Analysis
-
max time kernel
150s -
max time network
153s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
23-04-2024 10:51
General
-
Target
sora.x86.elf
-
Size
39KB
-
MD5
be5a798817330425494809c2f5304d1c
-
SHA1
0edb3f4395ec9a4c7c3f589e330eadf1b0457425
-
SHA256
e46e14349d506e50bd7b0c760f86edfadbeb442f293ba6b5f41ddff0cb490caa
-
SHA512
36f5cd0a076f0df9af7d2349dc8d3bb9269672f77f6e2ce7ca9031236294481a4537aceaf6f8f01c303aa2532a0063abc0fa671e5b54d3cc7d94b8862c3ce220
-
SSDEEP
768:sgWRsr0BsMXlZu60wyvvt8SFl8Gkfe45ZjMqxLuEjqYHvlJ1dY1:sgWugBs6Qayvv/l8GmrZjMqxL1qYPlpK
Malware Config
Extracted
mirai
SORA
Signatures
-
Contacts a large (86119) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
sora.x86.elfdescription ioc process File opened for modification /dev/watchdog sora.x86.elf File opened for modification /dev/misc/watchdog sora.x86.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
sora.x86.elfdescription ioc process File opened for reading /proc/net/tcp sora.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
sora.x86.elfdescription pid process Changes the process name, possibly in an attempt to hide itself 1476 sora.x86.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
sora.x86.elfdescription ioc process File opened for reading /proc/net/tcp sora.x86.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
sora.x86.elfdescription ioc process File opened for reading /proc/1102/fd sora.x86.elf File opened for reading /proc/1104/fd sora.x86.elf File opened for reading /proc/550/fd sora.x86.elf File opened for reading /proc/948/fd sora.x86.elf File opened for reading /proc/401/fd sora.x86.elf File opened for reading /proc/442/fd sora.x86.elf File opened for reading /proc/457/fd sora.x86.elf File opened for reading /proc/1105/fd sora.x86.elf File opened for reading /proc/1477/exe sora.x86.elf File opened for reading /proc/398/fd sora.x86.elf File opened for reading /proc/1309/fd sora.x86.elf File opened for reading /proc/1417/fd sora.x86.elf File opened for reading /proc/1419/fd sora.x86.elf File opened for reading /proc/503/fd sora.x86.elf File opened for reading /proc/1134/fd sora.x86.elf File opened for reading /proc/697/fd sora.x86.elf File opened for reading /proc/1239/fd sora.x86.elf File opened for reading /proc/487/fd sora.x86.elf File opened for reading /proc/565/fd sora.x86.elf File opened for reading /proc/1030/fd sora.x86.elf File opened for reading /proc/1086/fd sora.x86.elf File opened for reading /proc/1133/fd sora.x86.elf File opened for reading /proc/1422/fd sora.x86.elf File opened for reading /proc/502/fd sora.x86.elf File opened for reading /proc/514/fd sora.x86.elf File opened for reading /proc/1460/fd sora.x86.elf File opened for reading /proc/1479/fd sora.x86.elf File opened for reading /proc/494/fd sora.x86.elf File opened for reading /proc/963/fd sora.x86.elf File opened for reading /proc/1084/fd sora.x86.elf File opened for reading /proc/1414/fd sora.x86.elf File opened for reading /proc/835/fd sora.x86.elf File opened for reading /proc/917/fd sora.x86.elf File opened for reading /proc/812/fd sora.x86.elf File opened for reading /proc/957/fd sora.x86.elf File opened for reading /proc/1090/fd sora.x86.elf File opened for reading /proc/1421/fd sora.x86.elf File opened for reading /proc/535/fd sora.x86.elf File opened for reading /proc/611/fd sora.x86.elf File opened for reading /proc/672/fd sora.x86.elf File opened for reading /proc/902/fd sora.x86.elf File opened for reading /proc/1048/fd sora.x86.elf File opened for reading /proc/1140/fd sora.x86.elf File opened for reading /proc/1526/fd sora.x86.elf File opened for reading /proc/1527/fd sora.x86.elf File opened for reading /proc/582/fd sora.x86.elf File opened for reading /proc/633/fd sora.x86.elf File opened for reading /proc/1319/fd sora.x86.elf File opened for reading /proc/1118/fd sora.x86.elf File opened for reading /proc/693/fd sora.x86.elf File opened for reading /proc/1040/fd sora.x86.elf File opened for reading /proc/1515/fd sora.x86.elf File opened for reading /proc/1453/fd sora.x86.elf File opened for reading /proc/1480/fd sora.x86.elf File opened for reading /proc/1155/fd sora.x86.elf File opened for reading /proc/1181/fd sora.x86.elf File opened for reading /proc/1415/fd sora.x86.elf File opened for reading /proc/1416/fd sora.x86.elf File opened for reading /proc/1426/fd sora.x86.elf File opened for reading /proc/1/fd sora.x86.elf File opened for reading /proc/477/fd sora.x86.elf File opened for reading /proc/1423/fd sora.x86.elf File opened for reading /proc/533/fd sora.x86.elf File opened for reading /proc/1120/fd sora.x86.elf