Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
01-08-2024 09:27
General
-
Target
sora.mips
-
Size
28KB
-
MD5
5b85012f58e1be64429d67d61177c800
-
SHA1
37508ee8f81e0f2cb4f37ade7e55d3d712e282c3
-
SHA256
1b17f05fb9b14e2b14182e7d356a3b927c78b3d810cf96b779dad938f90bf5f0
-
SHA512
20e6af316c290c581a56fc7f50c39eda29b4a79c4d505a0a7a53b27ed09b43ad13d5b2d26637b26eed9369a04b5239f740aa3e3ba576dc9d0dba7fe5fde0ba11
-
SSDEEP
768:O4ylAtv6pqLJM0RXaxGyUbXtheU/SXB9QJgGlzDpbuR1Jk:RMBqTRXa+Zhr/PVJuS
Malware Config
Extracted
mirai
SORA
Signatures
-
Contacts a large (49389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
sora.mipsdescription ioc process File opened for modification /dev/watchdog sora.mips File opened for modification /dev/misc/watchdog sora.mips -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
sora.mipsdescription ioc process File opened for reading /proc/net/tcp sora.mips -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
sora.mipsdescription ioc pid process Changes the process name, possibly in an attempt to hide itself gi1jm5a11of51ch13mo 708 sora.mips -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
sora.mipsdescription ioc process File opened for reading /proc/net/tcp sora.mips -
Reads runtime system information 47 IoCs
Reads data from /proc virtual filesystem.
Processes:
sora.mipsdescription ioc process File opened for reading /proc/709/exe sora.mips File opened for reading /proc/330/fd sora.mips File opened for reading /proc/777/exe sora.mips File opened for reading /proc/752/exe sora.mips File opened for reading /proc/680/fd sora.mips File opened for reading /proc/687/fd sora.mips File opened for reading /proc/709/fd sora.mips File opened for reading /proc/746/fd sora.mips File opened for reading /proc/679/exe sora.mips File opened for reading /proc/720/exe sora.mips File opened for reading /proc/712/exe sora.mips File opened for reading /proc/173/fd sora.mips File opened for reading /proc/385/fd sora.mips File opened for reading /proc/667/fd sora.mips File opened for reading /proc/680/exe sora.mips File opened for reading /proc/824/fd sora.mips File opened for reading /proc/151/fd sora.mips File opened for reading /proc/359/fd sora.mips File opened for reading /proc/382/fd sora.mips File opened for reading /proc/679/fd sora.mips File opened for reading /proc/701/fd sora.mips File opened for reading /proc/705/exe sora.mips File opened for reading /proc/707/exe sora.mips File opened for reading /proc/789/exe sora.mips File opened for reading /proc/1/fd sora.mips File opened for reading /proc/353/fd sora.mips File opened for reading /proc/361/fd sora.mips File opened for reading /proc/720/fd sora.mips File opened for reading /proc/429/exe sora.mips File opened for reading /proc/687/exe sora.mips File opened for reading /proc/357/fd sora.mips File opened for reading /proc/700/fd sora.mips File opened for reading /proc/711/fd sora.mips File opened for reading /proc/667/exe sora.mips File opened for reading /proc/671/exe sora.mips File opened for reading /proc/700/exe sora.mips File opened for reading /proc/248/fd sora.mips File opened for reading /proc/671/fd sora.mips File opened for reading /proc/745/fd sora.mips File opened for reading /proc/706/exe sora.mips File opened for reading /proc/781/exe sora.mips File opened for reading /proc/381/fd sora.mips File opened for reading /proc/429/fd sora.mips File opened for reading /proc/712/fd sora.mips File opened for reading /proc/714/fd sora.mips File opened for reading /proc/717/fd sora.mips File opened for reading /proc/832/fd sora.mips