Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527400
MD5:	4d2d2f68414f89df18743d70a56473d8
SHA1:	118fad398cdc14b864f308af76515b3ff5ff84db
SHA256:	05be52ca16fd42e1d78a566a99f062b102557b22db923a606a0ef88a929ac4e0
Tags:	elfGafgytMiraiuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527400
Start date and time:	2024-10-06 23:33:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/1@2/0

Warnings

VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 5435, Parent: 5359, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5437, Parent: 5435)

na.elf New Fork (PID: 5439, Parent: 5437)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1184c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1189c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
na.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11734:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1184c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1189c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11734:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1184c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1189c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x11734:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: na.elf PID: 5435	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5435	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x41f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x421c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x426c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x430c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x435c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5435	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x41a7:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x4619:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: na.elf PID: 5437	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5437	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x40a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4107:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x411b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x412f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4143:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4157:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x416b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x417f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4193:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x420b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x421f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4233:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5437	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x4056:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x44c8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Found malware configuration

Source: na.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "5.42.98.74:4258"}

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 66%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/na.elf (PID: 5435)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:39932 -> 5.42.98.74:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: na.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: na.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: na.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/1@2/0

Source: /tmp/na.elf (PID: 5435)

Queries kernel information via 'uname':

Jump to behavior

Source: na.elf, 5435.1.00007ffda68cb000.00007ffda68ec000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.7vP5t8
Source: na.elf, 5435.1.000056027428d000.000056027433d000.rw-.sdmp, na.elf, 5437.1.000056027428d000.000056027433d000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: na.elf, 5435.1.00007ffda68cb000.00007ffda68ec000.rw-.sdmp, na.elf, 5437.1.00007ffda68cb000.00007ffda68ec000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5435.1.000056027428d000.000056027433d000.rw-.sdmp, na.elf, 5437.1.000056027428d000.000056027433d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: na.elf, 5435.1.00007ffda68cb000.00007ffda68ec000.rw-.sdmp, na.elf, 5437.1.00007ffda68cb000.00007ffda68ec000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: na.elf, 5435.1.00007ffda68cb000.00007ffda68ec000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.7vP5t8\4

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f84cc001000.00007f84cc015000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "5.42.98.74:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	67%	ReversingLabs	Linux.Trojan.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
5.42.98.74:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	na.elf	false	unknown
http://www.billybobbot.com/crawler/)	na.elf	false	unknown
http://fast.no/support/crawler.asp)	na.elf	false	unknown
http://feedback.redkolibri.com/	na.elf	false	unknown
http://www.baidu.com/search/spider.htm)	na.elf	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.98.74	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.42.98.74	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
5.42.98.74	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	Xmrig	Browse	5.42.80.2
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.15
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.15

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.7vP5t8 (deleted)

Download File

Process:	/tmp/na.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.152587075556178
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	108'983 bytes
MD5:	4d2d2f68414f89df18743d70a56473d8
SHA1:	118fad398cdc14b864f308af76515b3ff5ff84db
SHA256:	05be52ca16fd42e1d78a566a99f062b102557b22db923a606a0ef88a929ac4e0
SHA512:	d8cfc7486704550b22686099b52d2d781168a96a22cd68aa5d4e93c811f57bd3a501ae395342496076750269d6a934540dc3f487853e2802c50769b33250494e
SSDEEP:	3072:0QWtewn5BpeGQq4k3SI5he1B3m7ArEfT3n:0QWtetq4M5hMVm7ArEfT3n
TLSH:	89B33B03A3190B43D5CB59B02DEB37F143BAE9E112B36181A91EBF9417B3BB91152F85
File Content Preview:	.ELF...........................4..O......4. ...(......................>h..>h..............@...@...@.......t...............@T..@T..@T................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........D,..../...@..`= .

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10000218
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	85932
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100000b4	0xb4	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000d8	0xd8	0xfa1c	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1000faf4	0xfaf4	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1000fb18	0xfb18	0x4350	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x10024000	0x14000	0x54	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x10024054	0x14054	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x10024054	0x14054	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002405c	0x1405c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x10024064	0x14064	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x10024068	0x14068	0x2c2	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x1002432c	0x1432c	0x10	0x4	0x7	WAX	0	0	4
.sdata	PROGBITS	0x1002433c	0x1433c	0x56	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x10024398	0x14392	0x94	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x1002442c	0x14392	0x708c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x14392	0xb9a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x14f2c	0x7e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x152a4	0x30e0	0x10	0x0		18	281	4
.strtab	STRTAB	0x0	0x18384	0x2633	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x13e68	0x13e68	6.2403	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x14000	0x10024000	0x10024000	0x392	0x74b8	4.5394	0x7	RWE	0x10000	.eh_frame .tbss .ctors .dtors .jcr .data .got .sdata .sbss .bss
TLS	0x14054	0x10024054	0x10024054	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x100000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000d8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1000faf4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1000fb18	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x10024000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x10024054	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1002405c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x10024064	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x10024068	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1002432c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1002433c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x10024398	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x1002442c	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.3.5322	.symtab	0x100139d8	12	OBJECT	<unknown>	DEFAULT	4
C.3.6030	.symtab	0x1001297c	12	OBJECT	<unknown>	DEFAULT	4
C.3.6052	.symtab	0x10013d20	12	OBJECT	<unknown>	DEFAULT	4
C.3.6106	.symtab	0x10013d14	12	OBJECT	<unknown>	DEFAULT	4
C.4.5416	.symtab	0x10013cfc	24	OBJECT	<unknown>	DEFAULT	4
C.4.6053	.symtab	0x10013d2c	12	OBJECT	<unknown>	DEFAULT	4
C.6.6061	.symtab	0x10013d38	12	OBJECT	<unknown>	DEFAULT	4
C.69.5522	.symtab	0x100111dc	104	OBJECT	<unknown>	DEFAULT	4
C.7.5462	.symtab	0x100139e4	12	OBJECT	<unknown>	DEFAULT	4
C.76.5621	.symtab	0x10011e70	1128	OBJECT	<unknown>	DEFAULT	4
Q	.symtab	0x10024448	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0x100022a4	424	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x10001e64	424	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x10002158	332	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x10024330	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_SDA_BASE_	.symtab	0x1002c33c	0	NOTYPE	<unknown>	DEFAULT	12
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x10024058	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x10024054	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1001237c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x100139fa	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1001267c	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x10024060	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x1002405c	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x10024000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x10024050	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x10024348	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x10024368	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x10024350	4	OBJECT	<unknown>	HIDDEN	12
__GI___close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	HIDDEN	2
__GI___waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x100047b8	92	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x10007a4c	248	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10008064	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1000d06c	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x10004814	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x10008da8	116	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x10009928	212	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1000a034	80	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1000a084	84	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x10009d00	820	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10006814	120	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x10008230	136	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1000a200	640	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1000a480	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x10008670	824	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x100096a0	16	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x100096c0	16	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x10008b40	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x10009720	16	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x100066a4	4	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x100066a8	4	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x10004574	228	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1000c478	44	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x1000497c	24	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x10004848	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10005e64	144	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x10009730	52	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1000d150	52	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x10009764	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x10008e1c	132	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1000f37c	120	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10008b78	148	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x10007b48	104	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x10007d18	140	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10008f24	132	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x10006928	128	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x100048b0	136	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x100069dc	128	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x10004938	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x10006a90	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10006028	32	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1000f514	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10006048	160	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1000c358	72	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x100061d4	240	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1000647c	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x10008070	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x10008400	624	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1000496c	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x10004994	32	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1000f470	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x10008ea0	132	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x10024064	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x100243dc	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x10024244	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10009238	96	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1000ee94	144	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x10008db4	16	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1002434c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x1002436c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x10024354	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x10024414	4	OBJECT	<unknown>	DEFAULT	13
__data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted	.symtab	0x1000e25c	280	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1000f64c	188	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x1000e374	1672	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1000fa88	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000d8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x10024068	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x1000f9bc	204	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1000f564	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1000f708	124	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
__errno_location	.symtab	0x100049b4	20	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x100243c0	4	OBJECT	<unknown>	HIDDEN	13
__fcntl_nocancel	.symtab	0x10004658	116	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x100243c4	4	OBJECT	<unknown>	HIDDEN	13
__fork_handlers	.symtab	0x100243c8	4	OBJECT	<unknown>	HIDDEN	13
__fork_lock	.symtab	0x100243cc	4	OBJECT	<unknown>	HIDDEN	13
__get_hosts_byname_r	.symtab	0x1000ef24	88	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1000d334	344	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x100062c4	48	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1000902c	124	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x100090a8	172	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1000cd5c	464	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x100243d0	4	OBJECT	<unknown>	DEFAULT	13
__libc_waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x100089a8	52	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x10008d30	120	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x10013df0	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x10007634	460	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x10006bfc	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x10024168	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x1002b140	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x1000757c	184	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x10024420	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x10024424	4	OBJECT	<unknown>	HIDDEN	13
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1000f784	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1000ea80	1044	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x10008e28	16	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x100243d8	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x10024054	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x1000cf2c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1000915c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10009154	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1000f790	556	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x10008f30	16	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x100089dc	356	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x10024418	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x10024391	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x1002b0d8	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x10024390	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x100243e0	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x1002441c	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x10024428	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x10006bac	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10006bd4	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x10006b84	40	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1000f268	88	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1000cfc0	172	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x1002437c	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1000d630	120	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1000d6a8	264	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1000d7b0	212	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1000a874	364	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1000d884	72	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1000d97c	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1000d8cc	176	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1000ab9c	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1000aca0	76	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x10024380	4	OBJECT	<unknown>	DEFAULT	12
__sys_connect	.symtab	0x100067e0	52	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x100068f4	52	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x100069a8	52	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x10009644	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x10009798	52	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1000f348	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1000d0a0	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1000487c	52	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x100091a8	144	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10009298	100	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x100092fc	840	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1002435c	4	OBJECT	<unknown>	HIDDEN	12
__waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel	.symtab	0x10008fb4	16	FUNC	<unknown>	DEFAULT	2
__write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x10008eac	16	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1000d268	204	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1000d184	228	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x10028448	10	OBJECT	<unknown>	DEFAULT	14
_charpad	.symtab	0x10004b30	100	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x1002b0f0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x1002b118	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x10024358	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x1000cf38	28	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x1002438c	4	OBJECT	<unknown>	DEFAULT	12
_dl_nothread_init_static_tls	.symtab	0x1000cf54	108	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x1002440c	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x10024410	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_gaps	.symtab	0x10024400	1	OBJECT	<unknown>	DEFAULT	13
_dl_tls_dtv_slotinfo_list	.symtab	0x100243fc	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_generation	.symtab	0x10024404	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_max_dtv_idx	.symtab	0x100243f4	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_setup	.symtab	0x1000cd0c	80	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x100243f0	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_nelem	.symtab	0x10024408	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_size	.symtab	0x100243f8	4	OBJECT	<unknown>	DEFAULT	13
_dl_tls_static_used	.symtab	0x100243ec	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x10024392	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x1002b4b8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x100047b8	92	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1000faf4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x10028b94	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x10004b94	152	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1000aea0	1784	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x100000b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1000acec	128	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x10005324	188	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x100056dc	1488	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x100053e0	92	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1000543c	608	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1000569c	64	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x10009170	56	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10009164	12	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x10009660	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x100243b8	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x10000218	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1000a48c	1000	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1000a9e0	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x10024384	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x10028b7c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1000b7bc	540	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x100243e8	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x10028b88	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x100243e4	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x1002425c	204	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x1000aa60	316	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x10024388	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x10008078	440	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1000ad6c	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x10012a48	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1000ada8	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x10004c2c	1784	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x10007a4c	248	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10008064	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x10006410	16	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x10028634	4	OBJECT	<unknown>	DEFAULT	14
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1000d06c	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
buf.4826	.symtab	0x10028458	16	OBJECT	<unknown>	DEFAULT	14
buf.6501	.symtab	0x1002847c	440	OBJECT	<unknown>	DEFAULT	14
bzero	.symtab	0x10006420	12	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x10024160	4	OBJECT	<unknown>	DEFAULT	10
call___do_global_ctors_aux	.symtab	0x1000fad8	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x10000170	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001fc	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1000c830	264	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x10004814	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x10008da8	116	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x10009928	212	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x1002433c	4	OBJECT	<unknown>	DEFAULT	12
completed.5580	.symtab	0x1002442c	0	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x10006814	120	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x100018c0	656	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x10024344	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x10024070	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x10024340	4	OBJECT	<unknown>	DEFAULT	12
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x100243d4	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x10008230	136	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x10013d60	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1000a200	640	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x100046cc	236	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x100099fc	184	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x10000510	232	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x10009b84	184	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1000b9d8	744	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1000b6c8	244	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1000bdf8	196	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x10013d48	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1000a480	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x10008670	824	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x10028638	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0x10005cac	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x1000018c	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x10007800	524	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1000d48c	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1000d49c	404	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1000d0d4	124	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10005d08	192	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x100031b8	40	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10001550	124	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x100005f8	648	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x100004a0	112	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1000b598	304	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1000bcc0	312	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x10009668	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x100096a0	16	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x100096b0	16	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x100096c0	16	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x10006790	8	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x10006798	72	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1000c574	664	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1000ef7c	748	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x1000f2c0	136	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x100096d0	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x10008b40	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x100096ec	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1000688c	52	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x100068c0	52	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x10009720	16	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6500	.symtab	0x10028468	20	OBJECT	<unknown>	DEFAULT	14
htonl	.symtab	0x100066a4	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x100066a8	4	FUNC	<unknown>	DEFAULT	2
i.4865	.symtab	0x10024164	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1000675c	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1000c4a4	208	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x10006728	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x100066ac	124	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x1000df84	728	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x1000de30	340	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x1000dc24	524	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x1000db48	220	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10003bd0	412	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x10000260	232	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x1000ccd0	60	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x10007c2c	132	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x10007e98	236	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x10004574	228	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1000c478	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x1000497c	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x10004848	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6558	.symtab	0x10024328	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.6557	.symtab	0x1002b0d0	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x10001b50	460	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x1000f4a4	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x100243a8	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0x10003d6c	2056	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x10024398	4	OBJECT	<unknown>	DEFAULT	13
malloc	.symtab	0x10006c6c	2320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x10007a0c	64	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x1000bf60	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x10005dc8	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x1000bebc	164	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x1000c068	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x1000c09c	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x10005e64	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x10009730	52	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x1000d150	52	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x10009764	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x10024180	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x10024198	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x100097cc	112	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1347	.symtab	0x10028454	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0x100082b8	328	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1000669c	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x100066a0	4	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x100243a0	8	OBJECT	<unknown>	DEFAULT	13
object.5595	.symtab	0x10024430	0	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x10008e1c	132	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x10009ab4	208	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x100243b0	4	OBJECT	<unknown>	DEFAULT	13
ovhl7	.symtab	0x1000244c	3436	FUNC	<unknown>	DEFAULT	2
p.5578	.symtab	0x1002406c	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x100243b4	4	OBJECT	<unknown>	DEFAULT	13
poll	.symtab	0x1000f37c	120	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6256	.symtab	0x10012990	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10000e00	1568	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x100009dc	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10000c00	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10000a5c	420	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x100031e0	2544	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x10024364	4	OBJECT	<unknown>	DEFAULT	12
program_invocation_short_name	.symtab	0x10024360	4	OBJECT	<unknown>	DEFAULT	12
qual_chars.6264	.symtab	0x100129d8	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x10008b78	148	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x10007b44	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10000348	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x10007b48	104	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x100135a4	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x10007d18	140	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x100241c4	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x1000d9d4	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10008f24	132	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x10009c3c	196	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1000c938	920	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x10006928	128	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x100015cc	756	FUNC	<unknown>	DEFAULT	2
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6540	.symtab	0x1002b0d4	4	OBJECT	<unknown>	DEFAULT	14
rindex	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x1000983c	116	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x100048b0	136	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x100069dc	128	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x10004938	52	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x10006a5c	52	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x10007bb0	124	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x10007f84	224	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x1000c80c	36	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x10006ac4	192	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x100098b0	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x1000ea3c	68	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x1000e9fc	64	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x10008c0c	292	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x10006a90	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x10001d1c	328	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x10001420	304	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6263	.symtab	0x10012a06	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6255	.symtab	0x10012988	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6260	.symtab	0x10012a18	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6259	.symtab	0x10012a30	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6262	.symtab	0x100129f6	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6261	.symtab	0x100129ec	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x100049c8	136	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x10007cb0	104	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x10007da4	244	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x1000f3f4	124	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x1002ae9c	512	OBJECT	<unknown>	DEFAULT	14
static_map	.symtab	0x1002b09c	52	OBJECT	<unknown>	DEFAULT	14
static_slotinfo	.symtab	0x1002ab94	776	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x10024378	4	OBJECT	<unknown>	DEFAULT	12
stdin	.symtab	0x10024370	4	OBJECT	<unknown>	DEFAULT	12
stdout	.symtab	0x10024374	4	OBJECT	<unknown>	DEFAULT	12
strcasecmp	.symtab	0x1000642c	80	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x10005ef4	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x1000c190	248	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x10005ff4	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x10006028	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x1000c288	96	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x1000f514	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x100062f4	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x10006048	160	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1000da8c	188	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x100060e8	236	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x1000c43c	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1000c2e8	112	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x1000c358	72	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x100061d4	240	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1000647c	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x1000c3a0	156	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x10008070	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x10008400	624	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x10006488	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcsetattr	.symtab	0x10006524	376	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x1000496c	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x10004994	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x10000880	348	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x100129b4	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x100129cc	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x1000f470	52	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1370	.symtab	0x10012a38	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x100241b0	20	OBJECT	<unknown>	DEFAULT	10
useragents	.symtab	0x10024074	236	OBJECT	<unknown>	DEFAULT	10
vsnprintf	.symtab	0x10004a50	224	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x10008fa8	132	FUNC	<unknown>	DEFAULT	2
wcrtomb	.symtab	0x1000a0d8	92	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x1000a144	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x1000a134	16	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x10008ea0	132	FUNC	<unknown>	DEFAULT	2
xdigits.5264	.symtab	0x10013dd4	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x1000200c	332	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:33:50.844918966 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:33:50.850271940 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:33:50.850388050 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:33:50.851887941 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:33:50.856806040 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:12.254101992 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:12.254581928 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:12.254581928 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:12.255845070 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:12.259838104 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:12.260891914 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:12.260992050 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:12.261147976 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:12.266313076 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:33.624458075 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:33.624797106 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:33.626538038 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:33.630390882 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:33.631515026 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:33.631733894 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:33.631789923 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:33.636634111 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:55.015105963 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:55.015456915 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:55.016484022 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:55.021022081 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:55.021878958 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:34:55.021994114 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:55.022054911 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:34:55.027044058 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:16.405946970 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:16.406369925 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:16.408340931 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:16.411885977 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:16.413676977 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:16.414031029 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:16.414277077 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:16.419346094 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:37.829097986 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:37.830137968 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:37.833240032 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:37.835630894 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:37.838735104 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:37.839155912 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:37.839270115 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:37.844681978 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:59.219573975 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:59.219824076 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:59.220803022 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:59.225316048 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:59.225982904 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:35:59.226067066 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:59.226171970 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:35:59.231290102 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:20.594719887 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:20.595283031 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:20.598284006 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:20.600601912 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:20.603844881 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:20.604293108 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:20.604389906 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:20.609993935 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:41.969768047 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:41.970062971 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:41.970798969 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:41.974987030 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:41.975681067 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:36:41.975755930 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:41.975790024 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:36:41.980690956 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:03.329931974 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:03.330492020 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:03.330615997 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:03.332245111 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:03.336034060 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:03.337455034 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:03.337548018 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:03.337629080 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:03.342750072 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:24.705816984 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:24.706041098 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:24.707601070 CEST	39952	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:24.711421013 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:24.712745905 CEST	4258	39952	5.42.98.74	192.168.2.13
Oct 6, 2024 23:37:24.712810993 CEST	39952	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:24.712842941 CEST	39952	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:37:24.718597889 CEST	4258	39952	5.42.98.74	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:36:34.904958010 CEST	51708	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:36:34.904958010 CEST	34644	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:36:34.912168026 CEST	53	34644	8.8.8.8	192.168.2.13
Oct 6, 2024 23:36:34.912220001 CEST	53	51708	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 23:36:34.904958010 CEST	192.168.2.13	8.8.8.8	0x5b01	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:36:34.904958010 CEST	192.168.2.13	8.8.8.8	0xc9cd	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 23:36:34.912220001 CEST	8.8.8.8	192.168.2.13	0x5b01	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:36:34.912220001 CEST	8.8.8.8	192.168.2.13	0x5b01	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 5435, Parent PID: 5359

General

Start time (UTC):	21:33:49
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: na.elf PID: 5437, Parent PID: 5435

General

Start time (UTC):	21:33:50
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: na.elf PID: 5439, Parent PID: 5437

General

Start time (UTC):	21:33:50
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.7vP5t8 (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 5435, Parent PID: 5359

General

Chronological Activities

Analysis Process: na.elf PID: 5437, Parent PID: 5435

General

Chronological Activities

Analysis Process: na.elf PID: 5439, Parent PID: 5437

General

Chronological Activities

Linux Analysis Report
na.elf