Extracted

• • Target

    sora.arm.elf

  • Size

    31KB

  • MD5

    a5cad4481a17e94cc218010857554435

  • SHA1

    9a7a6bd0ca4e5a426cdce046ffce363d5c11ff42

  • SHA256

    bed099cdf50214613f89144e00edb807760b44dad3cd3641ff0374c490eeebd3

  • SHA512

    8bdceec0c7ae3c9a17c9967a5bf9f7ceb944b9cd0afb330715d0b57a5a6c4f2e4e4e387a019d1b4522be325bc14e8ce020023ea52046666c93a39ddc0a83273f

  • SSDEEP

    384:uSBehsL5wFgC4Urp3VvZhUzaAfVGbrc2/pkTNW7CQRkPgosmkyCizUs1Hk8hymdR:Fkh3G0p3VhUHqvKT4Fc9pi8s3UozRK

  Score

  10^/10

  miraisorabotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (171459) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1