Extracted

• • Target
    loligang.arm7.elf
  • Size 186KB
  • SHA256 432201b64bbacd813e939e81943e9e4d92a606840c2099a0bdcc50698558ffde
  • MD5 f9d4b979c82181a3ff768395a6d9f302
  • SHA1 e7e67288458ddc6cbcf0f558cc17169c8b64ad11
  • SHA512 a60e2e69fccc30c9f2738ed3a5ef3635254e5f5234b4ee3144784fb041de4c3da99aafe4563adc0da1131f0785875bcba3fd3dff7d845b466d6a83e6f826ed82
  • SSDEEP 3072:o0ieQOav79mrsplDKZUlQBKXAVan/X+F8Jyv495UZLwcayCKc4A0IuNQ4YJdai8J:o0Ibj9mrsplDKZUlQBKXAVan/X+F8JyB
  • TLSH
    T1F7146D46DA808E13C0D6177AB6EF424933229764E3DB73069D18AFB43F8679E0E77605
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (24104) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1