6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986

ELF

HOSTILE

6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986 · 92%

AI C2-driven multi-vector DDoS attack tool

Mal-ecule

O₂(CI)H₃(Cm₄Cr₃Db)

Size 5.6 MB download

First seen 15 days ago

Analyzed 14 days ago

Ecosystem linux

Source abuse.ch

Also detected by 1 source

Go ELF combines C2 attack dispatch with multiple protocol attack handlers: 6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986.elf:0x356894

Go ELF receives C2 tasking for protocol floods: 6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986.elf:0x356894

Go ELF exposes multiple named protocol attack handlers: 6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986.elf:0x375fe7

6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986.elf elf

0x31bf45	74736e65742f687474703a205472616e	tsnet/http: Tran
0x31bf55	73706f72742e4469616c436f6e746578	sport.DialContex
0x31bf65	7420686f6f6b2072657475726e656420	t hook returned
0x31bf75	286e696c2c206e696c2972616e676520	(nil, nil)range
0x31bf85	66756e6374696f6e20636f6e74696e75	function continu
0x31bf95	656420697465726174696f6e20616674	ed iteration aft
0x31bfa5	6572206c6f6f7020626f64792070616e	er loop body pan
0x31bfb5	696372616e67652066756e6374696f6e	icrange function
0x31bfc5	20636f6e74696e756564206974657261	continued itera
0x31bfd5	74696f6e2061667465722077686f6c65	tion after whole
0x31bfe5	206c6f6f70206578697470726f66696c	loop exitprofil
0x31bff5	65616c6c6f632063616c6c6564207769	ealloc called wi
0x31c005	74686f757420612050206f72206f7574	thout a P or out
0x31c015	7369646520626f6f7473747261707069	side bootstrappi
0x31c025	6e67646574656374656420706f737369	ngdetected possi
0x31c035	626c6520697373756573207769746820	ble issues with
0x31c045	636c65616e75707320616e642f6f7220	cleanups and/or
0x31c055	66696e616c697a657273696e2067634d	finalizersin gcM
0x31c065	61726b20657870656374696e6720746f	ark expecting to
0x31c075	20736565206763706861736520617320	see gcphase as
0x31c085	5f47436d61726b7465726d696e617469	_GCmarkterminati
0x31c095	6f6e72756e74696d653a206e6574706f	onruntime: netpo
0x31c0a5	6c6c3a206576656e7466642072656164	ll: eventfd read
0x31c0b5	7920666f7220736f6d657468	y for someth

0x32bca6	000020e3250000000000000d2b000000	.. .%.......+...
0x32bcb6	00006048300000000000d03526000000	..`H0......5&...
0x32bcc6	0000c013260000000000400d2b000000	....&.....@.+...
0x32bcd6	0000e045300000000000411601f70100	...E0.....A.....
0x32bce6	00000000000000000000410671db0100	..........A.q...
0x32bcf6	00000000000000000000f113a7de0000	................
0x32bd06	00000000000000000000f176ec050100	...........v....
0x32bd16	0000000000000000000060802c000000	..........`.,...
0x32bd26	000000542d0000000000020854ac0000	...T-.......T...
0x32bd36	00007073240000000000e0ad2c000000	..ps$.......,...
0x32bd46	000060d42c0000000000175c95a90000	..`.,......\....
0x32bd56	0000b0750e0000000000c0442b000000	...u.......D+...
0x32bd66	0000c0442b0000000000a06a2f000000	...D+......j/...
0x32bd76	0000e0062b000000000000452b000000	....+......E+...
0x32bd86	000000452b0000000000806b2f000000	...E+......k/...
0x32bd96	000020072b000000000040452b000000	.. .+.....@E+...
0x32bda6	000040452b0000000000606c2f	..@E+.....`l/

0x34f3a7	733134302f6165732f67636d2e47434d	s140/aes/gcm.GCM
0x34f3b7	57697468584f52436f756e7465724e6f	WithXORCounterNo
0x34f3c7	6e63650063727970746f2f6369706865	nce.crypto/ciphe
0x34f3d7	722e6e65774342430063727970746f2f	r.newCBC.crypto/
0x34f3e7	6369706865722e4e6577434243456e63	cipher.NewCBCEnc
0x34f3f7	7279707465720063727970746f2f696e	rypter.crypto/in
0x34f407	7465726e616c2f666970733134302f61	ternal/fips140/a
0x34f417	65732e4e6577434243456e6372797074	es.NewCBCEncrypt
0x34f427	65720063727970746f2f636970686572	er.crypto/cipher
0x34f437	2e282a636263456e6372797074657229	.(*cbcEncrypter)
0x34f447	2e426c6f636b53697a65006372797074	.BlockSize.crypt
0x34f457	6f2f6369706865722e282a636263456e	o/cipher.(*cbcEn
0x34f467	63727970746572292e4372797074426c	crypter).CryptBl
0x34f477	6f636b730063	ocks.c

0x356814	64724c697374006e65742e5265736f6c	drList.net.Resol
0x356824	7665556e697841646472006e65742e28	veUnixAddr.net.(
0x356834	2a556e697841646472292e4e6574776f	*UnixAddr).Netwo
0x356844	726b006e65742e282a49504164647229	rk.net.(*IPAddr)
0x356854	2e697357696c6463617264006e65742e	.isWildcard.net.
0x356864	282a55445041646472292e697357696c	(*UDPAddr).isWil
0x356874	6463617264006e65742e282a54435041	dcard.net.(*TCPA
0x356884	646472292e697357696c646361726400	ddr).isWildcard.
0x356894	6e65742e4469616c54696d656f757400	net.DialTimeout.Go ELF receives C2 tasking for protocol floods
0x3568a4	6e65742e282a4469616c6572292e4469	net.(*Dialer).Di
0x3568b4	616c006e65742e282a4469616c657229	al.net.(*Dialer)
0x3568c4	2e4469616c436f6e74657874006e6574	.DialContext.net
0x3568d4	2e282a4469616c6572292e7265736f6c	.(*Dialer).resol
0x3568e4	766572006e65742e282a4469616c6572	ver.net.(*Dialer
0x3568f4	292e6475616c537461636b006e65742e	).dualStack.net.
0x356904	616464724c6973742e70617274697469	addrList.partiti
0x356914	6f6e006e65742e282a4469616c657229	on.net.(*Dialer)
0x356924	2e6469616c437478006e65742e282a44	.dialCtx.net.(*D
0x356934	69616c6572292e6469616c4374782e66	ialer).dialCtx.f
0x356944	756e6332006e65742e282a4469616c65	unc2.net.(*Diale
0x356954	72292e6469616c4374782e66756e6331	r).dialCtx.func1
0x356964	006e65742e282a7379734469616c6572	.net.(*sysDialer
0x356974	292e6469616c506172616c6c656c006e	).dialParallel.n
0x356984	65742e282a4469616c6572292e66616c	et.(*Dialer).fal
0x356994	6c6261636b44656c6179006e65742e	lbackDelay.net.

0x375e54	6e6e292e636c6f7365436f6e6e496653	nn).closeConnIfS
0x375e64	74696c6c49646c652d666d006e65742f	tillIdle-fm.net/
0x375e74	687474702e282a5472616e73706f7274	http.(*Transport
0x375e84	292e6f6e63655365744e65787450726f	).onceSetNextPro
0x375e94	746f44656661756c74732d666d007479	toDefaults-fm.ty
0x375ea4	70653a2e65712e6e65742f687474702e	pe:.eq.net/http.
0x375eb4	736f636b73557365726e616d65506173	socksUsernamePas
0x375ec4	73776f7264006d61696e2e6d61696e00	sword.main.main.
0x375ed4	6d61696e2e636f6e6e656374546f434e	main.connectToCNGo ELF receives C2 tasking for protocol floods
0x375ee4	43006d61696e2e636f6e6e656374546f	C.main.connectTo
0x375ef4	434e432e64656665727772617031006d	CNC.deferwrap1.mGo ELF combines C2 attack dispatch with multiple protocol attack handlers
0x375f04	61696e2e68616e646c65436f6e6e6563	ain.handleConnec
0x375f14	74696f6e006d61696e2e68616e646c65	tion.main.handle
0x375f24	436f6e6e656374696f6e2e676f777261	Connection.gowra
0x375f34	7031006d61696e2e68616e646c65436f	p1.main.handleCo
0x375f44	6e6e656374696f6e2e66756e6333006d	nnection.func3.m
0x375f54	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375f64	006d61696e2e68616e646c6541747461	.main.handleAtta
0x375f74	636b2e676f7772617035006d61696e2e	ck.gowrap5.main.
0x375f84	68616e646c6541747461636b2e676f77	handleAttack.gow
0x375f94	72617034006d61696e2e68616e646c65	rap4.main.handle
0x375fa4	41747461636b2e676f7772617033006d	Attack.gowrap3.m
0x375fb4	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375fc4	2e676f7772617032006d61696e2e6861	.gowrap2.main.ha
0x375fd4	6e646c6541747461636b2e676f777261	ndleAttack.gowra
0x375fe4	7031006d61696e2e756470006d61696e	p1.main.udp.mainGo ELF exposes multiple named protocol attack handlers
0x375ff4	2e7564702e66756e6331006d61696e2e	.udp.func1.main.
0x376004	7564702e66756e63312e646566657277	udp.func1.deferw
0x376014	72617031006d61696e2e75647053656e	rap1.main.udpSen
0x376024	64006d61696e2e75647053656e642e64	d.main.udpSend.d
0x376034	656665727772617031006d61696e2e75	eferwrap1.main.u
0x376044	6470706c61696e006d61696e2e756470	dpplain.main.udp
0x376054	706c61696e2e66756e6331006d61696e	plain.func1.main
0x376064	2e756470706c61696e2e66756e63312e	.udpplain.func1.
0x376074	64656665727772617031006d61696e2e	deferwrap1.main.
0x376084	756470706c61696e53656e64006d6169	udpplainSend.mai
0x376094	6e2e756470706c61696e53656e642e64	n.udpplainSend.d
0x3760a4	656665727772617031006d61696e2e74	eferwrap1.main.t
0x3760b4	6370006d61696e2e7463702e66756e63	cp.main.tcp.func
0x3760c4	31006d61696e2e7463702e66756e6331	1.main.tcp.func1
0x3760d4	2e64656665727772617031006d61696e	.deferwrap1.main
0x3760e4	2e74637053656e64006d61696e2e6874	.tcpSend.main.htGo ELF exposes named HTTP attack handlers
0x3760f4	7470006d61696e2e687474702e66756e	tp.main.http.fun
0x376104	6331006d61696e2e687474702e66756e	c1.main.http.fun
0x376114	63312e64656665727772617031006d61	c1.deferwrap1.ma
0x376124	696e2e6874747053656e64006e65742f	in.httpSend.net/
0x376134	687474702e4e65775265717565737400	http.NewRequest.
0x376144	6d61696e2e7561006e65742f68747470	main.ua.net/http

Objectives

0x375e54	6e6e292e636c6f7365436f6e6e496653	nn).closeConnIfS
0x375e64	74696c6c49646c652d666d006e65742f	tillIdle-fm.net/
0x375e74	687474702e282a5472616e73706f7274	http.(*Transport
0x375e84	292e6f6e63655365744e65787450726f	).onceSetNextPro
0x375e94	746f44656661756c74732d666d007479	toDefaults-fm.ty
0x375ea4	70653a2e65712e6e65742f687474702e	pe:.eq.net/http.
0x375eb4	736f636b73557365726e616d65506173	socksUsernamePas
0x375ec4	73776f7264006d61696e2e6d61696e00	sword.main.main.
0x375ed4	6d61696e2e636f6e6e656374546f434e	main.connectToCN
0x375ee4	43006d61696e2e636f6e6e656374546f	C.main.connectTo
0x375ef4	434e432e64656665727772617031006d	CNC.deferwrap1.m
0x375f04	61696e2e68616e646c65436f6e6e6563	ain.handleConnec
0x375f14	74696f6e006d61696e2e68616e646c65	tion.main.handle
0x375f24	436f6e6e656374696f6e2e676f777261	Connection.gowra
0x375f34	7031006d61696e2e68616e646c65436f	p1.main.handleCo
0x375f44	6e6e656374696f6e2e66756e6333006d	nnection.func3.m
0x375f54	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375f64	006d61696e2e68616e646c6541747461	.main.handleAtta
0x375f74	636b2e676f7772617035006d61696e2e	ck.gowrap5.main.
0x375f84	68616e646c6541747461636b2e676f77	handleAttack.gow
0x375f94	72617034006d61696e2e68616e646c65	rap4.main.handle
0x375fa4	41747461636b2e676f7772617033006d	Attack.gowrap3.m
0x375fb4	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375fc4	2e676f7772617032006d61696e2e6861	.gowrap2.main.ha
0x375fd4	6e646c6541747461636b2e676f777261	ndleAttack.gowra
0x375fe4	7031006d61696e2e756470006d61696e	p1.main.udp.main
0x375ff4	2e7564702e66756e6331006d61696e2e	.udp.func1.main.
0x376004	7564702e66756e63312e646566657277	udp.func1.deferw
0x376014	72617031006d61696e2e75647053656e	rap1.main.udpSen
0x376024	64006d61696e2e75647053656e642e64	d.main.udpSend.d
0x376034	656665727772617031006d61696e2e75	eferwrap1.main.u
0x376044	6470706c61696e006d61696e2e756470	dpplain.main.udp
0x376054	706c61696e2e66756e6331006d61696e	plain.func1.main
0x376064	2e756470706c61696e2e66756e63312e	.udpplain.func1.
0x376074	64656665727772617031006d61696e2e	deferwrap1.main.
0x376084	756470706c61696e53656e64006d6169	udpplainSend.mai
0x376094	6e2e756470706c61696e53656e642e64	n.udpplainSend.d
0x3760a4	656665727772617031006d61696e2e74	eferwrap1.main.t
0x3760b4	6370006d61696e2e7463702e66756e63	cp.main.tcp.func
0x3760c4	31006d61696e2e7463702e66756e6331	1.main.tcp.func1
0x3760d4	2e64656665727772617031006d61696e	.deferwrap1.main
0x3760e4	2e74637053656e64006d61696e2e6874	.tcpSend.main.ht
0x3760f4	7470006d61696e2e687474702e66756e	tp.main.http.fun
0x376104	6331006d61696e2e687474702e66756e	c1.main.http.fun
0x376114	63312e64656665727772617031006d61	c1.deferwrap1.ma
0x376124	696e2e6874747053656e64006e65742f	in.httpSend.net/
0x376134	687474702e4e65775265717565737400	http.NewRequest.
0x376144	6d61696e2e7561006e65742f68747470	main.ua.net/http

0x356814	64724c697374006e65742e5265736f6c	drList.net.Resol
0x356824	7665556e697841646472006e65742e28	veUnixAddr.net.(
0x356834	2a556e697841646472292e4e6574776f	*UnixAddr).Netwo
0x356844	726b006e65742e282a49504164647229	rk.net.(*IPAddr)
0x356854	2e697357696c6463617264006e65742e	.isWildcard.net.
0x356864	282a55445041646472292e697357696c	(*UDPAddr).isWil
0x356874	6463617264006e65742e282a54435041	dcard.net.(*TCPA
0x356884	646472292e697357696c646361726400	ddr).isWildcard.
0x356894	6e65742e4469616c54696d656f757400	net.DialTimeout.
0x3568a4	6e65742e282a4469616c6572292e4469	net.(*Dialer).Di
0x3568b4	616c006e65742e282a4469616c657229	al.net.(*Dialer)
0x3568c4	2e4469616c436f6e74657874006e6574	.DialContext.net
0x3568d4	2e282a4469616c6572292e7265736f6c	.(*Dialer).resol
0x3568e4	766572006e65742e282a4469616c6572	ver.net.(*Dialer
0x3568f4	292e6475616c537461636b006e65742e	).dualStack.net.
0x356904	616464724c6973742e70617274697469	addrList.partiti
0x356914	6f6e006e65742e282a4469616c657229	on.net.(*Dialer)
0x356924	2e6469616c437478006e65742e282a44	.dialCtx.net.(*D
0x356934	69616c6572292e6469616c4374782e66	ialer).dialCtx.f
0x356944	756e6332006e65742e282a4469616c65	unc2.net.(*Diale
0x356954	72292e6469616c4374782e66756e6331	r).dialCtx.func1
0x356964	006e65742e282a7379734469616c6572	.net.(*sysDialer
0x356974	292e6469616c506172616c6c656c006e	).dialParallel.n
0x356984	65742e282a4469616c6572292e66616c	et.(*Dialer).fal
0x356994	6c6261636b44656c6179006e65742e	lbackDelay.net.

0x375e54	6e6e292e636c6f7365436f6e6e496653	nn).closeConnIfS
0x375e64	74696c6c49646c652d666d006e65742f	tillIdle-fm.net/
0x375e74	687474702e282a5472616e73706f7274	http.(*Transport
0x375e84	292e6f6e63655365744e65787450726f	).onceSetNextPro
0x375e94	746f44656661756c74732d666d007479	toDefaults-fm.ty
0x375ea4	70653a2e65712e6e65742f687474702e	pe:.eq.net/http.
0x375eb4	736f636b73557365726e616d65506173	socksUsernamePas
0x375ec4	73776f7264006d61696e2e6d61696e00	sword.main.main.
0x375ed4	6d61696e2e636f6e6e656374546f434e	main.connectToCN
0x375ee4	43006d61696e2e636f6e6e656374546f	C.main.connectTo
0x375ef4	434e432e64656665727772617031006d	CNC.deferwrap1.m
0x375f04	61696e2e68616e646c65436f6e6e6563	ain.handleConnec
0x375f14	74696f6e006d61696e2e68616e646c65	tion.main.handle
0x375f24	436f6e6e656374696f6e2e676f777261	Connection.gowra
0x375f34	7031006d61696e2e68616e646c65436f	p1.main.handleCo
0x375f44	6e6e656374696f6e2e66756e6333006d	nnection.func3.m
0x375f54	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375f64	006d61696e2e68616e646c6541747461	.main.handleAtta
0x375f74	636b2e676f7772617035006d61696e2e	ck.gowrap5.main.
0x375f84	68616e646c6541747461636b2e676f77	handleAttack.gow
0x375f94	72617034006d61696e2e68616e646c65	rap4.main.handle
0x375fa4	41747461636b2e676f7772617033006d	Attack.gowrap3.m
0x375fb4	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375fc4	2e676f7772617032006d61696e2e6861	.gowrap2.main.ha
0x375fd4	6e646c6541747461636b2e676f777261	ndleAttack.gowra
0x375fe4	7031006d61696e2e756470006d61696e	p1.main.udp.main
0x375ff4	2e7564702e66756e6331006d61696e2e	.udp.func1.main.
0x376004	7564702e66756e63312e646566657277	udp.func1.deferw
0x376014	72617031006d61696e2e75647053656e	rap1.main.udpSen
0x376024	64006d61696e2e75647053656e642e64	d.main.udpSend.d
0x376034	656665727772617031006d61696e2e75	eferwrap1.main.u
0x376044	6470706c61696e006d61696e2e756470	dpplain.main.udp
0x376054	706c61696e2e66756e6331006d61696e	plain.func1.main
0x376064	2e756470706c61696e2e66756e63312e	.udpplain.func1.
0x376074	64656665727772617031006d61696e2e	deferwrap1.main.
0x376084	756470706c61696e53656e64006d6169	udpplainSend.mai
0x376094	6e2e756470706c61696e53656e642e64	n.udpplainSend.d
0x3760a4	656665727772617031006d61696e2e74	eferwrap1.main.t
0x3760b4	6370006d61696e2e7463702e66756e63	cp.main.tcp.func
0x3760c4	31006d61696e2e7463702e66756e6331	1.main.tcp.func1
0x3760d4	2e64656665727772617031006d61696e	.deferwrap1.main
0x3760e4	2e74637053656e64006d61696e2e6874	.tcpSend.main.ht
0x3760f4	7470006d61696e2e687474702e66756e	tp.main.http.fun
0x376104	6331006d61696e2e687474702e66756e	c1.main.http.fun
0x376114	63312e64656665727772617031006d61	c1.deferwrap1.ma
0x376124	696e2e6874747053656e64006e65742f	in.httpSend.net/
0x376134	687474702e4e65775265717565737400	http.NewRequest.
0x376144	6d61696e2e7561006e65742f68747470	main.ua.net/http

0x356814	64724c697374006e65742e5265736f6c	drList.net.Resol
0x356824	7665556e697841646472006e65742e28	veUnixAddr.net.(
0x356834	2a556e697841646472292e4e6574776f	*UnixAddr).Netwo
0x356844	726b006e65742e282a49504164647229	rk.net.(*IPAddr)
0x356854	2e697357696c6463617264006e65742e	.isWildcard.net.
0x356864	282a55445041646472292e697357696c	(*UDPAddr).isWil
0x356874	6463617264006e65742e282a54435041	dcard.net.(*TCPA
0x356884	646472292e697357696c646361726400	ddr).isWildcard.
0x356894	6e65742e4469616c54696d656f757400	net.DialTimeout.
0x3568a4	6e65742e282a4469616c6572292e4469	net.(*Dialer).Di
0x3568b4	616c006e65742e282a4469616c657229	al.net.(*Dialer)
0x3568c4	2e4469616c436f6e74657874006e6574	.DialContext.net
0x3568d4	2e282a4469616c6572292e7265736f6c	.(*Dialer).resol
0x3568e4	766572006e65742e282a4469616c6572	ver.net.(*Dialer
0x3568f4	292e6475616c537461636b006e65742e	).dualStack.net.
0x356904	616464724c6973742e70617274697469	addrList.partiti
0x356914	6f6e006e65742e282a4469616c657229	on.net.(*Dialer)
0x356924	2e6469616c437478006e65742e282a44	.dialCtx.net.(*D
0x356934	69616c6572292e6469616c4374782e66	ialer).dialCtx.f
0x356944	756e6332006e65742e282a4469616c65	unc2.net.(*Diale
0x356954	72292e6469616c4374782e66756e6331	r).dialCtx.func1
0x356964	006e65742e282a7379734469616c6572	.net.(*sysDialer
0x356974	292e6469616c506172616c6c656c006e	).dialParallel.n
0x356984	65742e282a4469616c6572292e66616c	et.(*Dialer).fal
0x356994	6c6261636b44656c6179006e65742e	lbackDelay.net.

Micro-behaviors

0x31bf45	74736e65742f687474703a205472616e	tsnet/http: Tran
0x31bf55	73706f72742e4469616c436f6e746578	sport.DialContex
0x31bf65	7420686f6f6b2072657475726e656420	t hook returned
0x31bf75	286e696c2c206e696c2972616e676520	(nil, nil)range
0x31bf85	66756e6374696f6e20636f6e74696e75	function continu
0x31bf95	656420697465726174696f6e20616674	ed iteration aft
0x31bfa5	6572206c6f6f7020626f64792070616e	er loop body pan
0x31bfb5	696372616e67652066756e6374696f6e	icrange function
0x31bfc5	20636f6e74696e756564206974657261	continued itera
0x31bfd5	74696f6e2061667465722077686f6c65	tion after whole
0x31bfe5	206c6f6f70206578697470726f66696c	loop exitprofil
0x31bff5	65616c6c6f632063616c6c6564207769	ealloc called wi
0x31c005	74686f757420612050206f72206f7574	thout a P or out
0x31c015	7369646520626f6f7473747261707069	side bootstrappi
0x31c025	6e67646574656374656420706f737369	ngdetected possi
0x31c035	626c6520697373756573207769746820	ble issues with
0x31c045	636c65616e75707320616e642f6f7220	cleanups and/or
0x31c055	66696e616c697a657273696e2067634d	finalizersin gcM
0x31c065	61726b20657870656374696e6720746f	ark expecting to
0x31c075	20736565206763706861736520617320	see gcphase as
0x31c085	5f47436d61726b7465726d696e617469	_GCmarkterminati
0x31c095	6f6e72756e74696d653a206e6574706f	onruntime: netpo
0x31c0a5	6c6c3a206576656e7466642072656164	ll: eventfd read
0x31c0b5	7920666f7220736f6d657468	y for someth

0x5409d0	04080304070805080608010401050106	................
0x5409e0	03050306000000000000000000000000	................
0x5409f0	001010141c20304024141c2030401c20	..... 0@$.. 0@.
0x540a00	20203040000000000000000000000000	0@............
0x540a10	505249202a20485454502f322e300d0a	PRI * HTTP/2.0..
0x540a20	0d0a534d0d0a0d0a0000000000000000	..SM............
0x540a30	000000000200000070f20d0000000000	........p.......
0x540a40	a02f0e00000000000000000000000000	./..............
0x540a50	c0095500000000000200000000000000	..U.............
0x540a60	02000000000000000000000000000000	................
0x540a70	000000000200000070610a0000000000	........pa......
0x540a80	60690a00000000000000000000000000	`i..............
0x540a90	0000000002000000f02501000000	.........%....

0x375e54	6e6e292e636c6f7365436f6e6e496653	nn).closeConnIfS
0x375e64	74696c6c49646c652d666d006e65742f	tillIdle-fm.net/
0x375e74	687474702e282a5472616e73706f7274	http.(*Transport
0x375e84	292e6f6e63655365744e65787450726f	).onceSetNextPro
0x375e94	746f44656661756c74732d666d007479	toDefaults-fm.ty
0x375ea4	70653a2e65712e6e65742f687474702e	pe:.eq.net/http.
0x375eb4	736f636b73557365726e616d65506173	socksUsernamePas
0x375ec4	73776f7264006d61696e2e6d61696e00	sword.main.main.
0x375ed4	6d61696e2e636f6e6e656374546f434e	main.connectToCN
0x375ee4	43006d61696e2e636f6e6e656374546f	C.main.connectTo
0x375ef4	434e432e64656665727772617031006d	CNC.deferwrap1.m
0x375f04	61696e2e68616e646c65436f6e6e6563	ain.handleConnec
0x375f14	74696f6e006d61696e2e68616e646c65	tion.main.handle
0x375f24	436f6e6e656374696f6e2e676f777261	Connection.gowra
0x375f34	7031006d61696e2e68616e646c65436f	p1.main.handleCo
0x375f44	6e6e656374696f6e2e66756e6333006d	nnection.func3.m
0x375f54	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375f64	006d61696e2e68616e646c6541747461	.main.handleAtta
0x375f74	636b2e676f7772617035006d61696e2e	ck.gowrap5.main.
0x375f84	68616e646c6541747461636b2e676f77	handleAttack.gow
0x375f94	72617034006d61696e2e68616e646c65	rap4.main.handle
0x375fa4	41747461636b2e676f7772617033006d	Attack.gowrap3.m
0x375fb4	61696e2e68616e646c6541747461636b	ain.handleAttack
0x375fc4	2e676f7772617032006d61696e2e6861	.gowrap2.main.ha
0x375fd4	6e646c6541747461636b2e676f777261	ndleAttack.gowra
0x375fe4	7031006d61696e2e756470006d61696e	p1.main.udp.main
0x375ff4	2e7564702e66756e6331006d61696e2e	.udp.func1.main.
0x376004	7564702e66756e63312e646566657277	udp.func1.deferw
0x376014	72617031006d61696e2e75647053656e	rap1.main.udpSen
0x376024	64006d61696e2e75647053656e642e64	d.main.udpSend.d
0x376034	656665727772617031006d61696e2e75	eferwrap1.main.u
0x376044	6470706c61696e006d61696e2e756470	dpplain.main.udp
0x376054	706c61696e2e66756e6331006d61696e	plain.func1.main
0x376064	2e756470706c61696e2e66756e63312e	.udpplain.func1.
0x376074	64656665727772617031006d61696e2e	deferwrap1.main.
0x376084	756470706c61696e53656e64006d6169	udpplainSend.mai
0x376094	6e2e756470706c61696e53656e642e64	n.udpplainSend.d
0x3760a4	656665727772617031006d61696e2e74	eferwrap1.main.t
0x3760b4	6370006d61696e2e7463702e66756e63	cp.main.tcp.func
0x3760c4	31006d61696e2e7463702e66756e6331	1.main.tcp.func1
0x3760d4	2e64656665727772617031006d61696e	.deferwrap1.main
0x3760e4	2e74637053656e64006d61696e2e6874	.tcpSend.main.ht
0x3760f4	7470006d61696e2e687474702e66756e	tp.main.http.fun
0x376104	6331006d61696e2e687474702e66756e	c1.main.http.fun
0x376114	63312e64656665727772617031006d61	c1.deferwrap1.ma
0x376124	696e2e6874747053656e64006e65742f	in.httpSend.net/
0x376134	687474702e4e65775265717565737400	http.NewRequest.
0x376144	6d61696e2e7561006e65742f68747470	main.ua.net/http

0x356814	64724c697374006e65742e5265736f6c	drList.net.Resol
0x356824	7665556e697841646472006e65742e28	veUnixAddr.net.(
0x356834	2a556e697841646472292e4e6574776f	*UnixAddr).Netwo
0x356844	726b006e65742e282a49504164647229	rk.net.(*IPAddr)
0x356854	2e697357696c6463617264006e65742e	.isWildcard.net.
0x356864	282a55445041646472292e697357696c	(*UDPAddr).isWil
0x356874	6463617264006e65742e282a54435041	dcard.net.(*TCPA
0x356884	646472292e697357696c646361726400	ddr).isWildcard.
0x356894	6e65742e4469616c54696d656f757400	net.DialTimeout.
0x3568a4	6e65742e282a4469616c6572292e4469	net.(*Dialer).Di
0x3568b4	616c006e65742e282a4469616c657229	al.net.(*Dialer)
0x3568c4	2e4469616c436f6e74657874006e6574	.DialContext.net
0x3568d4	2e282a4469616c6572292e7265736f6c	.(*Dialer).resol
0x3568e4	766572006e65742e282a4469616c6572	ver.net.(*Dialer
0x3568f4	292e6475616c537461636b006e65742e	).dualStack.net.
0x356904	616464724c6973742e70617274697469	addrList.partiti
0x356914	6f6e006e65742e282a4469616c657229	on.net.(*Dialer)
0x356924	2e6469616c437478006e65742e282a44	.dialCtx.net.(*D
0x356934	69616c6572292e6469616c4374782e66	ialer).dialCtx.f
0x356944	756e6332006e65742e282a4469616c65	unc2.net.(*Diale
0x356954	72292e6469616c4374782e66756e6331	r).dialCtx.func1
0x356964	006e65742e282a7379734469616c6572	.net.(*sysDialer
0x356974	292e6469616c506172616c6c656c006e	).dialParallel.n
0x356984	65742e282a4469616c6572292e66616c	et.(*Dialer).fal
0x356994	6c6261636b44656c6179006e65742e	lbackDelay.net.

0x32bca6	000020e3250000000000000d2b000000	.. .%.......+...
0x32bcb6	00006048300000000000d03526000000	..`H0......5&...
0x32bcc6	0000c013260000000000400d2b000000	....&.....@.+...
0x32bcd6	0000e045300000000000411601f70100	...E0.....A.....
0x32bce6	00000000000000000000410671db0100	..........A.q...
0x32bcf6	00000000000000000000f113a7de0000	................
0x32bd06	00000000000000000000f176ec050100	...........v....
0x32bd16	0000000000000000000060802c000000	..........`.,...
0x32bd26	000000542d0000000000020854ac0000	...T-.......T...
0x32bd36	00007073240000000000e0ad2c000000	..ps$.......,...
0x32bd46	000060d42c0000000000175c95a90000	..`.,......\....
0x32bd56	0000b0750e0000000000c0442b000000	...u.......D+...
0x32bd66	0000c0442b0000000000a06a2f000000	...D+......j/...
0x32bd76	0000e0062b000000000000452b000000	....+......E+...
0x32bd86	000000452b0000000000806b2f000000	...E+......k/...
0x32bd96	000020072b000000000040452b000000	.. .+.....@E+...
0x32bda6	000040452b0000000000606c2f	..@E+.....`l/

0x34f3a7	733134302f6165732f67636d2e47434d	s140/aes/gcm.GCM
0x34f3b7	57697468584f52436f756e7465724e6f	WithXORCounterNo
0x34f3c7	6e63650063727970746f2f6369706865	nce.crypto/ciphe
0x34f3d7	722e6e65774342430063727970746f2f	r.newCBC.crypto/
0x34f3e7	6369706865722e4e6577434243456e63	cipher.NewCBCEnc
0x34f3f7	7279707465720063727970746f2f696e	rypter.crypto/in
0x34f407	7465726e616c2f666970733134302f61	ternal/fips140/a
0x34f417	65732e4e6577434243456e6372797074	es.NewCBCEncrypt
0x34f427	65720063727970746f2f636970686572	er.crypto/cipher
0x34f437	2e282a636263456e6372797074657229	.(*cbcEncrypter)
0x34f447	2e426c6f636b53697a65006372797074	.BlockSize.crypt
0x34f457	6f2f6369706865722e282a636263456e	o/cipher.(*cbcEn
0x34f467	63727970746572292e4372797074426c	crypter).CryptBl
0x34f477	6f636b730063	ocks.c

0x35e65a	6b69782e4e616d652e537472696e6700	kix.Name.String.
0x35e66a	63727970746f2f783530392f706b6978	crypto/x509/pkix
0x35e67a	2e282a4e616d65292e537472696e6700	.(*Name).String.
0x35e68a	63727970746f2f6165732e4b65795369	crypto/aes.KeySi
0x35e69a	7a654572726f722e4572726f72006372	zeError.Error.cr
0x35e6aa	7970746f2f6165732e4e657743697068	ypto/aes.NewCiph
0x35e6ba	65720063727970746f2f696e7465726e	er.crypto/intern
0x35e6ca	616c2f666970733134302f6165732e4e	al/fips140/aes.N
0x35e6da	65770063727970746f2f6165732e282a	ew.crypto/aes.(*
0x35e6ea	4b657953697a654572726f72292e4572	KeySizeError).Er
0x35e6fa	726f720063727970746f2f6465732e63	ror.crypto/des.c
0x35e70a	72797074426c6f636b0063727970746f	ryptBlock.crypto
0x35e71a	2f6465732e6665697374656c00637279	/des.feistel.cry
0x35e72a	70746f2f6465732e696e697446656973	pto/des.initFeis
0x35e73a	74656c426f780063727970746f	telBox.crypto

0x34f4d4	7970746f2f737562746c652e584f5242	ypto/subtle.XORB
0x34f4e4	797465730063727970746f2f63697068	ytes.crypto/ciph
0x34f4f4	65722e282a636263456e637279707465	er.(*cbcEncrypte
0x34f504	72292e53657449560063727970746f2f	r).SetIV.crypto/
0x34f514	6369706865722e4e6577434243446563	cipher.NewCBCDec
0x34f524	7279707465720063727970746f2f696e	rypter.crypto/in
0x34f534	7465726e616c2f666970733134302f61	ternal/fips140/a
0x34f544	65732e4e657743424344656372797074	es.NewCBCDecrypt
0x34f554	65720063727970746f2f636970686572	er.crypto/cipher
0x34f564	2e282a63626344656372797074657229	.(*cbcDecrypter)
0x34f574	2e426c6f636b53697a65006372797074	.BlockSize.crypt
0x34f584	6f2f6369706865722e282a6362634465	o/cipher.(*cbcDe
0x34f594	63727970746572292e4372797074426c	crypter).CryptBl
0x34f5a4	6f636b730063	ocks.c

0x360e3c	6f2f63686163686132302e4843686143	o/chacha20.HChaC
0x360e4c	6861323000656e636f64696e672f6269	ha20.encoding/bi
0x360e5c	6e6172792e6c6974746c65456e646961	nary.littleEndia
0x360e6c	6e2e55696e7433320076656e646f722f	n.Uint32.vendor/
0x360e7c	676f6c616e672e6f72672f782f637279	golang.org/x/cry
0x360e8c	70746f2f63686163686132302e282a43	pto/chacha20.(*C
0x360e9c	6970686572292e584f524b6579537472	ipher).XORKeyStr
0x360eac	65616d0076656e646f722f676f6c616e	eam.vendor/golan
0x360ebc	672e6f72672f782f63727970746f2f69	g.org/x/crypto/i
0x360ecc	6e7465726e616c2f616c6961732e496e	nternal/alias.In
0x360edc	65786163744f7665726c61700076656e	exactOverlap.ven
0x360eec	646f722f676f6c616e672e6f72672f78	dor/golang.org/x
0x360efc	2f63727970746f2f696e7465726e616c	/crypto/internal
0x360f0c	2f616c6961732e416e794f7665726c61	/alias.AnyOverla
0x360f1c	700076656e646f722f676f6c616e672e	p.vendor/golang.
0x360f2c	6f7267	org

0x35db66	726e616c2f666970733134302f736861	rnal/fips140/sha
0x35db76	3235362e4e6577323234006372797074	256.New224.crypt
0x35db86	6f2f7368613235362e53756d32323400	o/sha256.Sum224.
0x35db96	656e636f64696e672f6261736536342e	encoding/base64.
0x35dba6	696e697400656e636f64696e672f6261	init.encoding/ba
0x35dbb6	736536342e4e6577456e636f64696e67	se64.NewEncoding
0x35dbc6	00656e636f64696e672f626173653634	.encoding/base64
0x35dbd6	2e456e636f64696e672e576974685061	.Encoding.WithPa
0x35dbe6	6464696e6700656e636f64696e672f62	dding.encoding/b
0x35dbf6	61736536342e282a456e636f64696e67	ase64.(*Encoding
0x35dc06	292e456e636f646500656e636f64696e	).Encode.encodin
0x35dc16	672f6261736536342e282a456e636f64	g/base64.(*Encod
0x35dc26	696e67292e456e636f6465546f537472	ing).EncodeToStr
0x35dc36	696e6700656e636f64696e672f626173	ing.encoding/bas
0x35dc46	6536342e282a456e636f64696e67292e	e64.(*Encoding).
0x35dc56	456e636f6465644c656e00656e636f64	EncodedLen.encod
0x35dc66	696e672f6261736536342e436f727275	ing/base64.Corru
0x35dc76	7074496e7075744572726f722e457272	ptInputError.Err
0x35dc86	6f7200737472636f6e762e466f726d61	or.strconv.Forma
0x35dc96	74496e7400656e636f64696e672f6261	tInt.encoding/ba
0x35dca6	736536342e282a456e636f64696e6729	se64.(*Encoding)
0x35dcb6	2e6465636f64655175616e74756d0065	.decodeQuantum.e
0x35dcc6	6e636f64696e672f6261736536342e28	ncoding/base64.(
0x35dcd6	2a456e636f64696e67292e4465636f64	*Encoding).Decod
0x35dce6	6500656e636f64696e672f6261736536	e.encoding/base6
0x35dcf6	342e617373656d626c65363400656e63	4.assemble64.enc
0x35dd06	6f64696e	odin

0x31bb2a	7974657368747470323a205472616e73	yteshttp2: Trans
0x31bb3a	706f727420726563656976656420474f	port received GO
0x31bb4a	415741592066726f6d20736572766572	AWAY from server
0x31bb5a	20457272436f64653a25766d68656170	ErrCode:%vmheap
0x31bb6a	2e667265655370616e4c6f636b656420	.freeSpanLocked
0x31bb7a	2d20696e76616c69642066726565206f	- invalid free o
0x31bb8a	662075736572206172656e6120636875	f user arena chu
0x31bb9a	6e6b63617366726f6d5f477363616e73	nkcasfrom_Gscans
0x31bbaa	74617475733a746f702067702d3e7374	tatus:top gp->st
0x31bbba	61747573206973206e6f7420696e2073	atus is not in s
0x31bbca	63616e2073746174657265666c656374	can statereflect
0x31bbda	3a20696e7465726e616c206572726f72	: internal error
0x31bbea	3a20696e76616c696420757365206f66	: invalid use of
0x31bbfa	206d616b654d6574686f6456616c7565	makeMethodValue
0x31bc0a	6561636820636f6c6f6e2d7365706172	each colon-separ
0x31bc1a	61746564206669656c64206d75737420	ated field must
0x31bc2a	68617665206174206c65617374206f6e	have at least on
0x31bc3a	65206469676974746c733a20696e7465	e digittls: inte
0x31bc4a	726e61	rna

0x324bb0	491f48030000001f4a1f49030000001f	I.H.....J.I.....
0x324bc0	4b1f48030100001f4c1f49030100001f	K.H.....L.I.....
0x324bd0	4d03c5031300001f5003c5031400001f	M.......P.......
0x324be0	511f50030000001f521f51030000001f	Q.P.....R.Q.....
0x324bf0	531f50030100001f541f51030100001f	S.P.....T.Q.....
0x324c00	551f50034200001f561f51034200001f	U.P.B...V.Q.B...
0x324c10	5703a5031400001f591f59030000001f	W.......Y.Y.....
0x324c20	5b1f59030100001f5d1f59034200001f	[.Y.....].Y.B...
0x324c30	5f03c9031300001f6003c9031400001f	_.......`.......
0x324c40	611f60030000001f621f61030000001f	a.`.....b.a.....
0x324c50	631f60030100001f641f61030100001f	c.`.....d.a.....
0x324c60	651f60034200001f661f61034200001f	e.`.B...f.a.B...
0x324c70	6703a9031300001f	g.......

Metadata

0x320b21	07372a030730010307300f0307302e03	.7*..0...0...0..
0x320b31	07311603073104030731300307321803	.1...1...10..2..
0x320b41	07322d030733140307333e0307270903	.2-..3...3>..'..
0x320b51	07200003071f0b030718230307182803	. ........#...(.
0x320b61	07183603071803030719160307113603	..6...........6.
0x320b71	0712270307131003070c2603070c0803	..'.......&.....
0x320b81	070c1303070d0203070d1c03070b3503	..............5.
0x320b91	070b0a03070b0103070b0f0307050003	................
0x320ba1	0705090307050b030707010307070803	................
0x320bb1	07003c03	..<.

0x32eba0	608d330000000000708d330000000000	`.3.....p.3.....
0x32ebb0	808d330000000000908d330000000000	..3.......3.....
0x32ebc0	80eb33000000000060d42a0000000000	..3.....`.*.....
0x32ebd0	80e52b00000000000000000000000000	..+.............
0x32ebe0	108e33000000000000a3330000000000	..3.......3.....
0x32ebf0	308e33000000000060b3330000000000	0.3.....`.3.....
0x32ec00	508e330000000000608e330000000000	P.3.....`.3.....
0x32ec10	708e330000000000808e330000000000	p.3.......3.....
0x32ec20	e0eb330000000000a0d92a0000000000	..3.......*.....
0x32ec30	40e62b00	@.+.

0x32424c	2300001e0c0064032300001e0d004403	#.....d.#.....D.
0x32425c	3100001e0e0064033100001e0f004403	1.....d.1.....D.
0x32426c	2700001e100064032700001e11004403	'.....d.'.....D.
0x32427c	2d00001e120064032d00001e13011203	-.....d.-.......
0x32428c	0000001e140113030000001e15011203	................
0x32429c	0100001e160113030100001e17004503	..............E.
0x3242ac	2d00001e180065032d00001e19004503	-.....e.-.....E.
0x3242bc	3000001e1a0065033000001e1b022803	0.....e.0.....(.
0x3242cc	0600001e1c0229030600001e1d004603	......).......F.
0x3242dc	070000	...

0x33ac51	696d652e61737365727445324900696e	ime.assertE2I.in
0x33ac61	7465726e616c2f72756e74696d652f61	ternal/runtime/a
0x33ac71	746f6d69632e282a55696e743332292e	tomic.(*Uint32).
0x33ac81	416e640072756e74696d652e6973476f	And.runtime.isGo
0x33ac91	506f696e746572576974686f75745370	PointerWithoutSp
0x33aca1	616e0072756e74696d652e5365744669	an.runtime.SetFi
0x33acb1	6e616c697a657200696e7465726e616c	nalizer.internal
0x33acc1	2f6162692e282a46756e635479706529	/abi.(*FuncType)
0x33acd1	2e4973566172696164696300696e7465	.IsVariadic.inte
0x33ace1	726e61	rna

0x31bf45	74736e65742f687474703a205472616e	tsnet/http: Tran
0x31bf55	73706f72742e4469616c436f6e746578	sport.DialContex
0x31bf65	7420686f6f6b2072657475726e656420	t hook returned
0x31bf75	286e696c2c206e696c2972616e676520	(nil, nil)range
0x31bf85	66756e6374696f6e20636f6e74696e75	function continu
0x31bf95	656420697465726174696f6e20616674	ed iteration aft
0x31bfa5	6572206c6f6f7020626f64792070616e	er loop body pan
0x31bfb5	696372616e67652066756e6374696f6e	icrange function
0x31bfc5	20636f6e74696e756564206974657261	continued itera
0x31bfd5	74696f6e2061667465722077686f6c65	tion after whole
0x31bfe5	206c6f6f70206578697470726f66696c	loop exitprofil
0x31bff5	65616c6c6f632063616c6c6564207769	ealloc called wi
0x31c005	74686f757420612050206f72206f7574	thout a P or out
0x31c015	7369646520626f6f7473747261707069	side bootstrappi
0x31c025	6e67646574656374656420706f737369	ngdetected possi
0x31c035	626c6520697373756573207769746820	ble issues with
0x31c045	636c65616e75707320616e642f6f7220	cleanups and/or
0x31c055	66696e616c697a657273696e2067634d	finalizersin gcM
0x31c065	61726b20657870656374696e6720746f	ark expecting to
0x31c075	20736565206763706861736520617320	see gcphase as
0x31c085	5f47436d61726b7465726d696e617469	_GCmarkterminati
0x31c095	6f6e72756e74696d653a206e6574706f	onruntime: netpo
0x31c0a5	6c6c3a206576656e7466642072656164	ll: eventfd read
0x31c0b5	7920666f7220736f6d657468	y for someth

0x31d8ad	6174656420626c6f636b746c733a2069	ated blocktls: i
0x31d8bd	6e7465726e616c206572726f723a2061	nternal error: a
0x31d8cd	7474656d7074656420746f2072656164	ttempted to read
0x31d8dd	207265636f7264207769746820515549	record with QUI
0x31d8ed	43207472616e73706f7274746c733a20	C transporttls:
0x31d8fd	7365727665722073656c656374656420	server selected
0x31d90d	616e20696e76616c6964207665727369	an invalid versi
0x31d91d	6f6e20616674657220612048656c6c6f	on after a Hello
0x31d92d	52657472795265717565737478353039	RetryRequestx509
0x31d93d	3a20706f	: po

0x53ffd0	00000000000000000000000000000000	................
0x53ffe0	00000000000000000000000000000000	................
0x53fff0	00000000000000000000000000000000	................
0x540000	ff20476f206275696c64696e663a0802	. Go buildinf:..
0x540010	00000000000000000000000000000000	................
0x540020	08676f312e32362e35ca013077af0c92	.go1.26.5..0w...
0x540030	74080241e1c107e6d618e67061746809	t..A.......path.
0x540040	636f6d6d616e642d6c696e652d617267	command-line-arg
0x540050	756d656e74730a6275696c64092d6275	uments.build.-bu
0x540060	696c646d6f64653d6578650a62	ildmode=exe.b

0x5403b0	00000000000000000000000000000000	................
0x5403c0	00000000000000000000000000000000	................
0x5403d0	00000000000000000000000000000000	................
0x5403e0	0107010101013a0a3b3aff000d0a0500	......:.;:......
0x5403f0	001021000d0a0d0a0800000001000000	..!.............
0x540400	ffffffff010000000100000008000000	................
0x540410	0008000001000000010000000009121b	................
0x540420	00111f3103030403011302137befbdf7	...1........{...
0x540430	de000000000d1a272e0000002d2d2d2d	.......'....----
0x540440	2d000000450345030100	-...E.E...

0x5400e0	776572380af932433186182072008242	wer8..2C1.. r..B
0x5400f0	104116d8f20000000000000000000000	.A..............
0x540100	ff20476f2066697073696e666f20ff00	. Go fipsinfo ..
0x540110	43b3fba75fe68cebe20abd5808f0aff0	C..._......X....
0x540120	e2bc702d34daa238cd0764d7775d3b47	..p-4..8..d.w];G
0x540130	000155000000000090ef230000000000	..U.......#.....
0x540140	f08c280000000000704c3400	..(.....pL4.

0x3360b0	41060000000000004706000000000000	A.......G.......
0x3360c0	49060000000000004d06000000000000	I.......M.......
0x3360d0	53060000000000000000000000000000	S...............
0x3360e0	f1ffffff000004080a18000000000000	................
0x3360f0	a6020000000000000000000000000000	................
0x336100	4800000000000000a8a4040000000000	H...............
0x336110	48e204000000000038e3050000000000	H.......8.......
0x336120	98dc100000000000696e7465726e616c	........internal
0x336130	2f6162692e426f756e64734465636f64	/abi.BoundsDecod
0x336140	6500696e7465726e616c	e.internal

0xf48	00000000000000000000000000000000	................
0xf58	00000000000000000000000000000000	................
0xf68	00000000000000000000000000000000	................
0xf78	040000005300000004000000476f0000	....S.......Go..
0xf88	4b724a52552d70726b37543857653753	KrJRU-prk7T8We7S
0xf98	5a6355302f627565364978486d49776b	ZcU0/bue6IxHmIwk
0xfa8	2d78755936733959702f66446c446938	-xuY6s9Yp/fDlDi8
0xfb8	325571754b7168323239764146432f6f	2UquKqh229vAFC/o
0xfc8	564748666742426d79547a4f6e515154	VGHfgBBmyTzOnQQT
0xfd8	5a735700040000001400000003000000	ZsW.............

Identity

SHA-256	6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986
Filename	6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986.elf
Package	6cae7a11941d4b5993a30bccf786ee39d0051736443df539b7c8cf551d8d4986

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	linux
Domain	abuse.ch

Timeline

First seen	9 Aug 2026 15:41 UTC
First analyzed	10 Aug 2026 08:14 UTC
Last analyzed	10 Aug 2026 15:07 UTC
Last updated	10 Aug 2026 15:07 UTC

Labeling

Label	bad
Label source	harvest
Traits version	73866

Not seeing what you expected? Let us know

0x361f57	4e6577414541440063727970746f2f68	NewAEAD.crypto/h
0x361f67	706b652e41455332353647434d006372	pke.AES256GCM.cr
0x361f77	7970746f2f68706b652e414553313238	ypto/hpke.AES128
0x361f87	47434d0063727970746f2f68706b652e	GCM.crypto/hpke.
0x361f97	4368614368613230506f6c7931333035	ChaCha20Poly1305
0x361fa7	0063727970746f2f68706b652e282a61	.crypto/hpke.(*a
0x361fb7	656164292e49440063727970746f2f68	ead).ID.crypto/h
0x361fc7	706b652e282a61656164292e61656164	pke.(*aead).aead
0x361fd7	0063727970746f2f68706b652e282a61	.crypto/hpke.(*a
0x361fe7	656164292e6b657953697a6500637279	ead).keySize.cry
0x361ff7	70746f2f68706b652e282a6165616429	pto/hpke.(*aead)
0x362007	2e6e6f6e636553697a65006372797074	.nonceSize.crypt
0x362017	6f2f68706b652e6578706f72744f6e6c	o/hpke.exportOnl

0x34e98b	68006f732e4973506174685365706172	h.os.IsPathSepar
0x34e99b	61746f72006f732e282a46696c65292e	ator.os.(*File).
0x34e9ab	6c7374617461744e6f6c6f67006f732e	lstatatNolog.os.
0x34e9bb	486f73746e616d65006f732e686f7374	Hostname.os.host
0x34e9cb	6e616d65006f732e686f73746e616d65	name.os.hostname
0x34e9db	2e64656665727772617031006f732e28	.deferwrap1.os.(
0x34e9eb	2a66696c6553746174292e4e616d6500	*fileStat).Name.
0x34e9fb	6f732e282a66696c6553746174292e49	os.(*fileStat).I
0x34ea0b	73446972006f732e282a66696c655374	sDir.os.(*fileSt
0x34ea1b	6174292e4d6f6465	at).Mode