Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12-07-2024 16:30
General
-
Target
sora.arm
-
Size
30KB
-
MD5
3966298930d053177b4ef18ca32ccc93
-
SHA1
98f61422080564d6f2e049ee9c2ac64d8dc04ea3
-
SHA256
4ac4a7c9a2feccb81ea1d2e68818aaaec42910e5e1a7ca34967676cfc8fcb7ed
-
SHA512
3dcc3403987b8f6f2d6b3c9201b6fae3a297d0228e6018807790639a6038f84b3cded345428e8a6e015a90489342535e5454e6dc516d435053946db1baca4835
-
SSDEEP
768:vOZUS+ldEfeM3lV7yyIQ6GY82uX2H0waBEKl/Szs3UozM:v7S+ldofV2nbarDzM
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20652) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
sora.armdescription ioc process File opened for modification /dev/watchdog sora.arm File opened for modification /dev/misc/watchdog sora.arm -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
sora.armdescription ioc process File opened for reading /proc/net/tcp sora.arm -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
sora.armdescription ioc process File opened for reading /proc/net/tcp sora.arm -
Reads runtime system information 24 IoCs
Reads data from /proc virtual filesystem.
Processes:
sora.armdescription ioc process File opened for reading /proc/140/fd sora.arm File opened for reading /proc/174/fd sora.arm File opened for reading /proc/285/fd sora.arm File opened for reading /proc/303/fd sora.arm File opened for reading /proc/635/fd sora.arm File opened for reading /proc/646/fd sora.arm File opened for reading /proc/1/fd sora.arm File opened for reading /proc/315/fd sora.arm File opened for reading /proc/577/fd sora.arm File opened for reading /proc/595/fd sora.arm File opened for reading /proc/598/fd sora.arm File opened for reading /proc/636/fd sora.arm File opened for reading /proc/644/fd sora.arm File opened for reading /proc/272/fd sora.arm File opened for reading /proc/274/fd sora.arm File opened for reading /proc/592/fd sora.arm File opened for reading /proc/224/fd sora.arm File opened for reading /proc/273/fd sora.arm File opened for reading /proc/275/fd sora.arm File opened for reading /proc/304/fd sora.arm File opened for reading /proc/321/fd sora.arm File opened for reading /proc/597/fd sora.arm File opened for reading /proc/647/fd sora.arm File opened for reading /proc/self/exe sora.arm
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/643-1-0x00008000-0x00023b7c-memory.dmp