Analysis
-
max time kernel
149s -
max time network
162s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
18-12-2024 16:51
Behavioral task
behavioral1
Sample
loligang.arm7.elf
Resource
debian12-armhf-20240221-en
General
-
Target
loligang.arm7.elf
-
Size
152KB
-
MD5
9cd4922472ca9d4c51932f13166e335e
-
SHA1
c582c682f2f6f70e0101bfe6e2287d42a0599082
-
SHA256
fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1
-
SHA512
73ce8947b7a777d1b1f10d47b7575d4890d7ddfbd259cdf3fd785d778cdfe2e1d89c284742cbd1acd499a982f9ef1d5e9588e99cd8be42f495a2a517d4550072
-
SSDEEP
3072:ye9bqia5r9J5o9yhpZPH+9mrsplDKZU2QBKXAVanxX+F8JyvIT+hLBA4emlEBDzc:ye9bqia5r97o9yhpZv+9mrsplDKZU2QB
Malware Config
Signatures
-
Contacts a large (20071) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog loligang.arm7.elf File opened for modification /dev/misc/watchdog loligang.arm7.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp loligang.arm7.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp loligang.arm7.elf -
description ioc Process File opened for reading /proc/212/fd loligang.arm7.elf File opened for reading /proc/275/fd loligang.arm7.elf File opened for reading /proc/714/exe loligang.arm7.elf File opened for reading /proc/645/exe loligang.arm7.elf File opened for reading /proc/661/exe loligang.arm7.elf File opened for reading /proc/743/exe loligang.arm7.elf File opened for reading /proc/1/fd loligang.arm7.elf File opened for reading /proc/344/fd loligang.arm7.elf File opened for reading /proc/345/fd loligang.arm7.elf File opened for reading /proc/353/fd loligang.arm7.elf File opened for reading /proc/362/fd loligang.arm7.elf File opened for reading /proc/697/exe loligang.arm7.elf File opened for reading /proc/719/exe loligang.arm7.elf File opened for reading /proc/188/fd loligang.arm7.elf File opened for reading /proc/298/fd loligang.arm7.elf File opened for reading /proc/325/fd loligang.arm7.elf File opened for reading /proc/340/fd loligang.arm7.elf File opened for reading /proc/630/exe loligang.arm7.elf File opened for reading /proc/711/exe loligang.arm7.elf File opened for reading /proc/646/exe loligang.arm7.elf File opened for reading /proc/677/exe loligang.arm7.elf File opened for reading /proc/324/fd loligang.arm7.elf File opened for reading /proc/350/fd loligang.arm7.elf File opened for reading /proc/664/exe loligang.arm7.elf File opened for reading /proc/703/exe loligang.arm7.elf File opened for reading /proc/704/exe loligang.arm7.elf