Analysis
-
max time kernel
148s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
12-12-2024 18:30
Behavioral task
behavioral1
Sample
loligang.mips.elf
Resource
debian9-mipsbe-20240729-en
General
-
Target
loligang.mips.elf
-
Size
87KB
-
MD5
e15a5300a166fd96e51bf7da8e7a08ab
-
SHA1
0bf3ef103d49998caa3231334738222279832eb6
-
SHA256
5172dcf51fd501712a0b89b9ff4e63ede41754c63926a9ae6475f0a4763d0536
-
SHA512
82dd706f79283bdf4bdb627a66c0de33b09d59574bb4c78a6680ba183a5e7800a9a3ef02cafc4f9f243dc4f5bd2df5cf6faddc921cb96fe132277bfb5ad514a6
-
SSDEEP
1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOj3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/DM
Malware Config
Signatures
-
Contacts a large (20389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog loligang.mips.elf File opened for modification /dev/misc/watchdog loligang.mips.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp loligang.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp loligang.mips.elf -
description ioc Process File opened for reading /proc/434/exe loligang.mips.elf File opened for reading /proc/713/exe loligang.mips.elf File opened for reading /proc/724/exe loligang.mips.elf File opened for reading /proc/733/exe loligang.mips.elf File opened for reading /proc/783/exe loligang.mips.elf File opened for reading /proc/386/fd loligang.mips.elf File opened for reading /proc/723/fd loligang.mips.elf File opened for reading /proc/716/exe loligang.mips.elf File opened for reading /proc/712/exe loligang.mips.elf File opened for reading /proc/1/fd loligang.mips.elf File opened for reading /proc/353/fd loligang.mips.elf File opened for reading /proc/380/fd loligang.mips.elf File opened for reading /proc/718/fd loligang.mips.elf File opened for reading /proc/722/fd loligang.mips.elf File opened for reading /proc/673/exe loligang.mips.elf File opened for reading /proc/354/fd loligang.mips.elf File opened for reading /proc/357/fd loligang.mips.elf File opened for reading /proc/675/fd loligang.mips.elf File opened for reading /proc/679/fd loligang.mips.elf File opened for reading /proc/708/fd loligang.mips.elf File opened for reading /proc/710/fd loligang.mips.elf File opened for reading /proc/679/exe loligang.mips.elf File opened for reading /proc/714/exe loligang.mips.elf File opened for reading /proc/155/fd loligang.mips.elf File opened for reading /proc/327/fd loligang.mips.elf File opened for reading /proc/707/fd loligang.mips.elf File opened for reading /proc/795/exe loligang.mips.elf File opened for reading /proc/356/fd loligang.mips.elf File opened for reading /proc/719/fd loligang.mips.elf File opened for reading /proc/721/fd loligang.mips.elf File opened for reading /proc/678/exe loligang.mips.elf File opened for reading /proc/707/exe loligang.mips.elf File opened for reading /proc/787/exe loligang.mips.elf File opened for reading /proc/176/fd loligang.mips.elf File opened for reading /proc/240/fd loligang.mips.elf File opened for reading /proc/716/fd loligang.mips.elf File opened for reading /proc/719/exe loligang.mips.elf File opened for reading /proc/693/exe loligang.mips.elf File opened for reading /proc/379/fd loligang.mips.elf File opened for reading /proc/434/fd loligang.mips.elf File opened for reading /proc/673/fd loligang.mips.elf File opened for reading /proc/678/fd loligang.mips.elf File opened for reading /proc/693/fd loligang.mips.elf File opened for reading /proc/675/exe loligang.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 715 loligang.mips.elf