Analysis
-
max time kernel
6s -
max time network
133s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
-
submitted
10-04-2024 18:46
General
-
Target
sora.x86
-
Size
24KB
-
MD5
fad75956d7884a937c2c0ddc4d177ffc
-
SHA1
4615c2f330ee57ae005b29932c32d90e2debff1d
-
SHA256
754109c1e57f8afae30f696d3ac6547d9df6341f6250b9b6d1e0cca0b0e25ee6
-
SHA512
0b979e230aceeeb5441493a0b87524a6a791d5d5ec9bb867d47375392fd36f74323a8913be3d858718fe23014c3296a6ef4f037e79fe948ac871109add2cac7f
-
SSDEEP
384:MXYwdbjcsRFyzxCbxn6NNW3JDTxMOTJ3vOwAU+5p5WfQbCTEokupXG+Qr1GvtIqY:IYIbosXwYU2ZHhlcUK5bbqTXTlK
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Changes its process name 1 IoCs
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/sora.x86/tmp/sora.x861⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality