Overview

overview

10

Static

static

7

sora.arm7.elf

debian-9-armhf

10

Analysis

  • max time kernel
    1s
  • max time network
    124s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    30-04-2023 19:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sora.arm7.elf

  • Size

    51KB

  • MD5

    3758a1b73e6149c81c831526f2a8c08f

  • SHA1

    55c228398087ed133d123e4c75820c773d90a1ac

  • SHA256

    96af74ab3021985949fe2ebbfaab0775a62b8af4d09dd8ca7192c17ea6fb6959

  • SHA512

    b6b32bc0ff6c150a257b2d2932625a7ea7c87da2ae01f21050f6d3053566b4f65368e5695b9a3916d2121b7d4d4c345c59344da09286f220c199bf06621149be

  • SSDEEP

    1536:99O/ZMAXIxNUk0b8LcPqF1aBexo4opKZb1:99O/ZNKysLGqFUFg

Score
10/10
miraisorabotnet

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/sora.arm7.elf
    /tmp/sora.arm7.elf
    1⤵
    • Reads runtime system information
    PID:355

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/355-1-0x00008000-0x00029794-memory.dmp

    Download