Extracted

• • Target

    sora.arm7

  • Size

    53KB

  • MD5

    59a7319860856987828fbc686b6c9bbb

  • SHA1

    a98e3b3af9f90ce1422f5c07e2eca973f1975e46

  • SHA256

    6f1807bd00b271807e104211ee0a49c3d50f651d186cfca8295dab2d28329d8a

  • SHA512

    d86b7ca0aabb86fd262273e0deca0daddcb2cc5bb020ca73162498e130e41ae7e1736b6caea3291f169f6ddbb969ec986733dbcefa058ed34bb0b18af578b08d

  • SSDEEP

    1536:mHG6YXI/x4pNyrLKo8YEBClgw6wrLPeZDIAiXkfDpC:mHG1m4y79Eob6wLP8Dw

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20527) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1