be09848e5be4105d9ec52c6f32c3bd0ddbc07b3f8c34ef7ce2a2e964429e9c0c

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12-11-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sora.arm.elf
Size

93KB
MD5

3c9ab36542d142f8b55b86a0af95c6d0
SHA1

750a69cad0a25ab105e7ef3a7b3e4ccc888c1f37
SHA256

be09848e5be4105d9ec52c6f32c3bd0ddbc07b3f8c34ef7ce2a2e964429e9c0c
SHA512

f065350c35a7d30274e1a423a63bcd6de04b1802487a3614a765dbe1493da2f26732179debd06db55d6a43f594f6e3968d17ac96aefd00610e61e0e89d120c80
SSDEEP

1536:tn76I8d6zcqSvSshT2y0mqXNSp022ySNwMhWO5mOdahSFZnWGbEOUvpD5i:J76z4mIUp0bySNXf5hd8SCcE95i

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (49705) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

sora.arm.elf

description ioc process

File opened for modification /dev/watchdog sora.arm.elf
File opened for modification /dev/misc/watchdog sora.arm.elf
Enumerates running processes
Discovers information about currently running processes on the system
Changes its process name 1 IoCs

Processes:

sora.arm.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself 1h3hn1j1nicjkn4fo 647 sora.arm.elf

description	ioc	process
File opened for modification	/dev/watchdog	sora.arm.elf
File opened for modification	/dev/misc/watchdog	sora.arm.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	1h3hn1j1nicjkn4fo	647	sora.arm.elf

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

sora.arm.elf

description	ioc	process
File opened for reading	/proc/759/exe	sora.arm.elf
File opened for reading	/proc/761/exe	sora.arm.elf
File opened for reading	/proc/770/exe	sora.arm.elf
File opened for reading	/proc/776/exe	sora.arm.elf
File opened for reading	/proc/782/exe	sora.arm.elf
File opened for reading	/proc/648/exe	sora.arm.elf
File opened for reading	/proc/600/exe	sora.arm.elf
File opened for reading	/proc/745/exe	sora.arm.elf
File opened for reading	/proc/581/exe	sora.arm.elf
File opened for reading	/proc/646/exe	sora.arm.elf
File opened for reading	/proc/715/exe	sora.arm.elf
File opened for reading	/proc/766/exe	sora.arm.elf
File opened for reading	/proc/768/exe	sora.arm.elf
File opened for reading	/proc/711/exe	sora.arm.elf
File opened for reading	/proc/755/exe	sora.arm.elf
File opened for reading	/proc/760/exe	sora.arm.elf
File opened for reading	/proc/772/exe	sora.arm.elf
File opened for reading	/proc/778/exe	sora.arm.elf
File opened for reading	/proc/651/exe	sora.arm.elf
File opened for reading	/proc/591/exe	sora.arm.elf
File opened for reading	/proc/644/exe	sora.arm.elf
File opened for reading	/proc/784/exe	sora.arm.elf
File opened for reading	/proc/786/exe	sora.arm.elf
File opened for reading	/proc/659/exe	sora.arm.elf
File opened for reading	/proc/579/exe	sora.arm.elf
File opened for reading	/proc/639/exe	sora.arm.elf
File opened for reading	/proc/645/exe	sora.arm.elf
File opened for reading	/proc/774/exe	sora.arm.elf
File opened for reading	/proc/780/exe	sora.arm.elf
File opened for reading	/proc/578/exe	sora.arm.elf

/tmp/sora.arm.elf
/tmp/sora.arm.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:647

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads