Analysis

  • max time kernel
    0s
  • max time network
    147s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    03-08-2024 05:18

General

  • Target

    sora.arm7.elf

  • Size

    51KB

  • MD5

    e72c2c2ffa7161b4dccea4ed34785c2a

  • SHA1

    af392b3dcaaac89b76794e4d67ec02055dbe6d7a

  • SHA256

    c5f439d49fb65081bb4b21fe928b7492cd52e43f6a63380389758c719bbf3f89

  • SHA512

    fa17789905a834a7d4de21bf7d0bd938b346b142ad34e0c32aef85ccd8296b72d026e6483136e67df2d5a0f0f6a91e3e0ccaf464b3ce56a2ceebf5c2de63273a

  • SSDEEP

    768:LBbPpQwNueqlA/gS8wgXFuCAIDRFLoBcoevYVG9q3UELjCHVIpH3UQJc2ZVYCYjb:B+wg7A/ww96jo20Lm1IpXVJc21+3onK

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/sora.arm7.elf
    /tmp/sora.arm7.elf
    1⤵
    • Reads runtime system information
    PID:708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/708-1-0x00008000-0x00029790-memory.dmp