Analysis
-
max time kernel
150s -
max time network
157s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
-
submitted
29/11/2024, 08:12
General
-
Target
loligang.arm7.elf
-
Size
149KB
-
MD5
d5e16e09fde247ca4e5d1293c9538344
-
SHA1
1b271aec24341fc214f6900464281085dfe48f05
-
SHA256
999c9ae643c717d55d2cfd2b58eb18c340970edfd258d547f4a38b10e30b0520
-
SHA512
a0b96fafaac02f42dc6d934ef353f845782ae76c8846de68421bf017377d8ffeebc390c5b3220451b1958d0a4b861f7c8a594451fabc3df3ff28246e6dba6d6b
-
SSDEEP
3072:I4xAllnxjMdDpOFT2wxU9mrsplDKZU+QBKXAVan2X+F8JyvEQhLEA0UUjaBjKEoU:I4xAllnxjM1pOFT2UU9mrsplDKZU+QBW
Malware Config
Signatures
-
Contacts a large (20125) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 26 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/loligang.arm7.elf/tmp/loligang.arm7.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information