Extracted

• • Target

    sora.arm.elf

  • Size

    26KB

  • MD5

    0ece4cd98d4c079c639b2186bc43b645

  • SHA1

    48e53df0aa883a5b5c2e61f495b6e8494b713c60

  • SHA256

    ce28f399bd7c307a8b9b59a8b3e8d49d709e9edbb927bc3dbb6a53dff9cb50d2

  • SHA512

    fe36e497f616e1579d7b0c1af1f71c55f010775789bc84a3a41f1a592f37557124e42569dab53f3548807b4bf443fac3d540aa7eb5c9a6619687acaaf4f64bd8

  • SSDEEP

    768:AjKX9vt6GqA3Q0jzV7EUyUq9ESvs3Uoz3:AjqtBqoB7EUBxSiz3

  Score

  10^/10

  miraisorabotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (162826) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1