Extracted

• • Target

    sora.arm7.elf

  • Size

    47KB

  • MD5

    0ec75f0aa09c3304cfeb73c4306eff78

  • SHA1

    bcda7f8716d7e55b0f015e01331fe9a944e2cb42

  • SHA256

    7535be55796427859ab481e04adc3b0d048c4996f07694156cd2eb0ca4ccb092

  • SHA512

    1b5b31d85283a71d01edeae9dc928fc75d53a947452f1c941157ae56a5b9ee82951c0c064b7578407ba1bc55b4900086dec74174ef68b3dd4b4c2cc532b210ba

  • SSDEEP

    768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFR9q3UELWt/iw+kvBGg6+fYtrBH1:E12O1LCNguovDPH7Tcr6LWhiw+kvBGgs

  Score

  10^/10

  miraisorabotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (169625) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1