Analysis
-
max time kernel
153s -
max time network
167s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
01-08-2024 09:28
General
-
Target
sora.mpsl
-
Size
29KB
-
MD5
670b2a83b4d5148a1dccca584290e2f8
-
SHA1
2a35bd305327adbafa5d005d153722c2622e17fd
-
SHA256
a45730037d82fb70f3885f4e1e5908a47957a43c58ac5bc5d1552c7c4173f18b
-
SHA512
cf0f01f2a9c7905ee32207ac7dae23f8c209f41ab054d46e49041c5a6a9aba4294bfc5644e1ae33a00737343dfd30b92532327cc1946405a73c54821391d9882
-
SSDEEP
384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjmFWVDbRWGVCz0Nvz:8MYHb62x4ahQ3CfdwLj1FqBW2
Malware Config
Extracted
mirai
SORA
Signatures
-
Contacts a large (159078) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
sora.mpsldescription ioc process File opened for modification /dev/watchdog sora.mpsl File opened for modification /dev/misc/watchdog sora.mpsl -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
sora.mpsldescription ioc process File opened for reading /proc/net/tcp sora.mpsl -
Changes its process name 1 IoCs
Processes:
sora.mpsldescription ioc pid process Changes the process name, possibly in an attempt to hide itself eamjjihg2fmnac1p3fm 742 sora.mpsl -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
sora.mpsldescription ioc process File opened for reading /proc/net/tcp sora.mpsl -
Reads runtime system information 30 IoCs
Reads data from /proc virtual filesystem.
Processes:
sora.mpsldescription ioc process File opened for reading /proc/746/exe sora.mpsl File opened for reading /proc/387/fd sora.mpsl File opened for reading /proc/710/fd sora.mpsl File opened for reading /proc/743/exe sora.mpsl File opened for reading /proc/413/fd sora.mpsl File opened for reading /proc/430/fd sora.mpsl File opened for reading /proc/202/fd sora.mpsl File opened for reading /proc/654/fd sora.mpsl File opened for reading /proc/656/fd sora.mpsl File opened for reading /proc/755/fd sora.mpsl File opened for reading /proc/777/fd sora.mpsl File opened for reading /proc/181/fd sora.mpsl File opened for reading /proc/334/fd sora.mpsl File opened for reading /proc/404/fd sora.mpsl File opened for reading /proc/745/fd sora.mpsl File opened for reading /proc/399/fd sora.mpsl File opened for reading /proc/748/fd sora.mpsl File opened for reading /proc/801{1,1T sora.mpsl File opened for reading /proc/746/fd sora.mpsl File opened for reading /proc/775/fd sora.mpsl File opened for reading /proc/781/fd sora.mpsl File opened for reading /proc/411/fd sora.mpsl File opened for reading /proc/689/fd sora.mpsl File opened for reading /proc/691/fd sora.mpsl File opened for reading /proc/743/fd sora.mpsl File opened for reading /proc/713/fd sora.mpsl File opened for reading /proc/1/fd sora.mpsl File opened for reading /proc/325/fd sora.mpsl File opened for reading /proc/388/fd sora.mpsl File opened for reading /proc/693/fd sora.mpsl