Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1533419
MD5:	75bafb6432a482031d792bac00dd0019
SHA1:	de6cf788d2f841b7d9188577857c8db0a67ec15b
SHA256:	ea73e4240122c37e95d39f3a4788b21bfeb84738415bcbc9f0deb0d60fd6ea06
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Yara detected Moobot

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample and/or dropped files contains symbols with suspicious names

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533419
Start date and time:	2024-10-14 17:41:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal100.troj.evad.linELF@0/0@1/0

Warnings

VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	6217
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 6217, Parent: 6134, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 6219, Parent: 6217)

na.elf New Fork (PID: 6221, Parent: 6219)

na.elf New Fork (PID: 6222, Parent: 6219)

na.elf New Fork (PID: 6225, Parent: 6222)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x122dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1232c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1237c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1241c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1246c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x122dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1232c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1237c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1241c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1246c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x122dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1232c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1237c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1241c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1246c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 6217	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: na.elf PID: 6217	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 6217	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfed1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfef9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xffe9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfffd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10011:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10025:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10039:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1004d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10061:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 6225	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: na.elf PID: 6225	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 6225	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x451a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x452e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4542:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4556:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x456a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x457e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4592:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x460a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x461e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4632:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4646:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x465a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x466e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4682:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4696:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Suricata Signatures

ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T17:42:21.148771+0200	2030491	1	Malware Command and Control Activity Detected	192.168.2.23	48244	205.185.120.246	10496	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 50%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.23:48244 -> 205.185.120.246:10496

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 205.185.120.246 ports 0,1,4,6,9,10496

Source: global traffic

TCP traffic: 192.168.2.23:48244 -> 205.185.120.246:10496

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: jsgd.us-tv.top

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 6217, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 6225, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: na.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: /tmp/na.elf (PID: 6225)

SIGKILL sent: pid: -6219, result: unknown

Jump to behavior

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 6217, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 6225, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@1/0

Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/141/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 6221)	File opened: /proc/262/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/na.elf (PID: 6217)

File: /tmp/na.elf

Jump to behavior

Source: /tmp/na.elf (PID: 6217)

Queries kernel information via 'uname':

Jump to behavior

Source: na.elf, 6217.1.00007fff34f64000.00007fff34f85000.rw-.sdmp, na.elf, 6225.1.00007fff34f64000.00007fff34f85000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6217.1.0000558efffc7000.0000558f00116000.rw-.sdmp, na.elf, 6225.1.0000558efffc7000.0000558f000f5000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: na.elf, 6217.1.0000558efffc7000.0000558f00116000.rw-.sdmp, na.elf, 6225.1.0000558efffc7000.0000558f000f5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 6217.1.00007fff34f64000.00007fff34f85000.rw-.sdmp, na.elf, 6225.1.00007fff34f64000.00007fff34f85000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 6225, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 6225, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic

Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 6225, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6225.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.00007f98d0017000.00007f98d002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 6225, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	50%	ReversingLabs	Linux.Trojan.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jsgd.us-tv.top	205.185.120.246	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
205.185.120.246	jsgd.us-tv.top	United States	53667	PONYNETUS	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
205.185.120.246	na.elf	Get hash	malicious	Mirai, Moobot	Browse
	na.elf	Get hash	malicious	Mirai, Moobot	Browse
	na.elf	Get hash	malicious	Mirai, Moobot	Browse
91.189.91.43	na.elf	Get hash	malicious	Mirai, Moobot	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	na.elf	Get hash	malicious	Mirai, Moobot	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jsgd.us-tv.top	na.elf	Get hash	malicious	Mirai, Moobot	Browse	205.185.120.246
jsgd.us-tv.top	na.elf	Get hash	malicious	Mirai, Moobot	Browse	205.185.120.246

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	na.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
PONYNETUS	na.elf	Get hash	malicious	Mirai, Moobot	Browse	205.185.120.246
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	205.185.120.246
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	205.185.120.246
	https://checknowkenz.ddns.net/check/sign-in	Get hash	malicious	HTMLPhisher	Browse	198.251.84.236
	https://checknowkenz.ddns.net/check/sign-in	Get hash	malicious	HTMLPhisher	Browse	198.251.84.236
	JVL2bXW1ch.elf	Get hash	malicious	Mirai, Moobot	Browse	107.189.4.201
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse	198.251.84.78
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse	198.251.84.78
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	198.98.51.198
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	198.98.51.198
INIT7CH	na.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.97401034505057
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	139'936 bytes
MD5:	75bafb6432a482031d792bac00dd0019
SHA1:	de6cf788d2f841b7d9188577857c8db0a67ec15b
SHA256:	ea73e4240122c37e95d39f3a4788b21bfeb84738415bcbc9f0deb0d60fd6ea06
SHA512:	4c086a3cdd0438350e8bef2a9cebda9f4c91469fe6270e479720622bc26f9de95c847506fd6d49f452806a3708b2b70666be7ee029e02661225aa16687987957
SSDEEP:	3072:zyvMnLiC4JaRAZ5pDYrvUmIBYLR/CAHAstKM/98qYKrP0Ab:zyvMO9JaRAZ5pcrU41/CAHAUKM/984rt
TLSH:	AFD33A46E7418B13C0D61779B6EF42463323A7A493DB73069928BFF43F8679A0E63905
File Content Preview:	.ELF..............(.........4...........4. ...(........p(<..(...(...................................@=..@=..............@=..@=..@=......\|2..............D=..D=..D=..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	108424
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x12100	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1a1f0	0x121f0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1a200	0x12200	0x1a10	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1bc10	0x13c10	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1bc28	0x13c28	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x23d40	0x13d40	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x23d44	0x13d44	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x23d44	0x13d44	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x23d48	0x13d48	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x23d4c	0x13d4c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x23d50	0x13d50	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x23df8	0x13df8	0x208	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x24000	0x14000	0x2fbc	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x14000	0xafc	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x14b00	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x14c40	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x14e53	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x16e96	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x17578	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x183f0	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x186a8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x18f72	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1a101	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1a659	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1a66f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1ac10	0x4e70	0x10	0x0		28	711	4
.strtab	STRTAB	0x0	0x1fa80	0x2820	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x13c28	0x1bc28	0x1bc28	0x118	0x118	4.4489	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x13d40	0x13d40	6.1373	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x13d40	0x23d40	0x23d40	0x2c0	0x327c	3.9801	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x13d44	0x23d44	0x23d44	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1a1f0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1a200	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1bc10	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1bc28	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x23d40	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x23d44	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x23d44	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x23d48	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x23d4c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x23d50	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x23df8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x24000	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a1f0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a1fc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x871c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x981c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa6c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xadc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb49c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbedc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcbec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd5f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdda0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xddc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe11c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe61c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf72c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1017c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1030c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1047c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1054c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1068c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1078c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1085c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1232c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13504	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1358c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1361c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13db4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1401c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1407c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1487c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1578c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1683c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1727c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1735c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1756c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1786c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1791c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1929c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23d48	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23d44	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x916c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa6c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xadc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb498	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc1b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc7e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23df8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xc95c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcbe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcbfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23dfc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23e00	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23e04	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xd5e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd648	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd77c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xddc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdefc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23e08	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe4b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe614	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe69c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe6e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe7a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe7e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe8e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe9dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeb80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1abb8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xed10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf624	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1abf8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf8d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23e0c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1ac00	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xff90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10290	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac84	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10378	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10500	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x105b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10684	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x106c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10738	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1080c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23e10	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ed8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23e28	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12044	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23e40	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23ed8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12414	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7f0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x125b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23eec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x126fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x138c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13cc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23f04	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13d80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13db0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1403c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14150	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1512c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15310	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23f1c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23f18	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1555c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbc8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17274	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17554	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17800	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17910	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18000	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x18f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23f10	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b87e	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x1b85c	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1abb8	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x1b868	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x1abd0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1bba4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1bb80	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1bb98	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1bb8c	12	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x26b40	1	OBJECT	<unknown>	DEFAULT	14
LOCAL_ADDR	.symtab	0x26b3c	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x10078	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10094	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0xe5b4	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x23d50	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x18d44	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x18d48	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x199f8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x18d3c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x18d80	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x19a1c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1a1bc	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x18d74	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1998c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x199b0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x199d4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x18ca4	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x192bc	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x18cf0	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x23f10	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1b87e	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x23d40	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x23d40	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x23f10	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x13430	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x13414	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x23f14	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0xed24	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xe428	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1683c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1017c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x13430	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xe4c0	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x134c0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x135e0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x13550	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x134c0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x134a4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x135e0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x135c4	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x109ec	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x10a10	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x109c8	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x137f8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x138c8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x13550	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x13534	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x10194	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xe5b4	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x11dc4	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1030c	116	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x10380	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x178c4	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xe61c	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x13430	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0xe8e8	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x14800	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x14834	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x144d8	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x10408	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x12510	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x149b0	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xe4c0	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16490	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x15f80	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1683c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x160c4	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x16968	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x14ce0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x12d44	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0xfea0	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17b50	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17b74	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x13eb0	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0xfed8	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1683c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x13fb4	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x13fe0	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x13ff4	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x14008	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1401c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x131a8	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14044	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1047c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1407c	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x140bc	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x102a0	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x173fc	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1232c	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x17928	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1735c	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xe668	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x180a4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16ed0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xffa0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x16ea0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x18040	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16fc0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xffb0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x13d0c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x140d0	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x14114	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14194	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x134c0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0xeac8	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x131f0	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x11f04	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x121c4	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x135e0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0xec3c	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x143ec	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1054c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x10604	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x141f4	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xe728	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x106d0	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1078c	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xe7ac	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10814	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x12424	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x13db4	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x108a0	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x108f0	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x10904	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0xe7ec	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x132e0	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1085c	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xed78	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x12254	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x170a0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x17190	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x16eb0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x16eb0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1727c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10050	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x100b0	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x172c0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x17310	76	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x12720	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17380	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xe878	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x14260	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0xe8a8	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xedac	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1487c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x148f4	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x148d0	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x13550	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x23d4c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x23d4c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x199f8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1998c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x199b0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x199d4	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x18264	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x18bc0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x18bc0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x18ba4	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x18c50	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x18264	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x18bd8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x18c20	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x18c38	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x18c08	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x18bf0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x18904	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x18674	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x18258	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x18260	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x185c0	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x18598	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x18114	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x18240	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x18614	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x13e60	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x18574	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xe300	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xe3fc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x18600	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x19958	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x19950	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x19948	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x245d4	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x23eec	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x26fbc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x24000	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x24000	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x13874	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x13430	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x13414	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x18b20	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x23f14	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x26b38	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x23df8	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x13e54	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13e48	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xe414	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x18904	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x18114	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x23d48	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x26fbc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x245cc	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x18b20	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xed24	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1bd40	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1bc28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2407c	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x185c0	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xe428	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1683c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x23d4c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x23d48	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x18c50	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x18614	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x18598	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x18600	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x18574	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x12d44	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x26f88	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x26f8c	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x24080	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x23d44	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x18b10	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x13f14	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x17a08	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1401c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x131a8	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1017c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x190fc	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x191e4	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1997c	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x19178	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1929c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x19984	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x19a60	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1a174	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x19400	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x18b10	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x23d48	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x23d44	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x18b18	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x1030c	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x13430	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x10408	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x13650	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x136d8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0xe4c0	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x12d44	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x26f90	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x14194	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x134c0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x135e0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1054c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x10604	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xe728	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x106d0	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1078c	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x175f8	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x13db4	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x245c8	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x13550	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x13110	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x18b18	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x11994	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x10a34	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x23e10	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x26c10	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x118e4	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x18674	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x18b20	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x134c0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x134a4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x245d0	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x23d44	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x23d44	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x23f08	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x23f0c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x17828	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x137bc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x137b4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x137b4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x137b4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x137b4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x135e0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x135c4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x19960	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x245d8	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x109ec	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10a10	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x109c8	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x18064	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1791c	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x23f28	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x17d34	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x17d8c	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17e68	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x15160	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x17f30	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x18004	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x17f60	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15484	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x15560	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x23f2c	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x18260	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x102c8	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x103c4	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x10508	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x105bc	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x1068c	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x10740	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x13d88	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x14154	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x13e70	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0xe6e4	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x175d4	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x137f8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x138c8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x13920	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x23f04	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0xe300	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x13550	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x13534	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x10194	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x14340	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x14274	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2406c	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x26fbc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xee7c	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x26bb8	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x26be0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x23e0c	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x17834	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1786c	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x26fb4	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x26fb8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x26fa8	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x26fa4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x26fac	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x26f9c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1756c	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x26f98	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x26fb0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x26fa0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x26f94	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x24000	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x26fbc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0xe5b4	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1a1f0	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x245fc	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xeed0	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1578c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15590	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16a10	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xf648	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0xf930	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xf6e8	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xf72c	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xf8dc	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x137cc	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x137c4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x13e3c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x26c08	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x14d00	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x152a0	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x23f30	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x245dc	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x161e0	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x245f8	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x245e8	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x245f4	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x23f34	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x15320	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x23f18	4	OBJECT	<unknown>	DEFAULT	13
_store_inttype	.symtab	0x15604	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1ac94	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x15630	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xef54	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x11dc4	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x1030c	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0xcbec	24	FUNC	<unknown>	DEFAULT	2
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x86ac	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x8640	108	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x871c	908	FUNC	<unknown>	DEFAULT	2
attack_kill_all	.symtab	0x82cc	344	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0xc1bc	1668	FUNC	<unknown>	DEFAULT	2
attack_method_stdhex	.symtab	0xbedc	736	FUNC	<unknown>	DEFAULT	2
attack_method_tcp	.symtab	0x9170	1708	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x24024	32	OBJECT	<unknown>	DEFAULT	14
attack_parse	.symtab	0x8424	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x81d0	252	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0xa6c8	1788	FUNC	<unknown>	DEFAULT	2
attack_tcp_null	.symtab	0xb49c	1948	FUNC	<unknown>	DEFAULT	2
attack_tcp_sack2	.symtab	0x981c	1776	FUNC	<unknown>	DEFAULT	2
attack_tcp_stomp	.symtab	0x9f0c	1980	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0x8aa8	1736	FUNC	<unknown>	DEFAULT	2
attack_tcp_syndata	.symtab	0xadc4	1752	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_plain	.symtab	0xbc3c	672	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x24078	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x10380	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x178c4	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x10904	196	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x113e4	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0xe61c	56	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xc840	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xc890	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0xed44	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x13430	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0xe8e8	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x24000	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x10408	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
entries	.symtab	0x26b68	4	OBJECT	<unknown>	DEFAULT	14
environ	.symtab	0x245cc	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x12510	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1bbc8	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x149b0	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xe4c0	244	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x23dfc	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x23e00	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0xe9f8	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0xeb8c	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x16490	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x15f80	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1683c	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x160c4	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x16968	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1bbb0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x14ce0	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x12d44	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x24084	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0xfea0	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x11b48	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x17b50	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x17b50	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17b74	448	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x13eb0	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0xfed8	188	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_eit_entry	.symtab	0x18d8c	544	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x15f80	324	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1683c	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x13fb4	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x13fe0	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x13ff4	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x14008	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x1401c	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x131a8	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0xe654	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x14044	56	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1047c	68	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x104c0	72	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x1407c	64	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T17:42:21.148771+0200	2030491	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)	1	192.168.2.23	48244	205.185.120.246	10496	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 17:42:21.140559912 CEST	48244	10496	192.168.2.23	205.185.120.246
Oct 14, 2024 17:42:21.145632029 CEST	10496	48244	205.185.120.246	192.168.2.23
Oct 14, 2024 17:42:21.145680904 CEST	48244	10496	192.168.2.23	205.185.120.246
Oct 14, 2024 17:42:21.148771048 CEST	48244	10496	192.168.2.23	205.185.120.246
Oct 14, 2024 17:42:21.153851986 CEST	10496	48244	205.185.120.246	192.168.2.23
Oct 14, 2024 17:42:21.645802975 CEST	10496	48244	205.185.120.246	192.168.2.23
Oct 14, 2024 17:42:21.645828962 CEST	10496	48244	205.185.120.246	192.168.2.23
Oct 14, 2024 17:42:21.645934105 CEST	48244	10496	192.168.2.23	205.185.120.246
Oct 14, 2024 17:42:21.646173954 CEST	48244	10496	192.168.2.23	205.185.120.246
Oct 14, 2024 17:42:21.650981903 CEST	10496	48244	205.185.120.246	192.168.2.23
Oct 14, 2024 17:42:23.598143101 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 14, 2024 17:42:24.622153997 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 14, 2024 17:42:37.932122946 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 14, 2024 17:42:50.218385935 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 14, 2024 17:42:54.313886881 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 14, 2024 17:43:18.886455059 CEST	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 17:42:21.121270895 CEST	58832	53	192.168.2.23	8.8.8.8
Oct 14, 2024 17:42:21.138967037 CEST	53	58832	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 14, 2024 17:42:21.121270895 CEST	192.168.2.23	8.8.8.8	0x7558	Standard query (0)	jsgd.us-tv.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 14, 2024 17:42:21.138967037 CEST	8.8.8.8	192.168.2.23	0x7558	No error (0)	jsgd.us-tv.top		205.185.120.246	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 6217, Parent PID: 6134

General

Start time (UTC):	15:42:20
Start date (UTC):	14/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 6219, Parent PID: 6217

General

Start time (UTC):	15:42:20
Start date (UTC):	14/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 6221, Parent PID: 6219

General

Start time (UTC):	15:42:20
Start date (UTC):	14/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 6222, Parent PID: 6219

General

Start time (UTC):	15:42:20
Start date (UTC):	14/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: na.elf PID: 6225, Parent PID: 6222

General

Start time (UTC):	15:42:20
Start date (UTC):	14/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 6217, Parent PID: 6134

General

Chronological Activities

Analysis Process: na.elf PID: 6219, Parent PID: 6217

General

Chronological Activities

Analysis Process: na.elf PID: 6221, Parent PID: 6219

General

Chronological Activities

Analysis Process: na.elf PID: 6222, Parent PID: 6219

General

Chronological Activities

Analysis Process: na.elf PID: 6225, Parent PID: 6222

General

Chronological Activities

Linux Analysis Report
na.elf