Analysis
-
max time kernel
30s -
max time network
33s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240226-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
16-04-2024 23:50
General
-
Target
sora (2).mips
-
Size
28KB
-
MD5
b0444754143459607a045828a67e33c7
-
SHA1
05db402433355d47c7f066c0d93a91bc4c0d714e
-
SHA256
364f7fe3057b53003ddab6d8c62521742056da6e82136122a4b90b0e2149e1bb
-
SHA512
74bcaa66280699be37dae3e09add215f93da282276990ce33c76d4e4f49219dad11b92c0e34198f4225733cc75bdc92bbbba2a4108cbc868e8d4edb7fd4982de
-
SSDEEP
768:E4ylAtv6pqLJM0RXaxGyUbXtheU/Sf9IJgGlzDpbuR1JE:XMBqTRXa+Zhr/RVJuG
Malware Config
Extracted
mirai
SORA
Signatures
-
Contacts a large (10565) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
Processes:
sora (2).mipsdescription ioc pid process Changes the process name, possibly in an attempt to hide itself cajh0i11jbd1i3db2oo 697 sora (2).mips -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 14 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/1/fd File opened for reading /proc/324/fd File opened for reading /proc/327/fd File opened for reading /proc/330/fd File opened for reading /proc/385/fd File opened for reading /proc/698/exe File opened for reading /proc/235/fd File opened for reading /proc/374/fd File opened for reading /proc/701/exe File opened for reading /proc/141/fd File opened for reading /proc/325/fd File opened for reading /proc/375/fd File opened for reading /proc/165/fd File opened for reading /proc/355/fd
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/697-1-0x00400000-0x00454d70-memory.dmp