15.395625+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337372207.244.199.838008TCP
          2024-09-28T10:37:15.965672+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337372TCP
          2024-09-28T10:37:30.978352+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337374207.244.199.838008TCP
          2024-09-28T10:37:31.516655+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337374TCP
          2024-09-28T10:37:46.530769+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337376207.244.199.838008TCP
          2024-09-28T10:37:47.103768+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337376TCP
          2024-09-28T10:38:02.113477+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337378207.244.199.838008TCP
          2024-09-28T10:38:02.661821+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337378TCP
          2024-09-28T10:38:17.673880+02002840515ETPRO MALWARE ELF/BASHLITE Variant Reporting Arch Type (i586)1192.168.2.1337380207.244.199.838008TCP
          2024-09-28T10:38:18.229964+02002840516ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message1207.244.199.838008192.168.2.1337380TCP

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Sep 28, 2024 10:34:54.970052004 CEST373548008192.168.2.13207.244.199.83
          Sep 28, 2024 10:34:54.974940062 CEST800837354207.244.199.83192.168.2.13
          Sep 28, 2024 10:34:54.974997997 CEST373548008192.168.2.13207.244.199.83
          Sep 28, 2024 10:34:54.975022078 CEST373548008192.168.2.13207.244.199.83
          Sep 28, 2024 10:34:54.979823112 CEST800837354207.244.199.83192.168.2.13
          Sep 28, 2024 10:34:55.533835888 CEST800837354207.244.199.83192.168.2.13
          Sep 28, 2024 10:34:55.533865929 CEST800837354207.244.199.83192.168.2.13
          Sep 28, 2024 10:34:55.534049988 CEST373548008192.168.2.13207.244.199.83
          Sep 28, 2024 10:34:55.534147978 CEST373548008192.168.2.13207.244.199.83
          Sep 28, 2024 10:34:55.538971901 CEST800837354207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:10.538368940 CEST373568008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:10.543252945 CEST800837356207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:10.543343067 CEST373568008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:10.543421030 CEST373568008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:10.548167944 CEST800837356207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:11.094063044 CEST800837356207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:11.094197035 CEST800837356207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:11.094352007 CEST373568008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:11.094444036 CEST373568008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:11.099235058 CEST800837356207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:26.100917101 CEST373588008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:26.105784893 CEST800837358207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:26.105848074 CEST373588008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:26.105890036 CEST373588008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:26.110693932 CEST800837358207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:26.676733971 CEST800837358207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:26.676753998 CEST800837358207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:26.677138090 CEST373588008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:26.677315950 CEST373588008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:26.682035923 CEST800837358207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:41.683094978 CEST373608008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:41.688070059 CEST800837360207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:41.688205004 CEST373608008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:41.688246012 CEST373608008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:41.693017960 CEST800837360207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:42.254395008 CEST800837360207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:42.254427910 CEST800837360207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:42.254580975 CEST373608008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:42.254793882 CEST373608008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:42.262578011 CEST800837360207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:57.261071920 CEST373628008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:57.266087055 CEST800837362207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:57.266201019 CEST373628008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:57.266201019 CEST373628008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:57.271133900 CEST800837362207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:57.829286098 CEST800837362207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:57.829335928 CEST800837362207.244.199.83192.168.2.13
          Sep 28, 2024 10:35:57.829400063 CEST373628008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:57.829457998 CEST373628008192.168.2.13207.244.199.83
          Sep 28, 2024 10:35:57.834218979 CEST800837362207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:12.835705042 CEST373648008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:12.840670109 CEST800837364207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:12.840768099 CEST373648008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:12.840796947 CEST373648008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:12.845585108 CEST800837364207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:13.409713030 CEST800837364207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:13.409871101 CEST373648008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:13.410149097 CEST800837364207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:13.410300970 CEST373648008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:13.415920973 CEST800837364207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:28.416218042 CEST373668008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:28.433737040 CEST800837366207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:28.433814049 CEST373668008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:28.433814049 CEST373668008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:28.456399918 CEST800837366207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:29.023773909 CEST800837366207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:29.023889065 CEST800837366207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:29.024041891 CEST373668008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:29.024195910 CEST373668008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:29.032424927 CEST800837366207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:44.030463934 CEST373688008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:44.035361052 CEST800837368207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:44.035449982 CEST373688008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:44.035449982 CEST373688008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:44.040251970 CEST800837368207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:44.738630056 CEST800837368207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:44.738831043 CEST373688008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:44.739183903 CEST800837368207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:44.739294052 CEST373688008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:44.744095087 CEST800837368207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:59.746180058 CEST373708008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:59.751144886 CEST800837370207.244.199.83192.168.2.13
          Sep 28, 2024 10:36:59.751291037 CEST373708008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:59.751331091 CEST373708008192.168.2.13207.244.199.83
          Sep 28, 2024 10:36:59.756123066 CEST800837370207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:00.382929087 CEST800837370207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:00.382972956 CEST800837370207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:00.382985115 CEST800837370207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:00.383248091 CEST373708008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:00.383248091 CEST373708008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:00.383418083 CEST373708008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:00.388238907 CEST800837370207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:15.390599012 CEST373728008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:15.395545006 CEST800837372207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:15.395606995 CEST373728008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:15.395625114 CEST373728008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:15.400444031 CEST800837372207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:15.965672016 CEST800837372207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:15.965717077 CEST800837372207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:15.965769053 CEST373728008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:15.965955019 CEST373728008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:15.970748901 CEST800837372207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:30.972393990 CEST373748008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:30.978239059 CEST800837374207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:30.978313923 CEST373748008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:30.978352070 CEST373748008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:30.983115911 CEST800837374207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:31.516654968 CEST800837374207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:31.516840935 CEST373748008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:31.517061949 CEST800837374207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:31.517241001 CEST373748008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:31.522061110 CEST800837374207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:46.525707006 CEST373768008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:46.530680895 CEST800837376207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:46.530769110 CEST373768008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:46.530769110 CEST373768008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:46.535588980 CEST800837376207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:47.103768110 CEST800837376207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:47.103796959 CEST800837376207.244.199.83192.168.2.13
          Sep 28, 2024 10:37:47.103861094 CEST373768008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:47.103913069 CEST373768008192.168.2.13207.244.199.83
          Sep 28, 2024 10:37:47.108712912 CEST800837376207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:02.108366013 CEST373788008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:02.113322020 CEST800837378207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:02.113439083 CEST373788008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:02.113476992 CEST373788008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:02.118316889 CEST800837378207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:02.661820889 CEST800837378207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:02.661947966 CEST800837378207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:02.661986113 CEST373788008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:02.662269115 CEST373788008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:02.667135000 CEST800837378207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:17.668601036 CEST373808008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:17.673530102 CEST800837380207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:17.673842907 CEST373808008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:17.673880100 CEST373808008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:17.678641081 CEST800837380207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:18.229964018 CEST800837380207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:18.230129957 CEST800837380207.244.199.83192.168.2.13
          Sep 28, 2024 10:38:18.230317116 CEST373808008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:18.230431080 CEST373808008192.168.2.13207.244.199.83
          Sep 28, 2024 10:38:18.235661030 CEST800837380207.244.199.83192.168.2.13

          UDP Packets

          TimestampSource PortDest PortSource IPDest IP
          Sep 28, 2024 10:37:40.213352919 CEST5546153192.168.2.131.1.1.1
          Sep 28, 2024 10:37:40.213423014 CEST5628553192.168.2.131.1.1.1
          Sep 28, 2024 10:37:40.220489979 CEST53562851.1.1.1192.168.2.13
          Sep 28, 2024 10:37:40.220756054 CEST53554611.1.1.1192.168.2.13

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Sep 28, 2024 10:37:40.213352919 CEST192.168.2.131.1.1.10x2e8cStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
          Sep 28, 2024 10:37:40.213423014 CEST192.168.2.131.1.1.10xabb3Standard query (0)daisy.ubuntu.com28IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Sep 28, 2024 10:37:40.220756054 CEST1.1.1.1192.168.2.130x2e8cNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
          Sep 28, 2024 10:37:40.220756054 CEST1.1.1.1192.168.2.130x2e8cNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

          System Behavior

          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/rm
          Arguments:rm -f /tmp/tmp.gwY62oDfHc /tmp/tmp.eq3MmwQRU8 /tmp/tmp.4pNKbmBgxQ
          File size:72056 bytes
          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/cat
          Arguments:cat /tmp/tmp.gwY62oDfHc
          File size:43416 bytes
          MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/head
          Arguments:head -n 10
          File size:47480 bytes
          MD5 hash:fd96a67145172477dd57131396fc9608

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/tr
          Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
          File size:51544 bytes
          MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/cut
          Arguments:cut -c -80
          File size:47480 bytes
          MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/cat
          Arguments:cat /tmp/tmp.gwY62oDfHc
          File size:43416 bytes
          MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/head
          Arguments:head -n 10
          File size:47480 bytes
          MD5 hash:fd96a67145172477dd57131396fc9608

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/tr
          Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
          File size:51544 bytes
          MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/cut
          Arguments:cut -c -80
          File size:47480 bytes
          MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/dash
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Chronological Activities


          General

          Start time (UTC):08:34:44
          Start date (UTC):28/09/2024
          Path:/usr/bin/rm
          Arguments:rm -f /tmp/tmp.gwY62oDfHc /tmp/tmp.eq3MmwQRU8 /tmp/tmp.4pNKbmBgxQ
          File size:72056 bytes
          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

          Chronological Activities


          General

          Start time (UTC):08:34:53
          Start date (UTC):28/09/2024
          Path:/tmp/cayo.i486.elf
          Arguments:/tmp/cayo.i486.elf
          File size:107030 bytes
          MD5 hash:79510a83213cde59c1c632bb6bdcb9c0

          Chronological Activities


          General

          Start time (UTC):08:34:54
          Start date (UTC):28/09/2024
          Path:/tmp/cayo.i486.elf
          Arguments:-
          File size:107030 bytes
          MD5 hash:79510a83213cde59c1c632bb6bdcb9c0

          Chronological Activities


          General

          Start time (UTC):08:34:54
          Start date (UTC):28/09/2024
          Path:/tmp/cayo.i486.elf
          Arguments:-
          File size:107030 bytes
          MD5 hash:79510a83213cde59c1c632bb6bdcb9c0

          Chronological Activities


          General

          Start time (UTC):08:34:54
          Start date (UTC):28/09/2024
          Path:/tmp/cayo.i486.elf
          Arguments:-
          File size:107030 bytes
          MD5 hash:79510a83213cde59c1c632bb6bdcb9c0

          Chronological Activities