Analysis
-
max time kernel
14170s -
max time network
159s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
submitted
21-05-2022 17:01
Static task
static1
Behavioral task
behavioral1
Sample
sora.arm7
Resource
debian9-armhf-en-20211208
General
-
Target
sora.arm7
-
Size
125KB
-
MD5
0894461ed1f97041c224c7c1796b46ed
-
SHA1
fad16925e72dd73ba55a302a2587af5fcd8bfeba
-
SHA256
94dfb506b7cdb1a387b65c72d76f263457f6cae79d71b4b4fe08b69e45a7a1ea
-
SHA512
8b3d1da710076d681dfaf13b7373e835ea9fe9f231ae817487135171426211ca7e18ed632b0c38271dfde022a9f229f4583a87163b7ca65c951e66546c6087d3
Malware Config
Signatures
-
Contacts a large (138936) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/162/fd /proc/162/fd /proc/233/fd /proc/233/fd /proc/234/fd /proc/234/fd /proc/276/fd /proc/276/fd /proc/1/fd /proc/1/fd /proc/244/fd /proc/244/fd /proc/282/fd /proc/282/fd /proc/355/exe /proc/355/exe /proc/ /proc/ /proc/137/fd /proc/137/fd /proc/231/fd /proc/231/fd /proc/373{1,1T /proc/373{1,1T /proc/352/exe /proc/352/exe /proc/272/fd /proc/272/fd /proc/275/fd /proc/275/fd /proc/218/fd /proc/218/fd