Overview

overview

10

Static

static

7

sora.arm.elf

debian-9-armhf

10

Analysis

  • max time kernel
    1s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231221-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231221-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/02/2024, 09:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    sora.arm.elf

  • Size

    27KB

  • MD5

    b466441da7b6448f8d2506d34e68527f

  • SHA1

    66e1f711d2bdeddf2d90165b824347d78887d560

  • SHA256

    b5d60e3c961affe8287f4fd9b6ec40626141562f9c26b52633204886c55e1903

  • SHA512

    c79c87ca62922d8ed94bb3952f32188952f76d7293fb81531131df58af8f0f34566d4cff97e932e8991aecf83e3b5004a3570dd4b677b66d2465772fe51a6d79

  • SSDEEP

    768:9ZqbD9poewFRgjRm6O7NxKnSXQnUxFs3UozJ:9s/9KgV+jDXQUqzJ

Score
10/10
miraisorabotnet

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/sora.arm.elf
    /tmp/sora.arm.elf
    1⤵
    • Reads runtime system information
    PID:660

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads