Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
01-08-2024 08:37
General
-
Target
sora.x86.elf
-
Size
27KB
-
MD5
3abbcc42afc40752f2c941ba5cf79031
-
SHA1
f33d462fc4a753bad19669fe7f28f973e439b6c3
-
SHA256
55f9c9b09475079a0a537549343e9f833ab98f12befe2a819170bd267221d0b2
-
SHA512
279ff916c83be4ee3877fbfb9d2e7461f55233ca9f199ef51e27b5fb9d5c44bbd75e48372981945973365264e4198a57fcfca3fcbdb39f555b7bfd212f018c4e
-
SSDEEP
384:Msy9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcz:w5+Kcrb9VDJef5Q2PdHuzb8HoEPbeSN8
Malware Config
Extracted
mirai
SORA
Signatures
-
Contacts a large (76548) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
sora.x86.elfdescription ioc process File opened for modification /dev/watchdog sora.x86.elf File opened for modification /dev/misc/watchdog sora.x86.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
sora.x86.elfdescription ioc process File opened for reading /proc/net/tcp sora.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
sora.x86.elfdescription pid process Changes the process name, possibly in an attempt to hide itself 1558 sora.x86.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
sora.x86.elfdescription ioc process File opened for reading /proc/net/tcp sora.x86.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
sora.x86.elfdescription ioc process File opened for reading /proc/1085/fd sora.x86.elf File opened for reading /proc/1171/fd sora.x86.elf File opened for reading /proc/1564/fd sora.x86.elf File opened for reading /proc/991/fd sora.x86.elf File opened for reading /proc/1166/fd sora.x86.elf File opened for reading /proc/749/fd sora.x86.elf File opened for reading /proc/762/fd sora.x86.elf File opened for reading /proc/1050/fd sora.x86.elf File opened for reading /proc/613/fd sora.x86.elf File opened for reading /proc/1213/fd sora.x86.elf File opened for reading /proc/768/fd sora.x86.elf File opened for reading /proc/1209/fd sora.x86.elf File opened for reading /proc/1217/fd sora.x86.elf File opened for reading /proc/586/fd sora.x86.elf File opened for reading /proc/772/fd sora.x86.elf File opened for reading /proc/1262/fd sora.x86.elf File opened for reading /proc/633/fd sora.x86.elf File opened for reading /proc/1170/fd sora.x86.elf File opened for reading /proc/590/fd sora.x86.elf File opened for reading /proc/629/fd sora.x86.elf File opened for reading /proc/1038/fd sora.x86.elf File opened for reading /proc/1192/fd sora.x86.elf File opened for reading /proc/1215/fd sora.x86.elf File opened for reading /proc/1/fd sora.x86.elf File opened for reading /proc/1231/fd sora.x86.elf File opened for reading /proc/660/fd sora.x86.elf File opened for reading /proc/1241/fd sora.x86.elf File opened for reading /proc/1244/fd sora.x86.elf File opened for reading /proc/1561/fd sora.x86.elf File opened for reading /proc/679/fd sora.x86.elf File opened for reading /proc/1059/fd sora.x86.elf File opened for reading /proc/415/fd sora.x86.elf File opened for reading /proc/1066/fd sora.x86.elf File opened for reading /proc/858/fd sora.x86.elf File opened for reading /proc/872/fd sora.x86.elf File opened for reading /proc/1013/fd sora.x86.elf File opened for reading /proc/1163/fd sora.x86.elf File opened for reading /proc/1307/fd sora.x86.elf File opened for reading /proc/852/fd sora.x86.elf File opened for reading /proc/1565/fd sora.x86.elf File opened for reading /proc/630/fd sora.x86.elf File opened for reading /proc/1269/fd sora.x86.elf File opened for reading /proc/594/fd sora.x86.elf File opened for reading /proc/972/fd sora.x86.elf File opened for reading /proc/1143/fd sora.x86.elf File opened for reading /proc/1385/fd sora.x86.elf File opened for reading /proc/1569/fd sora.x86.elf File opened for reading /proc/1559/exe sora.x86.elf File opened for reading /proc/1134/fd sora.x86.elf File opened for reading /proc/1191/fd sora.x86.elf File opened for reading /proc/830/fd sora.x86.elf File opened for reading /proc/656/fd sora.x86.elf File opened for reading /proc/829/fd sora.x86.elf File opened for reading /proc/1108/fd sora.x86.elf File opened for reading /proc/1111/fd sora.x86.elf File opened for reading /proc/1211/fd sora.x86.elf File opened for reading /proc/376/fd sora.x86.elf File opened for reading /proc/1165/fd sora.x86.elf File opened for reading /proc/1334/fd sora.x86.elf File opened for reading /proc/1440/fd sora.x86.elf File opened for reading /proc/1559/fd sora.x86.elf File opened for reading /proc/1147/fd sora.x86.elf File opened for reading /proc/632/fd sora.x86.elf File opened for reading /proc/643/fd sora.x86.elf