Sample : c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df01afa96c0

Summary


OS ABI

UNIX - System V
CPU class

32 bit
Persistence (user)

Yes
Persistence (root)

Yes
CPU byte order

2's complement MSB
File type

ELF 32-bit MSB executable, MIPS, MIPS-II version 1, statically linked, for GNU/Linux 2.6.26, BuildID[sha1]=066c8d17c7a7ca2bf6932054e99f2f89f2ffb01f, not stripped
CPU type

MIPS I
Entropy

6.02963661849
Syscalls executed (root)

38145
Syscalls executed (user)

63818
ELF type

Executable file

ELF


Class

32 bit
Data encoding

2's complement MSB
Operating system ABI

UNIX - System V
Object file type

Executable file
ELF version

0.1
Machine

MIPS I
Link

static
Entrypoint

0x4005f0
Number of segments

7
Number of sections

36
Program header table offset

52
Section header table offset

2238160
Program header table - size of entry

32
Section header table - size of entry

40
Program header table - entries

7
Section header table - entries

36
Section header table - index sections names

33
Stripped

False
Sections stripped

False
Anomalies


Segments
W^X permission : PT_GNU_STACK at offset 0x0
Memory size doubles physical size : PT_TLS at offset 0x1f3764


Sections
Uncommon sections : __libc_thread_subfreeres
__libc_freeres_fn
__libc_subfreeres
.tbss
.tdata
__libc_freeres_ptrs
.reginfo
.sbss
section without a name
.gnu.attributes
.pdr
__libc_atexit
.mdebug.abi32
.sdata
__libc_thread_freeres_fn


Debug information

False
Comment

GCC: (Debian 4.4.7-2) 4.4.7

GCC: (Debian 4.6.3-7) 4.6.3

GCC: (Debian 4.6.3-14) 4.6.3

Note

GNU : '\x06l\x8d\x17\xc7\xa7\xca+\xf6\x93 T\xe9\x9f/\x89\xf2\xff\xb0'

Hash


MD5

53e8ebded835bd3c79e1447b0d9ee2cd
SHA1

3a99f7816c6864fd36ceea3380e591d337b0b241
SHA256

c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df01afa96c0
SHA512

0bf66b9bc00bf9d0ac7b0d7c3a6a30b6ea65f7033d273bf1be5d976680c09a4175272f4cc31f86249e83789f95daaf21acf2ca5e3c9db10345dde84e1764fc5e
ssdeep

49152:rJ96G39g2nwYw3go52dq6BSsCMSPUjVBdToiDwMYeImqzSQZ:dFbdqGSjYSic7DTzSQZ

Bytes


Entropy

6.02963661849
Min entropy (16KB blocks)

1.42499216259
Max entropy (16KB blocks)

7.87174594777
Unique bytes (0-255)

256
Null bytes

641176
White spaces

114046
Printable bytes

730820
First 16B

7f 45 4c 46 01 02 01 00 01 00 00 00 00 00 00 00
Last 16B

5f 50 41 52 41 4d 5f 73 65 74 5f 74 69 6d 65 00
Longest same bytes sequence

Byte : 0x0

Offset : 0x1f3e3a

Length : 3860

Three rarest bytes

0x9b - 766 times

0x7b - 716 times

0xbb - 713 times

Three most common bytes

0x0 - 641176 times

0x20 - 72396 times

0x8f - 61699 times

File type


Mime type

application/x-executable
File type

ELF 32-bit MSB executable, MIPS, MIPS-II version 1, statically linked, for GNU/Linux 2.6.26, BuildID[sha1]=066c8d17c7a7ca2bf6932054e99f2f89f2ffb01f, not stripped

VirusTotal


URL

https://www.virustotal.com/#/file/c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df01afa96c0
Positive

15
Total AVs

55
Scan date

2015-10-28 07:53:18
AVClass

tsunami
Detection

GData : Linux.Trojan.Agent.EBKNCV

Tencent : Linux.Backdoor.Tsunami.Sxeu

DrWeb : Linux.BackDoor.Tsunami.150

Symantec : Linux.Backdoor.Kaiten

Jiangmin : Backdoor/Linux.ue

Kaspersky : HEUR:Backdoor.Linux.Tsunami.bj

Avast : ELF:Tsunami-CA [Trj]

Ikarus : Trojan.Linux.Agent

AhnLab-V3 : Linux/Tsunami.2491266

NANO-Antivirus : Trojan.Tsunami.dxppoq

Sophos : Linux/Tsunami-A

ESET-NOD32 : Linux/Agent.CP

AVG : Linux/Tsunami.CP

Microsoft : Backdoor:Linux/Tsunami.gen!A

Rising : ELF:Backdoor.Tsunami!1.A1B2 [F]

Data Explore


Paths

/var/run/.boss.pid

/dev/shm/

/dev/shm

/var/tmp/

/var/tmp

/var/lock/

/var/lock

/bin/crontab

/usr/bin/crontab

/proc/self/exe

/dev/null

/dev/null

/dev/null

/var/run/bbsh;

/dev/null

/bin/sh

/dev/null

/dev/null

/dev/null

/dev/null

/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin

/proc/version`

/usr/bin:/usr/local/bin:/usr/sbin;%s

/etc/rc.local

/etc/rc.conf

~/.ssh

/etc/ssh/ssh_config

/bin/sh

/usr/lib/mips-linux-gnu/openssl-1.0.0/engines

/dev/urandom

/dev/random

/dev/srandom

/var/run/egd-pool

/dev/egd-pool

/etc/egd-pool

/etc/entropy

/usr/lib/ssl/private

/usr/lib/ssl

/usr/lib/ssl/certs

/usr/lib/ssl/cert.pem

/dev/tty

/dev/null

/dev/full

/proc/self/maps

/etc/localtime

/usr/share/zoneinfo

/proc/sys/kernel/ngroups_max

/proc/sys/kernel/rtsig-max

/etc/gai.conf

/dev/log

/dev/console

/proc/meminfo

/proc/stat

/proc/cpuinfo

/sys/devices/system/cpu

/etc/host.conf

/etc/resolv.conf

/etc/nsswitch.conf

/var/run/nscd/socket

/lib/mips-linux-gnu/

/usr/lib/mips-linux-gnu/

/lib/

/usr/lib/

/etc/ld.so.cache

/etc/ld.so.nohwcap

/proc/self/exe

/var/tmp

/var/profile

/etc/suid-debug

/proc/sys/kernel/osrelease

/usr/lib/mips-linux-gnu/gconv

/usr/lib/mips-linux-gnu/gconv/gconv-modules.cache

/usr/lib/locale

/usr/lib/locale/locale-archive

/usr/share/locale

/proc/net

/proc/

URLs

http://104.199.135.124/wgsh

http://www.openssl.org/support/faq

http://www.debian.org/Bugs/

IPs (v4 and v6)

d::

::

::

::

::

Code Explore


Nucleus

Eh_frame

Number of functions : 261

Total size functions [B] : 222984

Average size a function [B] : 854.344827586

Percentage of covered .text section : 13.072045623

Percentage of covered LOAD segment : 10.7882259594

Sandbox (user)


Standard output

Standard error

Sandbox (root)


Standard output

Standard error

Behavior


User behavior

Syscalls


Unique
rename
lseek
rt_sigaction
mprotect
uname
brk
connect
llseek
close
flock
poll
open
getgid
write
exit_group
recvfrom
rt_sigprocmask
lstat
umask
send
access
fchmod
getpid
getrlimit
munmap
fstat
fcntl
stat
dup2
read
getcwd
clone
setresgid
getppid
statfs64
set_robust_list
ioctl
readlink
waitpid
execve
utime
wait4
chdir
getuid
socket
fsync
fstatat
set_tid_address
gettimeofday
futex
mmap2
setresuid
time
unlinkat
getegid
geteuid


Unique number
56

Total number
63818

Instrumented libc calls


Unique
strchr
strcmp
memchr
memcmp


Unique number
4

Total number
1048

If uid is checked

True

If gid is checked

True

Permission related errors

True

Type of permission related error


EACCES
True

Number of processes

15

Trace lines lost

0

Persistence


Create
/etc/rc.local


Modify
crontabs/tmp.IkCkmv


Dropped files


Create
/dev/null
/var/lock/.x001804289383


Modify
/var/lock/.boss.pid


Files being read

/opt/glibc/share/locale/locale.alias

/lib/mips-linux-gnu/libselinux.so.1

/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION

/lib/mips-linux-gnu/libdl.so.2

/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION

/proc/filesystems

/opt/glibc/lib/ld.so.1

/etc/rc.local

/opt/glibc/lib/tls/libc.so.6

/etc/passwd

/opt/glibc/lib/libc.so.6

/opt/glibc/lib/libnss_dns.so.2

/lib/mips-linux-gnu/libpcre.so.3

/etc/localtime

/lib/mips-linux-gnu/libnss_compat.so.2

/opt/glibc/lib/libresolv.so.2

/lib/mips-linux-gnu/libnsl.so.1

/opt/glibc/lib/libdl.so.2

/opt/glibc/lib/libpthread.so.0

/opt/glibc/lib/locale/en/LC_IDENTIFICATION

/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION

/lib/mips-linux-gnu/libpthread.so.0

/lib/mips-linux-gnu/libaudit.so.1

/etc/ld.so.cache

/bin/crontab

/proc/self/exe

/lib/mips-linux-gnu/libnss_files.so.2

/etc/resolv.conf

x77580bc

/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION

/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION

/opt/glibc/lib/tls/libpcre.so.3

/opt/glibc/lib/locale/locale-archive

/etc/host.conf

/usr/lib/locale/locale-archive

/etc/hosts

/lib/mips-linux-gnu/libnss_nis.so.2

/var/lock/.x001804289383

/etc/cron.deny

/etc/cron.allow

/lib/mips-linux-gnu/libc.so.6

/usr/bin/crontab

crontabs/box

/etc/nsswitch.conf

/opt/glibc/lib/libnss_files.so.2

/opt/glibc/lib/libpcre.so.3

/lib/mips-linux-gnu/libpam.so.0

Max sleep

-1.0

System cmds

crontab -l

rm -rf /var/lock/.x001804289383

grep -v /tmp/c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df01afa96c0

grep -v update

crontab /var/lock/.x001804289383

grep -v lesshts/run.sh

grep -v no cron

grep -v hwclockd

Ioctls


Total
4031

Success
0x467f


Fail
TIOCNXCL


Unlink files

/var/lock/.x001804289383

String or memory comparison

"grep", "messages"

"rm", "until"

"crontab", "elif"

"echo", "elif"

"lesshts/run", ""

"/usr/share/locale", "/opt/glibc/share/locale"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFI...

"echo", "echo"

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICA...

"grep", "continue"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENT...

"UTF-8", "utf8"

"/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFIC...

"rm", "return"

"grep", "getopts"

"crontab", "case"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"grep", "hash"

"echo", "continue"

"en_US.UTF-8", "C"

"crontab", "crontab"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICAT...

"rm", "set"

"\201/tmp\201/c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df01afa96c0\210", "\202\001@=\210...

"grep", "if"

"rm", "in"

"grep", "jobs"

"rm", "for"

"grep", "in"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENT...

"en_US.UTF-8", "POSIX"

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION"

"echo", "done"

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"no cron\210", "\202\001@=\210", 5

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFICATION...

"update\210", "\202\001@=\210", 5

"/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION...

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_...

"crontab", "do"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATI...

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION...

"grep", "until"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICAT...

"crontab", "for"

"", 0x77d7cd84

"\201* \201* \201* \201* \201* \201/tmp\201/c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df0...

"rm", "test"

"/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION...

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US/LC_IDENTIFICATIO...

"echo", "exec"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTI...

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICAT...

"grep", "for"

"echo", "export"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTI...

"", 0x77c6bd84

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFICAT...

"coreutils", "messages"

"", 0x7731dd84

"echo", "do"

"crontab", "export"

"echo", "jobs"

"/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION"

"echo", "eval"

"grep", "grep"

"lesshts\201/run.sh\210", "\202\001@=\210", 5

"", 0x772e5d84

"/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFI...

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"grep", "export"

"crontab", "eval"

"crontab", "jobs"

"crontab", "exec"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US.UTF-8/LC_ID...

"crontab", "echo"

"rm", "then"

"rm", "read"

"rm", "jobs"

"crontab", "continue"

"echo", "for"

"/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATIO...

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION"

"hwclockd\210", "\202\001@=\210", 5



Root behavior

Syscalls


Unique
rename
lseek
rt_sigaction
mprotect
uname
brk
connect
llseek
close
flock
poll
open
getgid
write
exit_group
recvfrom
rt_sigprocmask
lstat
umask
send
access
fchmod
getpid
getrlimit
munmap
fstat
fcntl
stat
getcwd
dup2
read
commit_creds
clone
setresgid
getppid
statfs64
set_robust_list
ioctl
readlink
waitpid
execve
utime
wait4
chdir
getuid
socket
fsync
fstatat
set_tid_address
gettimeofday
futex
mmap2
setresuid
time
unlinkat
getegid
geteuid


Unique number
57

Total number
38145

Instrumented libc calls


Unique
strchr
strcmp
memchr
memcmp


Unique number
4

Total number
1072

Number of processes

15

Trace lines lost

0

Persistence


Create
/etc/rc.local


Modify
crontabs/tmp.mM5SMt


Dropped files


Create
/dev/null
/var/lock/.x001804289383


Modify
/var/run/.boss.pid


Files being read

/opt/glibc/share/locale/locale.alias

/lib/mips-linux-gnu/libselinux.so.1

/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION

/lib/mips-linux-gnu/libdl.so.2

/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION

/proc/filesystems

/opt/glibc/lib/ld.so.1

/etc/rc.local

/opt/glibc/lib/tls/libc.so.6

/etc/passwd

/opt/glibc/lib/libc.so.6

/opt/glibc/lib/libnss_dns.so.2

/lib/mips-linux-gnu/libpcre.so.3

/etc/localtime

/lib/mips-linux-gnu/libnss_compat.so.2

/opt/glibc/lib/libresolv.so.2

/lib/mips-linux-gnu/libnsl.so.1

/opt/glibc/lib/libdl.so.2

/opt/glibc/lib/libpthread.so.0

/opt/glibc/lib/locale/en/LC_IDENTIFICATION

/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION

/lib/mips-linux-gnu/libpthread.so.0

/lib/mips-linux-gnu/libaudit.so.1

/etc/ld.so.cache

/bin/crontab

/proc/self/exe

/lib/mips-linux-gnu/libnss_files.so.2

/etc/resolv.conf

/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION

/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION

/opt/glibc/lib/tls/libpcre.so.3

/opt/glibc/lib/locale/locale-archive

/etc/host.conf

/usr/lib/locale/locale-archive

/etc/hosts

/lib/mips-linux-gnu/libnss_nis.so.2

/var/lock/.x001804289383

/lib/mips-linux-gnu/libc.so.6

/usr/bin/crontab

/etc/nsswitch.conf

/opt/glibc/lib/libnss_files.so.2

crontabs/root

/opt/glibc/lib/libpcre.so.3

/lib/mips-linux-gnu/libpam.so.0

Max sleep

-1.0

Ioctls


Total
2373

Success
0x467f


Fail
TIOCNXCL


Unlink files

/var/lock/.x001804289383

String or memory comparison

"grep", "messages"

"rm", "until"

"crontab", "elif"

"echo", "elif"

"/usr/share/locale", "/opt/glibc/share/locale"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFI...

"echo", "echo"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICA...

"grep", "continue"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENT...

"UTF-8", "utf8"

"/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFIC...

"rm", "return"

"grep", "getopts"

"crontab", "case"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"grep", "hash"

"echo", "continue"

"en_US.UTF-8", "C"

"crontab", "crontab"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICAT...

"rm", "set"

"\201/tmp\201/c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df01afa96c0\210", "\202\001@=\210...

"", 0x775d7d84

"grep", "if"

"rm", "in"

"grep", "jobs"

"rm", "for"

"grep", "in"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENT...

"en_US.UTF-8", "POSIX"

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION"

"echo", "done"

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"no cron\210", "\202\001@=\210", 5

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFICATION...

"rm", "then"

"update\210", "\202\001@=\210", 5

"/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION...

"", 0x77916d84

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_...

"crontab", "do"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATI...

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION...

"grep", "until"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICAT...

"crontab", "for"

"\201* \201* \201* \201* \201* \201/tmp\201/c25bb69b073d2449da63d0c5bb9f344e77bf164dbaaa9acc67ba5df0...

"rm", "test"

"/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION...

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US/LC_IDENTIFICATIO...

"echo", "exec"

"/opt/glibc/lib/locale/en_US.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTI...

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICAT...

"grep", "for"

"echo", "export"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTI...

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFICAT...

"", 0x77394d84

"coreutils", "messages"

"echo", "do"

"", 0x77667d84

"crontab", "export"

"echo", "jobs"

"/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION"

"echo", "eval"

"", 0x77cb9d84

"grep", "grep"

"lesshts\201/run.sh\210", "\202\001@=\210", 5

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.utf8/LC_IDENTIFICATION"

"/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8.utf8/LC_IDENTIFI...

"/opt/glibc/lib/locale/en_US.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en/LC_IDENTIFICATION"

"grep", "export"

"crontab", "eval"

"crontab", "jobs"

"crontab", "exec"

"/opt/glibc/lib/locale/en_US.UTF-8.utf8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en_US.UTF-8/LC_ID...

"crontab", "echo"

"update", "update"

"rm", "read"

"rm", "jobs"

"crontab", "continue"

"echo", "for"

"/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATIO...

"/opt/glibc/lib/locale/en_US/LC_IDENTIFICATION", "/opt/glibc/lib/locale/en.UTF-8/LC_IDENTIFICATION"

"hwclockd\210", "\202\001@=\210", 5