Edit tour

Linux Analysis Report
pure-ftpd

Overview

General Information

Sample name:	pure-ftpd
Analysis ID:	1562227
MD5:	42b6c0a470b6009cf36af9522224cbf6
SHA1:	b1d8fcc01d27c6df0c32478bdd55bf46d71ed269
SHA256:	a3e5af00e1f8d9e27a5dbcc4fa7be90522ddbdd097d86a715a9465915839ebb8
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false

Signatures

Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing)

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562227
Start date and time:	2024-11-25 11:12:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	pure-ftpd
Detection:	CLEAN
Classification:	clean1.lin@0/0@0/0
Cookbook Comments:	Analysis time extended to 480s due to sleep detection in submitted sample

Warnings

VT rate limit hit for: pure-ftpd

Runtime Messages

Command:	/tmp/pure-ftpd
PID:	6250
Exit Code:	127
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	/tmp/pure-ftpd: error while loading shared libraries: libssl.so.10: cannot open shared object file: No such file or directory

Process Tree

system is lnxubuntu20

pure-ftpd (PID: 6250, Parent: 6174, MD5: 42b6c0a470b6009cf36af9522224cbf6) Arguments: /tmp/pure-ftpd

dash New Fork (PID: 6279, Parent: 4335)

rm (PID: 6279, Parent: 4335, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.X1oGK1mRig /tmp/tmp.BV2vYR63Ze /tmp/tmp.ElTY2jJylL

dash New Fork (PID: 6280, Parent: 4335)

cat (PID: 6280, Parent: 4335, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.X1oGK1mRig

dash New Fork (PID: 6281, Parent: 4335)

head (PID: 6281, Parent: 4335, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6282, Parent: 4335)

tr (PID: 6282, Parent: 4335, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6283, Parent: 4335)

cut (PID: 6283, Parent: 4335, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6284, Parent: 4335)

cat (PID: 6284, Parent: 4335, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.X1oGK1mRig

dash New Fork (PID: 6285, Parent: 4335)

head (PID: 6285, Parent: 4335, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6286, Parent: 4335)

tr (PID: 6286, Parent: 4335, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6287, Parent: 4335)

cut (PID: 6287, Parent: 4335, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6288, Parent: 4335)

rm (PID: 6288, Parent: 4335, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.X1oGK1mRig /tmp/tmp.BV2vYR63Ze /tmp/tmp.ElTY2jJylL

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: pure-ftpd	ELF static info symbol of initial sample: freeaddrinfo
Source: pure-ftpd	ELF static info symbol of initial sample: getaddrinfo
Source: pure-ftpd	ELF static info symbol of initial sample: getnameinfo

Source: pure-ftpd	String found in binary or memory: http://pureftpd.org/
Source: pure-ftpd	String found in binary or memory: http://pureftpd.org/Data
Source: pure-ftpd	String found in binary or memory: https://www.pureftpd.org/
Source: pure-ftpd	String found in binary or memory: https://www.pureftpd.org/listnlstmfmtmlstmlsdaborsiteidleSITE

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: clean1.lin@0/0@0/0

Source: /usr/bin/dash (PID: 6279)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.X1oGK1mRig /tmp/tmp.BV2vYR63Ze /tmp/tmp.ElTY2jJylL			Jump to behavior
Source: /usr/bin/dash (PID: 6288)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.X1oGK1mRig /tmp/tmp.BV2vYR63Ze /tmp/tmp.ElTY2jJylL			Jump to behavior

Source: ELF symbol in initial sample	Symbol name: sleep
Source: ELF symbol in initial sample	Symbol name: usleep

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.pureftpd.org/	pure-ftpd	false	unknown
https://www.pureftpd.org/listnlstmfmtmlstmlsdaborsiteidleSITE	pure-ftpd	false	unknown
http://pureftpd.org/	pure-ftpd	false	unknown
http://pureftpd.org/Data	pure-ftpd	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	pXdN91.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	pXdN91.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	Mozi.a.elf	Get hash	malicious	Unknown	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Unknown	Browse
	dwhdbg.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	pXdN91.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	Mozi.a.elf	Get hash	malicious	Unknown	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Unknown	Browse
	dwhdbg.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	pXdN91.armv4l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	pXdN91.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	Mozi.a.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vkjqpc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	pXdN91.armv4l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.125.190.26
	pXdN91.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	Mozi.a.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vkjqpc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
AMAZON-02US	XFO-E2024-013 SMP-10.3-F01-2210 Host spare parts.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.228.81.39
	05.Unzipped.obfhotel22-11.js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.48
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.48
	55876.exe	Get hash	malicious	Unknown	Browse	18.167.130.152
	55876.exe	Get hash	malicious	Unknown	Browse	18.167.130.152
	pXdN91.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	54.171.230.55
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	54.171.230.55
	file (1).txt.bat	Get hash	malicious	Unknown	Browse	18.181.154.24
	startup.txt.bat	Get hash	malicious	Unknown	Browse	18.181.154.24
	run.txt.bat	Get hash	malicious	Unknown	Browse	18.181.154.24
INIT7CH	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	pXdN91.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	109.202.202.202
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	109.202.202.202
	Mozi.a.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bin.sh.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	vkjqpc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dwhdbg.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=992e995103e8d194fc06d2fc1c318e004f3e9b27, stripped
Entropy (8bit):	5.917554879017907
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 49.77% ELF Executable and Linkable format (generic) (4004/1) 49.46% Lumena CEL bitmap (63/63) 0.78%
File name:	pure-ftpd
File size:	177'440 bytes
MD5:	42b6c0a470b6009cf36af9522224cbf6
SHA1:	b1d8fcc01d27c6df0c32478bdd55bf46d71ed269
SHA256:	a3e5af00e1f8d9e27a5dbcc4fa7be90522ddbdd097d86a715a9465915839ebb8
SHA512:	3277b364de224e8b1726b35b8b997c36798cbf5952e8d3c1c0eddcc84f3a5157aa77802cc52efd2cc30119b71638d5346e60c95a335fbbd89494a409f99a45c4
SSDEEP:	3072:0xBr4MECMscMV9vTnLBm6hAzjehzKIOsDyY4:0xBriYcsM6hA3ehGJQyY4
TLSH:	14045D6AF7E218FCC1B1C9304A5BD1737971B4988332763E39C85A302E56F641B1EB66
File Content Preview:	.ELF..............>......f......@.......`...........@.8...@.............@.......@.......@.......................................8.......8.......8................................................................................. .............(.......(."....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	DYN (Shared object file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x66b4
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	9
Section Header Offset:	175712
Section Header Size:	64
Number of Section Headers:	27
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x238	0x238	0x1c	0x0	0x2	A	0	0	1
.note.ABI-tag	NOTE	0x254	0x254	0x20	0x0	0x2	A	0	0	4
.note.gnu.build-id	NOTE	0x274	0x274	0x24	0x0	0x2	A	0	0	4
.gnu.hash	GNU_HASH	0x298	0x298	0x44	0x0	0x2	A	5	0	8
.dynsym	DYNSYM	0x2e0	0x2e0	0x15c0	0x18	0x2	A	6	1	8
.dynstr	STRTAB	0x18a0	0x18a0	0x9d0	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x2270	0x2270	0x1d0	0x2	0x2	A	5	0	2
.gnu.version_r	VERNEED	0x2440	0x2440	0xf0	0x0	0x2	A	6	5	8
.rela.dyn	RELA	0x2530	0x2530	0x1d40	0x18	0x2	A	5	0	8
.rela.plt	RELA	0x4270	0x4270	0x13e0	0x18	0x42	AI	5	23	8
.init	PROGBITS	0x5650	0x5650	0x1a	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x5670	0x5670	0xd50	0x10	0x6	AX	0	0	16
.text	PROGBITS	0x63c0	0x63c0	0x1af22	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x212e4	0x212e4	0x9	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x212f0	0x212f0	0x41db	0x0	0x2	A	0	0	16
.eh_frame_hdr	PROGBITS	0x254cc	0x254cc	0x794	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x25c60	0x25c60	0x30b4	0x0	0x2	A	0	0	8
.init_array	INIT_ARRAY	0x229228	0x29228	0x8	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0x229230	0x29230	0x8	0x8	0x3	WA	0	0	8
.jcr	PROGBITS	0x229238	0x29238	0x8	0x0	0x3	WA	0	0	8
.data.rel.ro	PROGBITS	0x229240	0x29240	0x458	0x0	0x3	WA	0	0	32
.dynamic	DYNAMIC	0x229698	0x29698	0x240	0x10	0x3	WA	6	0	8
.got	PROGBITS	0x2298d8	0x298d8	0x710	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x22a000	0x2a000	0xd68	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x22ad80	0x2ad68	0x18f18	0x0	0x3	WA	0	0	32
.shstrtab	STRTAB	0x0	0x2ad68	0xf3	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x40	0x40	0x1f8	0x1f8	1.8973	0x5	R E	0x8
INTERP	0x238	0x238	0x238	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x0	0x0	0x28d14	0x28d14	6.0771	0x5	R E	0x200000		.interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
LOAD	0x29228	0x229228	0x229228	0x1b40	0x1aa70	2.2678	0x6	RW	0x200000		.init_array .fini_array .jcr .data.rel.ro .dynamic .got .data .bss
DYNAMIC	0x29698	0x229698	0x229698	0x240	0x240	1.6260	0x6	RW	0x8		.dynamic
NOTE	0x254	0x254	0x254	0x44	0x44	3.3084	0x4	R	0x4		.note.ABI-tag .note.gnu.build-id
GNU_EH_FRAME	0x254cc	0x254cc	0x254cc	0x794	0x794	5.0205	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10
GNU_RELRO	0x29228	0x229228	0x229228	0xdd8	0xdd8	2.4250	0x4	R	0x1		.init_array .fini_array .jcr .data.rel.ro .dynamic .got

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libssl.so.10	0x1
DT_NEEDED	sharedlib	libcrypto.so.10	0x1
DT_NEEDED	sharedlib	libcrypt.so.1	0x1
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_NEEDED	sharedlib	libpam.so.0	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_INIT	value	0x5650	0xc
DT_FINI	value	0x212e4	0xd
DT_INIT_ARRAY	value	0x229228	0x19
DT_INIT_ARRAYSZ	bytes	8	0x1b
DT_FINI_ARRAY	value	0x229230	0x1a
DT_FINI_ARRAYSZ	bytes	8	0x1c
DT_GNU_HASH	value	0x298	0x6ffffef5
DT_STRTAB	value	0x18a0	0x5
DT_SYMTAB	value	0x2e0	0x6
DT_STRSZ	bytes	2512	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x2298d8	0x3
DT_PLTRELSZ	bytes	5088	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x4270	0x17
DT_RELA	value	0x2530	0x7
DT_RELASZ	bytes	7488	0x8
DT_RELAENT	bytes	24	0x9
DT_BIND_NOW	value	0x0	0x18
DT_FLAGS_1	value	0x8000001	0x6ffffffb
DT_VERNEED	value	0x2440	0x6ffffffe
DT_VERNEEDNUM	value	5	0x6fffffff
DT_VERSYM	value	0x2270	0x6ffffff0
DT_RELACOUNT	value	301	0x6ffffff9
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
DH_free	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
DH_get_2048_256	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ERR_error_string	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ERR_get_error	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
EVP_cleanup	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
OPENSSL_add_all_algorithms_noconf	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
RAND_seed	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
RAND_status	libcrypto.so.10	libcrypto.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CIPHER_get_bits	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CIPHER_get_name	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CIPHER_get_version	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_callback_ctrl	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_check_private_key	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_ctrl	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_free	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_load_verify_locations	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_new	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_set_cipher_list	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_set_info_callback	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_set_session_id_context	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_set_timeout	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_set_verify	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_set_verify_depth	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_use_PrivateKey_file	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_CTX_use_certificate_chain_file	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_accept	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_clear	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_ctrl	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_free	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_get_current_cipher	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_get_error	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_get_fd	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_get_servername	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_library_init	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_load_error_strings	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_new	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_read	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_set_SSL_CTX	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_set_accept_state	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_set_fd	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_shutdown	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSL_write	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
SSLv23_server_method	libssl.so.10	libssl.so.10	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Jv_RegisterClasses			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__bss_start			.dynsym	0x22ad68	0	NOTYPE	<unknown>	DEFAULT	25
__ctype_b_loc	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__ctype_tolower_loc	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__cxa_finalize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
__errno_location	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fdelt_chk	GLIBC_2.15	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fxstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__lxstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__memcpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__memmove_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__printf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__realpath_chk	GLIBC_2.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__snprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_fail	GLIBC_2.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strcat_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strdup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strncpy_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__syslog_chk	GLIBC_2.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__timezone	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
__vsnprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_edata			.dynsym	0x22ad68	0	NOTYPE	<unknown>	DEFAULT	24
_end			.dynsym	0x243c98	0	NOTYPE	<unknown>	DEFAULT	25
_environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_fini			.dynsym	0x212e4	0	FUNC	<unknown>	DEFAULT	14
_init			.dynsym	0x5650	0	FUNC	<unknown>	DEFAULT	11
abort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
accept	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
access	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
alarm	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
bind	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
calloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chown	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chroot	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closelog	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connect	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
crypt	GLIBC_2.2.5	libcrypt.so.1	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dup2	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
endusershell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
error			.dynsym	0xd760	122	FUNC	<unknown>	DEFAULT	13
exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fchmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fcntl	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fgets	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
freeaddrinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftruncate	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getaddrinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getcwd	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
geteuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getgrgid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getgroups	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gethostname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getloadavg	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getnameinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getopt_long	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpagesize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpeername	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpwnam	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpwuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getspnam	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gettimeofday	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getusershell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
glob			.dynsym	0x1e500	60	FUNC	<unknown>	DEFAULT	13
globfree			.dynsym	0x1e5b0	187	FUNC	<unknown>	DEFAULT	13
gmtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inet_pton	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
initgroups	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
isatty	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
link	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
listen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
localtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.14	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memmove	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkfifo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
msync	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
munmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
nice	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
open	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
openlog	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
optarg	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
optind	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
pam_acct_mgmt	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pam_authenticate	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pam_close_session	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pam_end	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pam_open_session	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pam_set_item	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pam_setcred	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pam_start	LIBPAM_1.0	libpam.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
perror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
poll	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
posix_fadvise	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
putenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
puts	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
qsort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
random	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
read	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recvmsg	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rmdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
select	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
send	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendmsg	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setegid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
seteuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setgid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setgroups	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setlocale	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setrlimit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsockopt	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setusershell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
shutdown	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigaction	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigaddset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigdelset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigemptyset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigfillset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigprocmask	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sleep	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
snprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socketpair	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
srandom	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sscanf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
statvfs64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stderr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
strcasecmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strerror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strftime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncasecmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strrchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtol	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtoul	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtoull	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sysconf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
timegm	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
timezone	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
tzset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
umask	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
usleep	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
utime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
waitpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
write	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 11:13:33.178072929 CET	43928	443	192.168.2.23	91.189.91.42
Nov 25, 2024 11:13:38.809262037 CET	42836	443	192.168.2.23	91.189.91.43
Nov 25, 2024 11:13:40.089140892 CET	42516	80	192.168.2.23	109.202.202.202
Nov 25, 2024 11:13:53.655374050 CET	43928	443	192.168.2.23	91.189.91.42
Nov 25, 2024 11:14:04.297427893 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:04.297446966 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:04.297457933 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:04.297631025 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:04.297631025 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:04.297631025 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:04.298698902 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:04.418370008 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:04.702065945 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:04.702385902 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:04.702792883 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:04.822278023 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:05.330354929 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:05.330518961 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:05.332647085 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:05.452513933 CET	443	33606	54.171.230.55	192.168.2.23
Nov 25, 2024 11:14:05.452575922 CET	33606	443	192.168.2.23	54.171.230.55
Nov 25, 2024 11:14:05.941488028 CET	42836	443	192.168.2.23	91.189.91.43
Nov 25, 2024 11:14:10.037064075 CET	42516	80	192.168.2.23	109.202.202.202
Nov 25, 2024 11:14:34.609662056 CET	43928	443	192.168.2.23	91.189.91.42

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 25, 2024 11:14:04.297457933 CET	54.171.230.55	443	192.168.2.23	33606	CN=motd.ubuntu.com CN=R11, O=Let's Encrypt, C=US	CN=R11, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Oct 21 10:21:37 CEST 2024 Wed Mar 13 01:00:00 CET 2024	Sun Jan 19 09:21:36 CET 2025 Sat Mar 13 00:59:59 CET 2027
Nov 25, 2024 11:14:04.297457933 CET	54.171.230.55	443	192.168.2.23	33606	CN=R11, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027

System Behavior

Analysis Process: pure-ftpd PID: 6250, Parent PID: 6174

General

Start time (UTC):	10:13:32
Start date (UTC):	25/11/2024
Path:	/tmp/pure-ftpd
Arguments:	/tmp/pure-ftpd
File size:	177440 bytes
MD5 hash:	42b6c0a470b6009cf36af9522224cbf6

Chronological Activities

Analysis Process: dash PID: 6279, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6279, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.X1oGK1mRig /tmp/tmp.BV2vYR63Ze /tmp/tmp.ElTY2jJylL
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6280, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6280, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.X1oGK1mRig
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6281, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6281, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6282, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6282, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6283, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6283, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6284, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6284, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.X1oGK1mRig
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6285, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6285, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6286, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6286, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6287, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6287, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6288, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6288, Parent PID: 4335

General

Start time (UTC):	10:14:04
Start date (UTC):	25/11/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.X1oGK1mRig /tmp/tmp.BV2vYR63Ze /tmp/tmp.ElTY2jJylL
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report pure-ftpd

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Network Port Distribution

TCP Packets

HTTPS Connections

System Behavior

Analysis Process: pure-ftpd PID: 6250, Parent PID: 6174

General

Chronological Activities

Analysis Process: dash PID: 6279, Parent PID: 4335

General

Chronological Activities

Analysis Process: rm PID: 6279, Parent PID: 4335

General

Chronological Activities

Analysis Process: dash PID: 6280, Parent PID: 4335

General

Chronological Activities

Analysis Process: cat PID: 6280, Parent PID: 4335

General

Chronological Activities

Analysis Process: dash PID: 6281, Parent PID: 4335

General

Chronological Activities

Analysis Process: head PID: 6281, Parent PID: 4335

General

Chronological Activities

Analysis Process: dash PID: 6282, Parent PID: 4335

Linux Analysis Report
pure-ftpd