Edit tour

Linux Analysis Report
tyo2831qq.i586.elf

Overview

General Information

Sample name:	tyo2831qq.i586.elf
Analysis ID:	1546016
MD5:	068b609bbc4b5e580fe3e29a9384948a
SHA1:	9134a2c3ff706b9e9f965ba92579a5fbc4062f84
SHA256:	95f5e370e3a84ac10b8d4c685d828a65d7f784a6eccb66428f0ea219f861fce3
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546016
Start date and time:	2024-10-31 11:36:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	tyo2831qq.i586.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: tyo2831qq.i586.elf

Runtime Messages

Command:	/tmp/tyo2831qq.i586.elf
PID:	6232
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

tyo2831qq.i586.elf (PID: 6232, Parent: 6146, MD5: 068b609bbc4b5e580fe3e29a9384948a) Arguments: /tmp/tyo2831qq.i586.elf

tyo2831qq.i586.elf New Fork (PID: 6233, Parent: 6232)

tyo2831qq.i586.elf New Fork (PID: 6234, Parent: 6233)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
tyo2831qq.i586.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
tyo2831qq.i586.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
tyo2831qq.i586.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12b64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
tyo2831qq.i586.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x86b:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
tyo2831qq.i586.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14744:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x16a88:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
tyo2831qq.i586.elf	Linux_Trojan_Gafgyt_e6d75e6f	unknown	unknown	0xcb82:$a: 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00
tyo2831qq.i586.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x908:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
tyo2831qq.i586.elf	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xa98f:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
tyo2831qq.i586.elf	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0xf275:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6233.1.0000000008048000.0000000008062000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6233.1.0000000008048000.0000000008062000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6233.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12b64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6233.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x86b:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
6233.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14744:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x16a88:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6233.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_e6d75e6f	unknown	unknown	0xcb82:$a: 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00
6233.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x908:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
6233.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xa98f:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
6233.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0xf275:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
6232.1.0000000008048000.0000000008062000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6232.1.0000000008048000.0000000008062000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6232.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12b64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6232.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x86b:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
6232.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14744:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x16a88:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6232.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_e6d75e6f	unknown	unknown	0xcb82:$a: 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00
6232.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x908:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
6232.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_122ff2e6	unknown	unknown	0xa98f:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
6232.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_fa48b592	unknown	unknown	0xf275:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
Process Memory Space: tyo2831qq.i586.elf PID: 6232	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: tyo2831qq.i586.elf PID: 6232	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3476:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x348a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x349e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3502:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3516:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x352a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x353e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3552:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3566:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x357a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x358e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3606:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: tyo2831qq.i586.elf PID: 6232	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5ae6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x5d1b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x8907:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x896c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: tyo2831qq.i586.elf PID: 6233	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: tyo2831qq.i586.elf PID: 6233	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2bf6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2caa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ce6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cfa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: tyo2831qq.i586.elf PID: 6233	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5266:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x549b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x8087:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x80ec:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 19 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:37:39.850950+0100	2846526	1	A Network Trojan was detected	192.168.2.23	45298	109.120.156.253	1780	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: tyo2831qq.i586.elf

Avira: detected

Found malware configuration

Source: tyo2831qq.i586.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "109.120.156.253:1780"}

Multi AV Scanner detection for submitted file

Source: tyo2831qq.i586.elf

ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: tyo2831qq.i586.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/tyo2831qq.i586.elf (PID: 6232)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.23:45298 -> 109.120.156.253:1780

Source: global traffic

TCP traffic: 192.168.2.23:45298 -> 109.120.156.253:1780

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.156.253

Source: tyo2831qq.i586.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: tyo2831qq.i586.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: tyo2831qq.i586.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: tyo2831qq.i586.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: tyo2831qq.i586.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f Author: unknown
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f Author: unknown
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f Author: unknown
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: httpattack
Source: ELF static info symbol of initial sample	Name: vseattack

Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f reference_sample = 48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c, id = e6d75e6f-aa04-4767-8730-6909958044a7, last_modified = 2021-09-16
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: tyo2831qq.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f reference_sample = 48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c, id = e6d75e6f-aa04-4767-8730-6909958044a7, last_modified = 2021-09-16
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e6d75e6f reference_sample = 48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c, id = e6d75e6f-aa04-4767-8730-6909958044a7, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: tyo2831qq.i586.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@0/0

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: tyo2831qq.i586.elf, type: SAMPLE
Source: Yara match	File source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: tyo2831qq.i586.elf, type: SAMPLE
Source: Yara match	File source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tyo2831qq.i586.elf PID: 6232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tyo2831qq.i586.elf PID: 6233, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: tyo2831qq.i586.elf, type: SAMPLE
Source: Yara match	File source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: tyo2831qq.i586.elf, type: SAMPLE
Source: Yara match	File source: 6233.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tyo2831qq.i586.elf PID: 6232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tyo2831qq.i586.elf PID: 6233, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "109.120.156.253:1780"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
tyo2831qq.i586.elf	68%	ReversingLabs	Linux.Trojan.LnxGafgyt
tyo2831qq.i586.elf	100%	Avira	EXP/ELF.Mirai.Z
tyo2831qq.i586.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
109.120.156.253:1780	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	tyo2831qq.i586.elf	false		unknown
http://www.billybobbot.com/crawler/)	tyo2831qq.i586.elf	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	tyo2831qq.i586.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	tyo2831qq.i586.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	tyo2831qq.i586.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.120.156.253	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.120.156.253	tyo2831qq.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x.rar.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x.rar.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	x.rar.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	x.rar.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	x.rar.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
INFOBOX-ASInfoboxruAutonomousSystemRU	tyo2831qq.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	tyo2831qq.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	tyo2831qq.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	tyo2831qq.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	tyo2831qq.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	tyo2831qq.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.120.156.253
	armv5l.elf	Get hash	malicious	Mirai	Browse	92.243.71.47
	http://www.cottesloecounselling.com.au/anna-amhrose.html	Get hash	malicious	Unknown	Browse	77.221.155.81

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.598408222950559
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	tyo2831qq.i586.elf
File size:	134'662 bytes
MD5:	068b609bbc4b5e580fe3e29a9384948a
SHA1:	9134a2c3ff706b9e9f965ba92579a5fbc4062f84
SHA256:	95f5e370e3a84ac10b8d4c685d828a65d7f784a6eccb66428f0ea219f861fce3
SHA512:	fc973d4dcf4f2322ae09678971fd78be0aca1536842a0734349e7453cf3c09079002a59afc43886543527120a79a07ea64107e9862e404b2c54ae555e12af111
SSDEEP:	3072:wBk68/1UIUjUCUIUjU06TDgZXdqYBD+xmvXGL5hc6u7mJswdytNr9:wBc1/KXn6r6HgZXpDwmvXW5hcT7mJswE
TLSH:	D0D32ABAF280C1B3D183157111C6DF165C32F2F7278FA50AE7A81EF0AE991413965E9E
File Content Preview:	.ELF........................4...........4. ...(.....................d...d...............d...d ..d ......x\|...................'...'..................Q.td............................U..S.......G....h........[]...$.............U......=.+...t..5....$(.....$(.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048184
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	109036
Section Header Size:	40
Number of Section Headers:	19
Header String Table Index:	16

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80480b4	0xb4	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480d0	0xd0	0x11438	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8059508	0x11508	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8059520	0x11520	0x7b44	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x8062064	0x19064	0x78c	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x80627f0	0x197f0	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x80627f0	0x197f0	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x80627f8	0x197f8	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8062800	0x19800	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x8062804	0x19804	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x8062820	0x19820	0x348	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x8062b80	0x19b68	0x715c	0x0	0x3	WA	0	0	32
.stab	PROGBITS	0x0	0x19b68	0x138	0xc	0x0		14	0	4
.stabstr	STRTAB	0x0	0x19ca0	0xf6	0x0	0x0		0	0	1
.comment	PROGBITS	0x0	0x19d96	0xbd0	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1a966	0x84	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1ace4	0x3740	0x10	0x0		18	343	4
.strtab	STRTAB	0x0	0x1e424	0x29e2	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x19064	0x19064	6.7416	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x19064	0x8062064	0x8062064	0xb04	0x7c78	4.8382	0x6	RW	0x1000	.eh_frame .tbss .ctors .dtors .jcr .got.plt .data .bss
TLS	0x197f0	0x80627f0	0x80627f0	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80480b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8059508	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8059520	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8062064	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x80627f0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x80627f0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x80627f8	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8062800	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8062804	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x8062820	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x8062b80	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.108.5758	.symtab	0x805b780	44	OBJECT	<unknown>	DEFAULT	4
C.11.5136	.symtab	0x8060bc4	24	OBJECT	<unknown>	DEFAULT	4
C.141.6070	.symtab	0x805bbec	24	OBJECT	<unknown>	DEFAULT	4
C.196.6682	.symtab	0x805c1e0	92	OBJECT	<unknown>	DEFAULT	4
C.198.6789	.symtab	0x805ce60	1148	OBJECT	<unknown>	DEFAULT	4
C.201.6826	.symtab	0x805ea00	44	OBJECT	<unknown>	DEFAULT	4
C.204.6857	.symtab	0x805ea40	44	OBJECT	<unknown>	DEFAULT	4
C.215.6996	.symtab	0x805ecc0	1128	OBJECT	<unknown>	DEFAULT	4
C.255.7290	.symtab	0x805f240	96	OBJECT	<unknown>	DEFAULT	4
C.259.7338	.symtab	0x805f3e0	36	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x804d2ab	483	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0x804bf9e	357	FUNC	<unknown>	DEFAULT	2
POPBX1	.symtab	0x805409f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x80540ff	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x805415f	0	NOTYPE	<unknown>	DEFAULT	2
POPBX1	.symtab	0x80541bf	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805408b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80540eb	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x805414b	0	NOTYPE	<unknown>	DEFAULT	2
PUSHBX1	.symtab	0x80541ab	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x8062bc0	16384	OBJECT	<unknown>	DEFAULT	12
RESTBX1	.symtab	0x8054049	0	NOTYPE	<unknown>	DEFAULT	2
Randhex	.symtab	0x804c794	368	FUNC	<unknown>	DEFAULT	2
SAVEBX1	.symtab	0x805403c	0	NOTYPE	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0x804b3c9	293	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0x804ca01	1007	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0x804c103	266	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0x804c20d	266	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0x804b4ee	293	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0x804b139	328	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0x804b95e	1600	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0x804a15d	244	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8049a22	266	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0x804a34e	266	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x8049280	816	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0x804c59a	253	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x8050fd0	66	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x8062804	0	OBJECT	<unknown>	HIDDEN	10
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_L_lock_103	.symtab	0x8055496	16	FUNC	<unknown>	DEFAULT	2
_L_lock_115	.symtab	0x80549d0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_12	.symtab	0x80565cf	16	FUNC	<unknown>	DEFAULT	2
_L_lock_140	.symtab	0x805660f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_160	.symtab	0x805662f	16	FUNC	<unknown>	DEFAULT	2
_L_lock_17	.symtab	0x80562ba	10	FUNC	<unknown>	DEFAULT	2
_L_lock_18	.symtab	0x805545c	13	FUNC	<unknown>	DEFAULT	2
_L_lock_191	.symtab	0x805664f	13	FUNC	<unknown>	DEFAULT	2
_L_lock_198	.symtab	0x8055764	16	FUNC	<unknown>	DEFAULT	2
_L_lock_209	.symtab	0x8055774	16	FUNC	<unknown>	DEFAULT	2
_L_lock_256	.symtab	0x80549f0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_27	.symtab	0x8053eb4	16	FUNC	<unknown>	DEFAULT	2
_L_lock_27	.symtab	0x8054990	16	FUNC	<unknown>	DEFAULT	2
_L_lock_29	.symtab	0x80565df	16	FUNC	<unknown>	DEFAULT	2
_L_lock_32	.symtab	0x805622d	10	FUNC	<unknown>	DEFAULT	2
_L_lock_34	.symtab	0x805782a	13	FUNC	<unknown>	DEFAULT	2
_L_lock_54	.symtab	0x8055469	16	FUNC	<unknown>	DEFAULT	2
_L_lock_66	.symtab	0x80549b0	16	FUNC	<unknown>	DEFAULT	2
_L_lock_70	.symtab	0x8053db4	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_101	.symtab	0x80549c0	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_101	.symtab	0x8057837	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_102	.symtab	0x80565ff	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_113	.symtab	0x80554a6	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_140	.symtab	0x80549e0	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_152	.symtab	0x805661f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_167	.symtab	0x8053dc4	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_170	.symtab	0x805663f	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_225	.symtab	0x8055784	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_232	.symtab	0x805665c	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_235	.symtab	0x8055791	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_291	.symtab	0x8054a00	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_40	.symtab	0x80562c4	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_46	.symtab	0x80549a0	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_61	.symtab	0x8056237	10	FUNC	<unknown>	DEFAULT	2
_L_unlock_66	.symtab	0x8055479	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_83	.symtab	0x8055489	13	FUNC	<unknown>	DEFAULT	2
_L_unlock_86	.symtab	0x80565ef	16	FUNC	<unknown>	DEFAULT	2
_L_unlock_90	.symtab	0x8053ec4	13	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x80627f4	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x80627f0	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x8062958	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805f584	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8062b60	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8060d64	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8062960	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x805f884	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x80627fc	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x80627f8	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x8062064	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x80627ec	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8062958	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_tolower	.symtab	0x8062b60	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_toupper	.symtab	0x8062960	4	OBJECT	<unknown>	HIDDEN	11
__GI___close	.symtab	0x8054030	80	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x805403a	27	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x806295c	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_tolower	.symtab	0x8062b64	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_toupper	.symtab	0x8062964	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x8051278	13	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x8050ee4	83	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x805666c	204	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8052248	26	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x8054030	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x8050f37	153	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x8054080	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x8054140	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid	.symtab	0x80541a0	91	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x80540e0	91	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x8054080	91	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x805408a	33	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x8054140	91	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x805414a	33	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x8053df1	195	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x8052740	32	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x8052760	32	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x805271c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x80542d3	56	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8054337	39	FUNC	<unknown>	HIDDEN	2
__GI___waitpid	.symtab	0x80541a0	91	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x80540e0	91	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x80540ea	33	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8052264	191	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8050fd0	66	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80532d4	191	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8053704	17	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8057424	44	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x8051040	39	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x8054030	80	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x8054cc0	130	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x80551aa	44	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x80551d6	44	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x8054f40	618	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x805245c	84	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8054b24	47	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8053848	93	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x80552e0	380	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x8050f37	153	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8056410	447	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x805619c	145	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x805666c	204	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8056244	118	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8056738	94	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x80554b4	21	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x8053ba8	524	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8051ff8	45	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x805771c	24	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8057734	246	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x8057450	70	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8052028	111	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x805666c	204	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x8051068	32	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8054b54	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x8054b5c	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8054b64	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8052410	14	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x8052420	57	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8056a8c	666	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8058c1c	684	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x8058ec8	89	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x8054b6c	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x8053ed4	49	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x8051088	43	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x80524b0	40	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8054b80	8	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x8052374	7	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x8052368	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x80523f0	31	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80569f8	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x80523dc	17	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8052390	76	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8057de6	432	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8057b33	459	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x80535c7	155	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80510b4	139	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x805697c	27	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x8051244	17	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x8051140	43	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x805900c	90	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8052098	41	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8056798	37	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8057a9c	30	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80567f8	177	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x80520c4	50	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8054aa4	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x8057498	59	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x8054b88	43	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8054bdd	61	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x8052387	7	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x805237b	12	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x8054080	91	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x8054dcc	132	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8058f51	72	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8053f08	100	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x805339c	66	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80534c8	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8057a60	19	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x8054140	91	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x8054ebc	129	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8052510	92	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8054c1c	64	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x80511a5	108	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x805256c	92	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x80525c8	108	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x8051214	31	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8052634	56	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8053662	161	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8054a2f	80	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8052694	136	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8054c5c	97	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8053f6c	195	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x8051288	32	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x805266c	40	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x80512a8	30	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8053527	160	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x8058f9c	70	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x805941c	54	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x80520f8	30	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x80567c0	25	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8052118	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8052118	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x8052138	27	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x80568ac	45	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8059068	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8052154	19	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8057a74	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8052168	24	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8056958	35	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x80567dc	26	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80568dc	42	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x8052180	197	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8052350	22	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8056908	80	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8053718	23	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x805396c	523	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8056998	96	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x8051234	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x8051258	29	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x8058fe4	39	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80512c8	172	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x80541a0	91	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8055204	63	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8055260	128	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8055244	27	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x80540e0	91	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8062800	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x8062800	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x8067308	4	OBJECT	<unknown>	HIDDEN	12
__atexit_lock	.symtab	0x8062a48	24	OBJECT	<unknown>	DEFAULT	11
__bss_start	.symtab	0x8062b68	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x805430b	44	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x8054030	80	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x8058b90	96	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x805403a	27	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x806295c	4	OBJECT	<unknown>	DEFAULT	11
__ctype_tolower	.symtab	0x8062b64	4	OBJECT	<unknown>	DEFAULT	11
__ctype_toupper	.symtab	0x8062964	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x806989c	4	OBJECT	<unknown>	HIDDEN	12
__data_start	.symtab	0x8062828	0	NOTYPE	<unknown>	DEFAULT	11
__decode_dotted	.symtab	0x8057f98	259	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8059150	166	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x805809c	1842	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x80594e0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480e0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8062820	0	OBJECT	<unknown>	HIDDEN	11
__encode_dotted	.symtab	0x8059454	130	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8059098	182	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x80591f8	82	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x8067300	4	OBJECT	<unknown>	DEFAULT	12
__errno_location	.symtab	0x8051278	13	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8066db0	4	OBJECT	<unknown>	HIDDEN	12
__fcntl_nocancel	.symtab	0x8050ee4	83	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x805666c	204	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x80627f0	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x80627f0	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x8053ba8	524	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x8069c98	4	OBJECT	<unknown>	HIDDEN	12
__fork_handlers	.symtab	0x8069c9c	4	OBJECT	<unknown>	HIDDEN	12
__fork_lock	.symtab	0x8066db4	4	OBJECT	<unknown>	HIDDEN	12
__get_hosts_byname_r	.symtab	0x8058bf0	41	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480d0	0	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x8057604	280	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x8054b6c	19	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x8053ed4	49	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x8052248	26	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x80627f0	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x80627f0	0	NOTYPE	<unknown>	HIDDEN	6
__libc_close	.symtab	0x8054030	80	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x805245c	84	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x80541fc	86	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x8054252	79	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x8050f37	153	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x8053ba8	524	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x8054bdd	61	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x8054080	91	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x8054140	91	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8052510	92	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x80511a5	108	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x805256c	92	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x80525c8	108	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x80571ba	513	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8054a2f	80	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80672fc	4	OBJECT	<unknown>	DEFAULT	12
__libc_system	.symtab	0x8054943	77	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x80541a0	91	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x80540e0	91	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x8053dd4	29	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x8057110	40	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private	.symtab	0x8057140	32	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x8060d44	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate	.symtab	0x8052fad	379	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8052780	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x806296c	24	OBJECT	<unknown>	DEFAULT	11
__malloc_state	.symtab	0x8069920	888	OBJECT	<unknown>	DEFAULT	12
__malloc_trim	.symtab	0x8052f30	125	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x8069cd0	4	OBJECT	<unknown>	HIDDEN	12
__nameservers	.symtab	0x8069cd4	4	OBJECT	<unknown>	HIDDEN	12
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x8054080	91	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x805924c	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8058823	876	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x805408a	33	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x8067304	4	OBJECT	<unknown>	DEFAULT	12
__preinit_array_end	.symtab	0x80627f0	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x80627f0	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x8062a64	4	OBJECT	<unknown>	DEFAULT	11
__progname_full	.symtab	0x8062a68	4	OBJECT	<unknown>	DEFAULT	11
__pthread_initialize_minimal	.symtab	0x80573bb	15	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x80542a7	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x80542a4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x80542a4	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x80542a4	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x80542a4	3	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x8054140	91	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x8059258	451	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x805414a	33	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x8053df1	195	FUNC	<unknown>	DEFAULT	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x8069cc8	4	OBJECT	<unknown>	HIDDEN	12
__resolv_attempts	.symtab	0x8062b5d	1	OBJECT	<unknown>	HIDDEN	11
__resolv_lock	.symtab	0x80698a4	24	OBJECT	<unknown>	DEFAULT	12
__resolv_timeout	.symtab	0x8062b5c	1	OBJECT	<unknown>	HIDDEN	11
__restore	.symtab	0x8054a27	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8054a20	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x806730c	4	OBJECT	<unknown>	HIDDEN	12
__searchdomain	.symtab	0x8069ccc	4	OBJECT	<unknown>	HIDDEN	12
__searchdomains	.symtab	0x8069cd8	4	OBJECT	<unknown>	HIDDEN	12
__sigaddset	.symtab	0x8052740	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8052760	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x805271c	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8054ac0	43	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8062a78	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x8057844	62	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8057884	139	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8057910	154	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x80557a0	232	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x80579ac	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8057a30	46	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80579d4	92	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8055994	154	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8055a30	37	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8062a7c	4	OBJECT	<unknown>	DEFAULT	11
__syscall_error	.symtab	0x8054a10	15	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x8054bb4	41	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x8058f24	45	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x8054aec	53	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x805116c	57	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x80542d3	56	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8054337	39	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x805435e	577	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8062a60	4	OBJECT	<unknown>	HIDDEN	11
__waitpid	.symtab	0x80541a0	91	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel	.symtab	0x80541aa	33	FUNC	<unknown>	DEFAULT	2
__write	.symtab	0x80540e0	91	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x80540ea	33	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x8052264	191	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x8057577	138	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x80574d4	163	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x8066bc0	10	OBJECT	<unknown>	DEFAULT	12
_charpad	.symtab	0x8051374	53	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x80698c8	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_handler	.symtab	0x80698f0	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_spec	.symtab	0x8062968	4	OBJECT	<unknown>	HIDDEN	11
_dl_aux_init	.symtab	0x80573cc	18	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x8062b54	4	OBJECT	<unknown>	DEFAULT	11
_dl_nothread_init_static_tls	.symtab	0x80573de	68	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x8069cc0	4	OBJECT	<unknown>	DEFAULT	12
_dl_phnum	.symtab	0x8069cc4	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_gaps	.symtab	0x8069cb4	1	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_slotinfo_list	.symtab	0x8069cb0	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_generation	.symtab	0x8069cb8	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_max_dtv_idx	.symtab	0x8069ca8	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_setup	.symtab	0x805718a	48	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x8069ca4	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_nelem	.symtab	0x8069cbc	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_size	.symtab	0x8069cac	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_used	.symtab	0x8069ca0	4	OBJECT	<unknown>	DEFAULT	12
_edata	.symtab	0x8062b68	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8069cdc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x8050fd0	66	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8059508	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8067360	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x80513a9	94	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8055bd4	1479	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80480b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8055a58	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x8051a04	103	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8051be9	1036	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8051a6c	57	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x8051aa8	277	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8051bc0	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x80542bc	23	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80542aa	18	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x8054a80	34	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x8069918	8	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x8048184	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x80554cc	664	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8055888	59	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8062a80	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x8067340	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x80562d0	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x806735c	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_del_lock	.symtab	0x806734c	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x8067358	4	OBJECT	<unknown>	DEFAULT	12
_stdio_streams	.symtab	0x8062a88	204	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x80558c3	208	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8062a84	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l	.symtab	0x8053730	278	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8055ab0	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805fc3c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8055af0	228	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8051407	1530	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80532d4	191	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x8051014	43	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x804b03d	252	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0x804abcb	1138	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8053704	17	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8053704	17	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0x804a7b3	1048	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x8052324	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8066dac	1	OBJECT	<unknown>	DEFAULT	12
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x8057424	44	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8052694	136	FUNC	<unknown>	DEFAULT	2
buf.4562	.symtab	0x8066bd0	16	OBJECT	<unknown>	DEFAULT	12
buf.6699	.symtab	0x8066be0	440	OBJECT	<unknown>	DEFAULT	12
bzero	.symtab	0x805233c	19	FUNC	<unknown>	DEFAULT	2
bzero.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	.symtab	0x8062950	4	OBJECT	<unknown>	DEFAULT	11
calloc	.symtab	0x8056d28	236	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cancel_handler	.symtab	0x80545a0	155	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x8051040	39	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x8054030	80	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x8054cc0	130	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x8062840	4	OBJECT	<unknown>	DEFAULT	11
completed.4963	.symtab	0x8062b80	1	OBJECT	<unknown>	DEFAULT	12
connect	.symtab	0x805245c	84	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x8048dd3	459	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x80490af	168	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x806294c	4	OBJECT	<unknown>	DEFAULT	11
data_start	.symtab	0x8062828	0	NOTYPE	<unknown>	DEFAULT	11
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
do_system	.symtab	0x805463b	776	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x8067300	4	OBJECT	<unknown>	DEFAULT	12
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8054b24	47	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8053848	93	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8060c00	156	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x80552e0	380	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x8050f37	153	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x8054d44	136	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8048386	104	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x8054e50	108	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x8056410	447	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x805619c	145	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x805666c	204	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8056244	118	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8056738	94	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x8060be0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x80554b4	21	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x8053ba8	524	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x8066db8	1348	OBJECT	<unknown>	DEFAULT	12
fputs_unlocked	.symtab	0x8051ff8	45	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8053128	399	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x805771c	24	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x805771c	24	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8057734	246	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x8057450	70	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0x80495b0	1138	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x8052028	111	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x804d85a	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8048ba0	59	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x80483ee	507	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x804d864	146	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x8048356	48	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x805619c	145	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x805666c	204	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x8051068	32	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8054b54	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x8054b5c	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8054b64	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8052410	14	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x8052420	57	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8056a8c	666	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8058c1c	684	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x8058ec8	89	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x8054b6c	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x8053ed4	49	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x8051088	43	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x80524b0	40	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80524d8	56	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8054b80	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x8062ba4	4	OBJECT	<unknown>	DEFAULT	12
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6698	.symtab	0x8066d98	20	OBJECT	<unknown>	DEFAULT	12
htonl	.symtab	0x8052374	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8052368	12	FUNC	<unknown>	DEFAULT	2
httpattack	.symtab	0x804b613	843	FUNC	<unknown>	DEFAULT	2
i.4858	.symtab	0x8062954	4	OBJECT	<unknown>	DEFAULT	11
index	.symtab	0x80520f8	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x80523f0	31	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80569f8	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x80523dc	17	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8052390	76	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8057de6	432	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8057cfe	232	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8057b33	459	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8057abc	119	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x805081b	306	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x8048229	111	FUNC	<unknown>	DEFAULT	2
init_static_tls	.symtab	0x8057160	42	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8053435	85	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x80535c7	155	FUNC	<unknown>	DEFAULT	2
intr	.symtab	0x8067310	20	OBJECT	<unknown>	DEFAULT	12
ioctl	.symtab	0x80510b4	139	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x805697c	27	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x8051244	17	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x8051140	43	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6756	.symtab	0x8062b58	2	OBJECT	<unknown>	DEFAULT	11
last_ns_num.6755	.symtab	0x80698a0	4	OBJECT	<unknown>	DEFAULT	12
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x8048f9e	273	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lock	.symtab	0x806733c	4	OBJECT	<unknown>	DEFAULT	12
lseek64	.symtab	0x805900c	90	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x8062bb0	6	OBJECT	<unknown>	DEFAULT	12
main	.symtab	0x805094d	1430	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x8062ba0	4	OBJECT	<unknown>	DEFAULT	12
makeIPPacket	.symtab	0x8049202	126	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x8048bdb	103	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x8049c0d	141	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x80527a6	1928	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x80532b7	29	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x8052098	41	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8056798	37	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8057a9c	30	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80567f8	177	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x80520c4	50	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mmap	.symtab	0x8054aa4	27	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x8057498	59	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x8054b88	43	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8062984	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x806299c	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x8054bdd	61	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1451	.symtab	0x8066bcc	4	OBJECT	<unknown>	DEFAULT	12
nprocessors_onln	.symtab	0x80538a8	196	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8052387	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x805237b	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8062ba8	8	OBJECT	<unknown>	DEFAULT	12
object.4975	.symtab	0x8062b84	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x8054080	91	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x8054dcc	132	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x80698c0	4	OBJECT	<unknown>	DEFAULT	12
p.4961	.symtab	0x8062824	0	OBJECT	<unknown>	DEFAULT	11
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x80698c4	4	OBJECT	<unknown>	DEFAULT	12
poll	.symtab	0x8058f51	72	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6454	.symtab	0x805fb94	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80488bd	581	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x804868a	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x804879b	290	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x80486c4	215	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x804d8f6	11988	FUNC	<unknown>	DEFAULT	2
program_invocation_name	.symtab	0x8062a68	4	OBJECT	<unknown>	DEFAULT	11
program_invocation_short_name	.symtab	0x8062a64	4	OBJECT	<unknown>	DEFAULT	11
pseudo_cancel	.symtab	0x8054055	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x80540ab	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805410b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x805416b	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_cancel	.symtab	0x80541cb	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805407f	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80540da	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805413a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x805419a	0	NOTYPE	<unknown>	DEFAULT	2
pseudo_end	.symtab	0x80541fa	0	NOTYPE	<unknown>	DEFAULT	2
qual_chars.6463	.symtab	0x805fba8	20	OBJECT	<unknown>	DEFAULT	4
quit	.symtab	0x8067324	20	OBJECT	<unknown>	DEFAULT	12
raise	.symtab	0x8053f08	100	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8053394	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x8048298	190	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x805339c	66	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8060798	10	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80534c8	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x80629c8	128	OBJECT	<unknown>	DEFAULT	11
rawmemchr	.symtab	0x8057a60	19	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x8054140	91	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x8054ebc	129	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8056e14	763	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x80507ca	81	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x8052510	92	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x8048c42	401	FUNC	<unknown>	DEFAULT	2
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6741	.symtab	0x80698bc	4	OBJECT	<unknown>	DEFAULT	12
rindex	.symtab	0x80567dc	26	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x804a458	859	FUNC	<unknown>	DEFAULT	2
sa_refcntr	.symtab	0x8067338	4	OBJECT	<unknown>	DEFAULT	12
sbrk	.symtab	0x8054c1c	64	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x80511a5	108	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x805256c	92	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHLD	.symtab	0x804d48e	972	FUNC	<unknown>	DEFAULT	2
sendHTTPtwo	.symtab	0x804b281	328	FUNC	<unknown>	DEFAULT	2
sendKILLALL	.symtab	0x804c317	643	FUNC	<unknown>	DEFAULT	2
sendPkt	.symtab	0x804d14a	353	FUNC	<unknown>	DEFAULT	2
sendTLS	.symtab	0x804cdf0	858	FUNC	<unknown>	DEFAULT	2
senditbudAMP	.symtab	0x80481a8	129	FUNC	<unknown>	DEFAULT	2
sendnfo	.symtab	0x804c697	253	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x80525c8	108	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x8051214	31	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8052634	56	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x80533de	87	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8053662	161	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x8054a2f	80	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x8052694	136	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x8054c5c	97	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space	.symtab	0x80587f8	43	FUNC	<unknown>	DEFAULT	2
skip_nospace	.symtab	0x80587d0	40	FUNC	<unknown>	DEFAULT	2
sleep	.symtab	0x8053f6c	195	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf	.symtab	0x8051288	32	FUNC	<unknown>	DEFAULT	2
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x805266c	40	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049b2c	225	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x8048b02	158	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6462	.symtab	0x805fbbc	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6453	.symtab	0x805fba0	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6459	.symtab	0x805fc0c	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6458	.symtab	0x805fc24	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6461	.symtab	0x805fbcc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6460	.symtab	0x805fbdc	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x80512a8	30	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x805348a	61	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x805348a	61	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8053527	160	FUNC	<unknown>	DEFAULT	2
stat	.symtab	0x8058f9c	70	FUNC	<unknown>	DEFAULT	2
stat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x8069360	512	OBJECT	<unknown>	DEFAULT	12
static_map	.symtab	0x8069868	52	OBJECT	<unknown>	DEFAULT	12
static_slotinfo	.symtab	0x8069560	776	OBJECT	<unknown>	DEFAULT	12
stderr	.symtab	0x8062a74	4	OBJECT	<unknown>	DEFAULT	11
stdhexflood	.symtab	0x804a251	253	FUNC	<unknown>	DEFAULT	2
stdin	.symtab	0x8062a6c	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x8062a70	4	OBJECT	<unknown>	DEFAULT	11
strcasecmp	.symtab	0x805941c	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x80520f8	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x80567c0	25	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8052118	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8052118	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x8052138	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x80568ac	45	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8059068	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8052264	191	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8052154	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8057a74	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8052168	24	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8056958	35	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x80567dc	26	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80568dc	42	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x8052180	197	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8052350	22	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8056908	80	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8053718	23	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x805396c	523	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x8054943	77	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x8056998	96	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x8049157	171	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x8051234	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x8051258	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x80485e9	161	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x805fbe8	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805fc00	12	OBJECT	<unknown>	DEFAULT	4
uname	.symtab	0x8058fe4	39	FUNC	<unknown>	DEFAULT	2
uname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1474	.symtab	0x805fc2c	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80629b4	20	OBJECT	<unknown>	DEFAULT	11
useragents	.symtab	0x8062860	236	OBJECT	<unknown>	DEFAULT	11
usleep	.symtab	0x8053b78	47	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0x8049c9a	1219	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x80512c8	172	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x80541a0	91	FUNC	<unknown>	DEFAULT	2
wcrtomb	.symtab	0x8055204	63	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8055260	128	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8055244	27	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x80540e0	91	FUNC	<unknown>	DEFAULT	2
xdigits.4985	.symtab	0x8060cec	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xtdcustom	.symtab	0x804c904	253	FUNC	<unknown>	DEFAULT	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T11:37:39.850950+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.23	45298	109.120.156.253	1780	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 11:37:39.845850945 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:37:39.850828886 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:37:39.850887060 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:37:39.850950003 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:37:39.855762959 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:37:40.895339012 CET	43928	443	192.168.2.23	91.189.91.42
Oct 31, 2024 11:37:46.526650906 CET	42836	443	192.168.2.23	91.189.91.43
Oct 31, 2024 11:37:47.550384045 CET	42516	80	192.168.2.23	109.202.202.202
Oct 31, 2024 11:38:01.628365040 CET	43928	443	192.168.2.23	91.189.91.42
Oct 31, 2024 11:38:13.914757967 CET	42836	443	192.168.2.23	91.189.91.43
Oct 31, 2024 11:38:18.010106087 CET	42516	80	192.168.2.23	109.202.202.202
Oct 31, 2024 11:38:18.025739908 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:38:18.025790930 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:38:18.025810003 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:38:18.025907040 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:38:18.025969982 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:38:18.025969982 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:38:18.025969982 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:38:18.025969982 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:38:42.582737923 CET	43928	443	192.168.2.23	91.189.91.42
Oct 31, 2024 11:39:17.637586117 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:39:17.637816906 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:39:17.770580053 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:39:17.770730972 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:40:17.642509937 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:40:17.642879963 CET	45298	1780	192.168.2.23	109.120.156.253
Oct 31, 2024 11:40:17.779452085 CET	1780	45298	109.120.156.253	192.168.2.23
Oct 31, 2024 11:40:17.779544115 CET	45298	1780	192.168.2.23	109.120.156.253

System Behavior

Analysis Process: tyo2831qq.i586.elf PID: 6232, Parent PID: 6146

General

Start time (UTC):	10:37:38
Start date (UTC):	31/10/2024
Path:	/tmp/tyo2831qq.i586.elf
Arguments:	/tmp/tyo2831qq.i586.elf
File size:	134662 bytes
MD5 hash:	068b609bbc4b5e580fe3e29a9384948a

Chronological Activities

Analysis Process: tyo2831qq.i586.elf PID: 6233, Parent PID: 6232

General

Start time (UTC):	10:37:38
Start date (UTC):	31/10/2024
Path:	/tmp/tyo2831qq.i586.elf
Arguments:	-
File size:	134662 bytes
MD5 hash:	068b609bbc4b5e580fe3e29a9384948a

Chronological Activities

Analysis Process: tyo2831qq.i586.elf PID: 6234, Parent PID: 6233

General

Start time (UTC):	10:37:38
Start date (UTC):	31/10/2024
Path:	/tmp/tyo2831qq.i586.elf
Arguments:	-
File size:	134662 bytes
MD5 hash:	068b609bbc4b5e580fe3e29a9384948a

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report tyo2831qq.i586.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: tyo2831qq.i586.elf PID: 6232, Parent PID: 6146

General

Chronological Activities

Analysis Process: tyo2831qq.i586.elf PID: 6233, Parent PID: 6232

General

Chronological Activities

Analysis Process: tyo2831qq.i586.elf PID: 6234, Parent PID: 6233

General

Linux Analysis Report
tyo2831qq.i586.elf