Extracted

• • Target

    sora.x86.elf

  • Size

    29KB

  • MD5

    ebb6a793b734426bdd0a3805ef76eff9

  • SHA1

    15d9c1c2b1556f531a88091205e8e30b872671eb

  • SHA256

    7ca046612cecee59f9bb6507019654f83f005da31711a7e2813d37c848ba1372

  • SHA512

    ffa07f96d6b79192d903e296eb3b9e9ee04006ec0e49f299c38416f1435bdf0761b3e4eea0c1739f5642f980831dc9fa1fe9f21ccb551514ece3803bf2356a74

  • SSDEEP

    768:gIhuJ2klwC/4P8qhZABQ3L5FRgRnn8dVWZd2nbcuyD7UHQRjt:1MR4PZ75FRg1MVcd2nouy8Hy5

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20335) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1