mirai | e588c361cd13c7d71d72e090181139d070ccccc769c8cf61b28d8ebef2bada17 | Triage

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03-11-2024 14:44

Sharing

Report Analysis Logs

General

Target

sora.arm6.elf
Size

32KB
MD5

d603c1439c3ae448e235ba2f0470dba9
SHA1

00f0092f4d23d06c136e5d1ff50db0b89dd66688
SHA256

e588c361cd13c7d71d72e090181139d070ccccc769c8cf61b28d8ebef2bada17
SHA512

2680092354b237bb738d81aa99b52bc0bd1c22167d43dda13f72d8d87bd622e0400de35f4f9e62f81af0c03c60ff7fe95e7333ae6e9d88acee0c613d3808cb74
SSDEEP

768:coiQmTDhXpoegNnN2DZjvjqn7PXHlJZ8GKIfm8TolVH9q3UEL5I4:coZmXhXgnADdqnrHp8RIfm8olkL7

Score

10^/10

mirai sora botnet discovery

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	sora.arm6.elf

/tmp/sora.arm6.elf
/tmp/sora.arm6.elf
1⤵
- Reads runtime system information
PID:642

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads