Extracted

• • Target

    sora.x86

  • Size

    24KB

  • MD5

    fad75956d7884a937c2c0ddc4d177ffc

  • SHA1

    4615c2f330ee57ae005b29932c32d90e2debff1d

  • SHA256

    754109c1e57f8afae30f696d3ac6547d9df6341f6250b9b6d1e0cca0b0e25ee6

  • SHA512

    0b979e230aceeeb5441493a0b87524a6a791d5d5ec9bb867d47375392fd36f74323a8913be3d858718fe23014c3296a6ef4f037e79fe948ac871109add2cac7f

  • SSDEEP

    384:MXYwdbjcsRFyzxCbxn6NNW3JDTxMOTJ3vOwAU+5p5WfQbCTEokupXG+Qr1GvtIqY:IYIbosXwYU2ZHhlcUK5bbqTXTlK

  Score

  10^/10

  miraimiraibotnet

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Changes its process name

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1