Extracted

• • Target
    loligang.x86.elf
  • Size 92KB
  • SHA256 ec950e86b959036af5146e5d39a83af61ba1e52e1ab3e604b1c3865bc11b6281
  • MD5 0baf3e234b3c22c328996fe3c733b7fc
  • SHA1 6e720379bacfa08566ed904c9b392c8566fa3172
  • SHA512 b9287e98b40641bd62c1734270289f7377564d7e522edb972ca05dfbfa9533a4fd06e4e718992dee0fe7c38a6feea99429960e0e74c4317fc1dfba2ae8f9be46
  • SSDEEP 1536:4P1itFoIQOqmYK8GYNElMUcvYLerATlra0DlglrmkLpPN2ZXe5SdAZmnrQ6bXMPH:y1wFoIQOqmYK8GYNElMVrrslrnD8rtNv
  • TLSH
    T1AD937CC5E6A3D8F5EC4205B46137FB369A72E53E711DDAC3C3986A3AAC01603C5172AD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (24378) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1