Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527404
MD5:	e877b84ac315607b595ffaae7c1d886f
SHA1:	972225bd07503ba331cad6a6bd561c1267c07d06
SHA256:	298fb71de75b13634b90fe251e2a5d18e55fa9b1ae014d9a8a414977d1c90e6f
Tags:	elfGafgytMiraiuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527404
Start date and time:	2024-10-06 23:37:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	5426
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 5426, Parent: 5348, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5428, Parent: 5426)

na.elf New Fork (PID: 5430, Parent: 5428)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10bfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
na.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10bac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10bfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10bac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10bfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10cec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10bac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: na.elf PID: 5426	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5426	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x67da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6802:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6816:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x682a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x683e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6852:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6866:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x687a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x688e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x68a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x68b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x68ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x68de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x68f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6906:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x691a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x692e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6942:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6956:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x696a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5426	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x678d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x6bff:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: na.elf PID: 5428	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5428	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2f61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f75:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fc5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fd9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3001:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3015:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3029:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x303d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3051:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3065:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3079:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x308d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5428	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2f14:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x3386:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Found malware configuration

Source: na.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "5.42.98.74:4258"}

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 79%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/na.elf (PID: 5426)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:39932 -> 5.42.98.74:4258

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.98.74
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: na.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: na.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: na.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: na.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5428, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/0@2/0

Source: /tmp/na.elf (PID: 5426)

Queries kernel information via 'uname':

Jump to behavior

Source: na.elf, 5426.1.00007ffc57373000.00007ffc57394000.rw-.sdmp, na.elf, 5428.1.00007ffc57373000.00007ffc57394000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5426.1.000055ee9ea23000.000055ee9eb51000.rw-.sdmp, na.elf, 5428.1.000055ee9ea23000.000055ee9eb51000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: na.elf, 5426.1.000055ee9ea23000.000055ee9eb51000.rw-.sdmp, na.elf, 5428.1.000055ee9ea23000.000055ee9eb51000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 5426.1.00007ffc57373000.00007ffc57394000.rw-.sdmp, na.elf, 5428.1.00007ffc57373000.00007ffc57394000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5428, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5428.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007f9d80017000.00007f9d8002a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5428, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "5.42.98.74:4258"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	79%	ReversingLabs	Linux.Trojan.Gafgyt
na.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
5.42.98.74:4258	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	na.elf	false	unknown
http://www.billybobbot.com/crawler/)	na.elf	false	unknown
http://fast.no/support/crawler.asp)	na.elf	false	unknown
http://feedback.redkolibri.com/	na.elf	false	unknown
http://www.baidu.com/search/spider.htm)	na.elf	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.98.74	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.42.98.74	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	5.42.98.74
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	6.041588674414023
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	115'077 bytes
MD5:	e877b84ac315607b595ffaae7c1d886f
SHA1:	972225bd07503ba331cad6a6bd561c1267c07d06
SHA256:	298fb71de75b13634b90fe251e2a5d18e55fa9b1ae014d9a8a414977d1c90e6f
SHA512:	771db1eb47cdb7e14461d12c8b8371f8c76dc9231f88c3518b02ee96aff61ac74d4dcbcaafeb7c2757d80b82f3c01f2a11dc0e1969428d8ef364aca933f796c9
SSDEEP:	3072:dDv2Ou25FC9+UaVeTY2Y1C5h6drH9Gm0Qxu1bXWIn:xvz8sVeTYX1C5h6drH9Gm0Qxu1rWIn
TLSH:	ACB32849F5008653C1D32B7ABB8B434A37226AE997DB33155638BFF43BC36991D36980
File Content Preview:	.ELF...a..........(.........4....R......4. ...(..........................................0...0...0.......i..........Q.td..................................-...L."....;..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	86780
Section Header Size:	40
Number of Section Headers:	21
Header String Table Index:	18

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0xeecc	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x16f7c	0xef7c	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x16f90	0xef90	0x3f08	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x23000	0x13000	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x23004	0x13004	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x2300c	0x1300c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x23014	0x13014	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x23018	0x13018	0x370	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x23388	0x13388	0x6660	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x13388	0xbb0	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x13f38	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x14058	0x70d	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x14765	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x14819	0x978	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x15194	0xa0	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x15234	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x15244	0xb8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x15644	0x46a0	0x10	0x0		20	622	4
.strtab	STRTAB	0x0	0x19ce4	0x24a1	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x12e98	0x12e98	6.2365	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x13000	0x23000	0x23000	0x388	0x69e8	4.0595	0x6	RW	0x8000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x16f7c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x16f90	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x23000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x23004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2300c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x23014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x23018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x23388	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x16f7c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f88	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x16f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x16f8c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x94d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa05c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xade4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb79c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc49c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc54c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc65c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc66c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc6e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd10c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd144	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd32c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdaa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdbb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe13c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe24c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe35c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf06c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf85c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1018c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1054c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1413c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14284	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23004	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x2300c	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x16f70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23028	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x94cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x98ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18654	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x9bdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa9dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xadfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb91c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc138	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x28	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x48	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0xc6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc6e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23128	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x197f8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x23130	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19af8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc6ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc90c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23138	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19df8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xd058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e2c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xd2dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd83c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23274	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19e34	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xdb84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19eb8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xdef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe108	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe2ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23278	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf04c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf184	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23290	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf1fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf39c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x232a8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf478	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa24	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf8dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23354	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf99c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1043c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2336c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x10544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x106e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23378	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1aa9e	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1096c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ada0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10ac8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x295c8	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x10ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x110dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11494	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1adcc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12154	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x124f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1263c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1382c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1412c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14418	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1479c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1539c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23380	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1581c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23382	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1ae78	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x158c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x50	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x70	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x78	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x98	0	NOTYPE	<unknown>	DEFAULT	16
C.1.3461	.symtab	0x1ada0	24	OBJECT	<unknown>	DEFAULT	4
C.70.5136	.symtab	0x18654	104	OBJECT	<unknown>	DEFAULT	4
C.77.5235	.symtab	0x192e8	1128	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0xda68	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xda84	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x233b8	16384	OBJECT	<unknown>	DEFAULT	10
Randhex	.symtab	0x9ea0	444	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x9a40	416	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x9d40	352	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0xc448	40	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x23008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x23004	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x23128	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x197f8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x23378	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1aa9e	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x23130	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x19af8	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x23010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x2300c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x23000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x23000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x23128	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x23378	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x23130	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x2312c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x2337c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x23134	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0xc6e4	12	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xc3e4	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x12510	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0xdd80	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x10ad8	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xc380	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0xe314	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0xe338	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0xe2f0	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x100e8	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1018c	76	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0xdd94	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xc448	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0xf094	256	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0xf6b0	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x137f8	56	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xc470	44	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x10580	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xc49c	44	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x10744	212	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x10e08	48	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x10e38	52	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x10ae4	804	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0xe110	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x295c8	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0xf85c	156	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x10f88	368	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xc380	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x12340	464	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x120a8	188	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x12510	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x12164	156	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x12640	148	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x110f8	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xc4c8	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0xd86c	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x13ff8	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x14004	312	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x13830	80	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0xd8a0	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x12510	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x105ac	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x105d4	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x105dc	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x105e4	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0xe0b8	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0xe0c0	80	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x130b0	664	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x15924	764	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x15c20	112	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x105ec	24	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xc4f4	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x10604	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0xe13c	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x10630	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x295cc	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0xdfb0	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0xdf9c	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0xe094	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x12fc0	240	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0xe088	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0xe004	132	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x148e4	620	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x145a4	512	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0xf5e8	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xc4fc	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0xdf04	32	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0xc698	24	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xc54c	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x15d38	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x12b70	244	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xd970	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x15da0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x12c64	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x12c7c	220	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xd980	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x10478	96	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x13880	48	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x10638	44	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x10664	44	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0xdfe4	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0xdfd0	20	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xc578	92	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x108d4	156	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x15c90	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x13348	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0xf198	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0xf47c	140	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x14370	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xc5d4	44	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x10a04	212	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0xe198	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x10690	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xc600	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0xe1c4	44	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xc630	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0xe1f0	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0xf3b4	200	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x104d8	116	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0xe24c	164	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x106e8	48	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0xf8f8	168	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0xe220	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xc6f0	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0xf508	224	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x15cbc	80	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0xde7c	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0xdaa0	236	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x12d58	232	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xda20	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xda20	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0xdb8c	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x12e40	64	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x15db0	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xda40	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x14420	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0xdbb0	216	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x12f80	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x12e80	68	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x12ec4	72	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xdc88	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0xdef8	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x12f0c	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0xf6bc	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0xfab8	1528	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0xdf24	120	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xc65c	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xc6b0	52	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x15d0c	44	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xc724	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x10718	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xc664	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x10e6c	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x10edc	172	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x10ebc	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xc66c	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x23014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x23014	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x164a4	736	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x16e74	20	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x16e74	20	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x16e58	48	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x16eec	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x164a4	736	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x16e88	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x16ec4	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x16ed8	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x16eb0	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x16e9c	20	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x16bc0	516	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x16898	808	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x16498	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x164a0	740	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x167d8	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x167ac	44	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x16274	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv0	.symtab	0xc334	4	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1639c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1682c	108	FUNC	<unknown>	HIDDEN	2
__aeabi_ldiv0	.symtab	0xc334	4	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x16784	40	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xc158	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xc250	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x16818	128	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x295c0	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x23354	24	OBJECT	<unknown>	DEFAULT	9
__bss_end__	.symtab	0x299e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x23388	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x23388	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10154	56	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x15860	124	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x16dd4	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2312c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x2337c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x23134	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x295d0	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x23018	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x14b50	244	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x15ec8	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x10550	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1054c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xc334	4	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x16bc0	516	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x16274	296	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x14c44	1936	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x16f40	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x2301c	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x161cc	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x15de0	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x15f7c	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x299e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x295b8	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x16dd4	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xc6e4	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x295b0	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x167d8	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xc3e4	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x12510	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x23004	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x23004	0	NOTYPE	<unknown>	HIDDEN	6
__fixunsdfsi	.symtab	0x16eec	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1682c	108	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x167ac	44	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x16818	128	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x16784	40	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x16dc4	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x158dc	72	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x13e98	352	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x105ec	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0xdd80	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x16dc4	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x10ad8	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x23004	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x23004	0	NOTYPE	<unknown>	HIDDEN	6
__ledf2	.symtab	0x16dcc	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xc49c	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0xe110	44	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xc380	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xc4c8	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x15d38	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x10664	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xc578	92	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xc5d4	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0xe198	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xc600	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0xe1c4	44	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x104d8	116	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x295b4	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0xc664	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xc66c	44	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x1ae78	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x16dcc	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0xecbc	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0xe35c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x23278	24	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x29654	888	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0xec18	164	FUNC	<unknown>	DEFAULT	2
__modsi3	.symtab	0x163b4	228	FUNC	<unknown>	HIDDEN	2
__muldf3	.symtab	0x16898	808	FUNC	<unknown>	HIDDEN	2
__muldi3	.symtab	0xc338	72	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x299dc	4	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x299e0	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x16dd4	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x15fd8	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x15454	1036	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x295bc	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x23004	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x23004	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x23370	4	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x23374	4	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x100b8	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x100b0	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x100b0	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x100b0	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x100b0	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x15fe4	488	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x299d4	4	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x23383	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x295d8	24	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x23382	1	OBJECT	<unknown>	HIDDEN	9
__rtld_fini	.symtab	0x295c4	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x299d8	4	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x299e4	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0xe314	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0xe338	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0xe2f0	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x23144	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x1413c	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x11104	212	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x14198	192	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x114c4	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0xc854	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4591	.symtab	0x19df8	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x14258	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x14340	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x14284	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x115fc	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xc91c	44	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x23148	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x164a0	740	FUNC	<unknown>	HIDDEN	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x10554	44	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x100e8	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1018c	76	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x101d8	672	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2336c	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0xc158	248	FUNC	<unknown>	HIDDEN	2
__umodsi3	.symtab	0xc268	204	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0xdd94	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x13bc0	728	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x138b0	784	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x293c0	10	OBJECT	<unknown>	DEFAULT	10
_bss_end__	.symtab	0x299e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xc948	80	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x295fc	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x29624	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x23274	4	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x137d4	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x299cc	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x299d0	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x23388	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x299e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x295c8	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0xc448	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x16f7c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x273c0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xc998	128	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x11908	1952	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x295cc	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x11700	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x126e0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xd074	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0xd32c	1344	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xd10c	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xd144	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xd2e0	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x100c8	32	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x100c0	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2964c	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x111d8	748	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xc7d8	124	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x2314c	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x23150	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x12200	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x273bc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x23168	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x273b8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x23184	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0xc864	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x23180	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0xf6c4	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x11774	64	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x19ec8	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x117b4	340	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xca18	1628	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0xf094	256	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0xf6b0	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0xf6b0	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0xd950	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x295ac	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x137f8	56	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0xe24c	164	FUNC	<unknown>	DEFAULT	2
buf.2915	.symtab	0x293d0	16	OBJECT	<unknown>	DEFAULT	10
buf.5468	.symtab	0x293e0	440	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0xd960	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x23120	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x16f74	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x13360	268	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0xc470	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x10580	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xc49c	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x10744	212	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x23028	4	OBJECT	<unknown>	DEFAULT	9
completed.4916	.symtab	0x23388	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0xe110	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x94d0	640	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
currentServer	.symtab	0x2311c	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x23024	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x2302c	4	OBJECT	<unknown>	DEFAULT	9
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x295b8	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x295c8	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0xf85c	156	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1adcc	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x10f88	368	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xc380	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x10818	188	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8438	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x10970	148	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x12340	464	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x120a8	188	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x12510	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x12164	156	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x12640	148	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1adb8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x110f8	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x23018	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x23384	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0xc4c8	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0xd86c	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0xee64	520	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x13ff8	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x13ff8	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x14004	312	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x13830	80	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0xd8a0	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0xade4	28	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x9198	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8508	720	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x83d8	96	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x120a8	188	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x12510	304	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x105ac	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x105d4	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x105dc	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x105e4	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0xe0b8	8	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0xe0c0	80	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x130b0	664	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x15924	764	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x15c20	112	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x105ec	24	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xc4f4	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x10604	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0xe13c	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0xe168	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x10630	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x295cc	4	OBJECT	<unknown>	DEFAULT	10
hoste.5467	.symtab	0x29598	20	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0xdfb0	32	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0xdf9c	20	FUNC	<unknown>	DEFAULT	2
i.4537	.symtab	0x23124	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0xdaa0	236	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0xe094	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x12fc0	240	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0xe088	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0xe004	132	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x148e4	620	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x147a4	320	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x145a4	512	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x144d8	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xb79c	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0xf2a0	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0xf5e8	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0xc4fc	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0xdf04	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xc698	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xc54c	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5525	.symtab	0x23380	2	OBJECT	<unknown>	DEFAULT	9
last_ns_num.5524	.symtab	0x295d4	4	OBJECT	<unknown>	DEFAULT	10
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9750	420	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x15d38	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x233b0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xb928	2096	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x233a4	4	OBJECT	<unknown>	DEFAULT	10
malloc	.symtab	0xe3d4	2116	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0xf06c	40	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x12b70	244	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0xd970	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x15da0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x12c64	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x12c7c	220	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0xd980	156	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x10478	96	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x13880	48	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x10638	44	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x23290	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x232a8	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x10664	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1304	.symtab	0x293cc	4	OBJECT	<unknown>	DEFAULT	10
nprocessors_onln	.symtab	0xf9a0	280	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0xdfe4	32	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0xdfd0	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x233a8	8	OBJECT	<unknown>	DEFAULT	10
object.4931	.symtab	0x2338c	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0xc578	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x108d4	156	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x295f4	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0xa05c	3464	FUNC	<unknown>	DEFAULT	2
p.4914	.symtab	0x23020	0	OBJECT	<unknown>	DEFAULT	9
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x295f8	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x15c90	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4811	.symtab	0x19e20	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8ce0	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8908	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8af8	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8974	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xae00	2460	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x23374	4	OBJECT	<unknown>	DEFAULT	9
program_invocation_short_name	.symtab	0x23370	4	OBJECT	<unknown>	DEFAULT	9
qual_chars.4820	.symtab	0x19e34	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x13348	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0xf194	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0xf198	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1aa24	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0xf47c	140	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x232d4	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x14370	176	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0xc5d4	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x10a04	212	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1346c	872	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0xe198	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x91fc	724	FUNC	<unknown>	DEFAULT	2
resolv_conf_mtime.5510	.symtab	0x295f0	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x12e80	68	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x10690	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0xc600	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:38:18.362696886 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:18.367671013 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:38:18.367748022 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:18.371222973 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:18.376117945 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:38:39.738622904 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:38:39.739042997 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:39.739586115 CEST	39932	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:39.740735054 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:39.744452953 CEST	4258	39932	5.42.98.74	192.168.2.13
Oct 6, 2024 23:38:39.745631933 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:38:39.745749950 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:39.746232986 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:38:39.751048088 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:01.135071039 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:01.135509968 CEST	39934	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:01.136645079 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:01.140516043 CEST	4258	39934	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:01.141736984 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:01.141849995 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:01.141906023 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:01.146836996 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:22.645045996 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:22.645905018 CEST	39936	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:22.648116112 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:22.652451992 CEST	4258	39936	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:22.654602051 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:22.654973030 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:22.655158997 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:22.661817074 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:44.303287029 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:44.303344965 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:44.303673983 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:44.303819895 CEST	39938	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:44.305854082 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:44.309180975 CEST	4258	39938	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:44.311096907 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:39:44.311321974 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:44.311454058 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:39:44.316620111 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:05.676932096 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:05.677709103 CEST	39940	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:05.679323912 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:05.683243990 CEST	4258	39940	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:05.684432983 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:05.684700012 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:05.684932947 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:05.690073013 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:27.052372932 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:27.053227901 CEST	39942	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:27.055624962 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:27.058897972 CEST	4258	39942	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:27.061216116 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:27.061455011 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:27.061861992 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:27.067092896 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:48.447354078 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:48.448162079 CEST	39944	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:48.450690985 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:48.453711987 CEST	4258	39944	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:48.456140995 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:40:48.456453085 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:48.456453085 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:40:48.461973906 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:09.849368095 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:09.849889040 CEST	39946	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:09.851006985 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:09.854882956 CEST	4258	39946	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:09.856033087 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:09.856265068 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:09.856503963 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:09.861370087 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:31.246639967 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:31.247348070 CEST	39948	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:31.248707056 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:31.252557993 CEST	4258	39948	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:31.253859997 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:31.254100084 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:31.254297972 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:31.259753942 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:52.616556883 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:52.616868973 CEST	39950	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:52.618005991 CEST	39952	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:52.622445107 CEST	4258	39950	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:52.623276949 CEST	4258	39952	5.42.98.74	192.168.2.13
Oct 6, 2024 23:41:52.623348951 CEST	39952	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:52.623374939 CEST	39952	4258	192.168.2.13	5.42.98.74
Oct 6, 2024 23:41:52.628638029 CEST	4258	39952	5.42.98.74	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:40:59.038115978 CEST	59678	53	192.168.2.13	1.1.1.1
Oct 6, 2024 23:40:59.038177013 CEST	46940	53	192.168.2.13	1.1.1.1
Oct 6, 2024 23:40:59.046016932 CEST	53	46940	1.1.1.1	192.168.2.13
Oct 6, 2024 23:40:59.046073914 CEST	53	59678	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 23:40:59.038115978 CEST	192.168.2.13	1.1.1.1	0xe2b0	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:40:59.038177013 CEST	192.168.2.13	1.1.1.1	0x5b82	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 23:40:59.046073914 CEST	1.1.1.1	192.168.2.13	0xe2b0	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 6, 2024 23:40:59.046073914 CEST	1.1.1.1	192.168.2.13	0xe2b0	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 5426, Parent PID: 5348

General

Start time (UTC):	21:38:17
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 5428, Parent PID: 5426

General

Start time (UTC):	21:38:17
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 5430, Parent PID: 5428

General

Start time (UTC):	21:38:17
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 5426, Parent PID: 5348

General

Chronological Activities

Analysis Process: na.elf PID: 5428, Parent PID: 5426

General

Chronological Activities

Analysis Process: na.elf PID: 5430, Parent PID: 5428

General

Chronological Activities

Linux Analysis Report
na.elf