Analysis
-
max time kernel
149s -
max time network
157s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
-
submitted
30/11/2024, 15:32
General
-
Target
loligang.arm7.elf
-
Size
152KB
-
MD5
9346d48a2087a7517c40511fc0ea6106
-
SHA1
d53290bbf5f11c003a34e3cd2bc0378d45bde65e
-
SHA256
e2a08e2aa88311e4d1dc0db4b1f0516bfc2ca66b93d6f3d2ae7d7117d957656d
-
SHA512
d79f05d984746d50b00c96acf77638e322e9c1352ce71e9038191f715bb22bb9ff898c6d66525cc10ea6fa3d9cd4d4561ef91b944dda0b39a5efe3febb758917
-
SSDEEP
3072:ye9bqia5r9J5o9yhpZPH+9mrsplDKZU2QBKXAVanxX+F8JyvIT+hLBA4emlEBDzA:ye9bqia5r97o9yhpZv+9mrsplDKZU2Q1
Malware Config
Signatures
-
Contacts a large (20471) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 26 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/loligang.arm7.elf/tmp/loligang.arm7.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information