Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
22-12-2024 18:56
Behavioral task
behavioral1
Sample
loligang.arm7.elf
Resource
debian12-armhf-20240418-en
General
-
Target
loligang.arm7.elf
-
Size
141KB
-
MD5
abde533a1866fb17c76ff1edcf5facd1
-
SHA1
21bd062bb8d518f384ed18ca0f2cef91cffbb5f8
-
SHA256
ce83c30530762a5dc8832ea605a05d7c411c33d63465ce96cc37b7ef02d4223b
-
SHA512
d55f6adfa3dd8b543ed972d6562c8f20cbcb0772f3b7dbc125f2dab9183c92f00feee991f75d85d33add31429f077c64e0d87bda4ab4ef18f159e7e6b116dfec
-
SSDEEP
3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1Qo:walgM69pe0QmlTvI8t9mrsplDKZUQQBt
Malware Config
Signatures
-
Contacts a large (20107) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog loligang.arm7.elf File opened for modification /dev/misc/watchdog loligang.arm7.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp loligang.arm7.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp loligang.arm7.elf -
description ioc Process File opened for reading /proc/362/fd loligang.arm7.elf File opened for reading /proc/717/exe loligang.arm7.elf File opened for reading /proc/681/exe loligang.arm7.elf File opened for reading /proc/711/exe loligang.arm7.elf File opened for reading /proc/724/exe loligang.arm7.elf File opened for reading /proc/1/fd loligang.arm7.elf File opened for reading /proc/249/fd loligang.arm7.elf File opened for reading /proc/309/fd loligang.arm7.elf File opened for reading /proc/344/fd loligang.arm7.elf File opened for reading /proc/761/exe loligang.arm7.elf File opened for reading /proc/221/fd loligang.arm7.elf File opened for reading /proc/327/fd loligang.arm7.elf File opened for reading /proc/346/fd loligang.arm7.elf File opened for reading /proc/647/exe loligang.arm7.elf File opened for reading /proc/663/exe loligang.arm7.elf File opened for reading /proc/703/exe loligang.arm7.elf File opened for reading /proc/319/fd loligang.arm7.elf File opened for reading /proc/317/fd loligang.arm7.elf File opened for reading /proc/324/fd loligang.arm7.elf File opened for reading /proc/341/fd loligang.arm7.elf File opened for reading /proc/630/exe loligang.arm7.elf File opened for reading /proc/720/exe loligang.arm7.elf File opened for reading /proc/648/exe loligang.arm7.elf File opened for reading /proc/664/exe loligang.arm7.elf File opened for reading /proc/188/fd loligang.arm7.elf File opened for reading /proc/712/exe loligang.arm7.elf
Processes
Network
-
Requestdebian12-armhf-20240418-en-3IN AAAAResponse
-
Requestdebian12-armhf-20240418-en-3IN AResponse
-
Requestdebian12-armhf-20240418-en-3IN AAAAResponse
-
Requestdebian12-armhf-20240418-en-3IN AResponse
-
851 B 690 B 16 13
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
80 B 44 B 2 1
-
40 B 1
-
40 B 40 B 1 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 40 B 1 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 40 B 1 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 40 B 1 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
420 B 44 B 10 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 40 B 1 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 40 B 1 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 40 B 1 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1
-
40 B 1