Extracted

• • Target

    loligang.arm7.elf

  • Size

    152KB

  • MD5

    9346d48a2087a7517c40511fc0ea6106

  • SHA1

    d53290bbf5f11c003a34e3cd2bc0378d45bde65e

  • SHA256

    e2a08e2aa88311e4d1dc0db4b1f0516bfc2ca66b93d6f3d2ae7d7117d957656d

  • SHA512

    d79f05d984746d50b00c96acf77638e322e9c1352ce71e9038191f715bb22bb9ff898c6d66525cc10ea6fa3d9cd4d4561ef91b944dda0b39a5efe3febb758917

  • SSDEEP

    3072:ye9bqia5r9J5o9yhpZPH+9mrsplDKZU2QBKXAVanxX+F8JyvIT+hLBA4emlEBDzA:ye9bqia5r97o9yhpZv+9mrsplDKZU2Q1

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20471) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1