mirai | ce28f399bd7c307a8b9b59a8b3e8d49d709e9edbb927bc3dbb6a53dff9cb50d2

Analysis

max time kernel
150s
max time network
154s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23-11-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sora.arm.elf
Size

26KB
MD5

0ece4cd98d4c079c639b2186bc43b645
SHA1

48e53df0aa883a5b5c2e61f495b6e8494b713c60
SHA256

ce28f399bd7c307a8b9b59a8b3e8d49d709e9edbb927bc3dbb6a53dff9cb50d2
SHA512

fe36e497f616e1579d7b0c1af1f71c55f010775789bc84a3a41f1a592f37557124e42569dab53f3548807b4bf443fac3d540aa7eb5c9a6619687acaaf4f64bd8
SSDEEP

768:AjKX9vt6GqA3Q0jzV7EUyUq9ESvs3Uoz3:AjqtBqoB7EUBxSiz3

Score

10^/10

mirai sora botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (162826) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

sora.arm.elf

description ioc process

File opened for modification /dev/watchdog sora.arm.elf
File opened for modification /dev/misc/watchdog sora.arm.elf
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
discovery

System Network Connections Discovery
T1049

Processes:

sora.arm.elf

description ioc process

File opened for reading /proc/net/tcp sora.arm.elf
Changes its process name 1 IoCs

Processes:

sora.arm.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself dn1f5gc14kaojim12kk 657 sora.arm.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

sora.arm.elf

description ioc process

File opened for reading /proc/net/tcp sora.arm.elf

description	ioc	process
File opened for modification	/dev/watchdog	sora.arm.elf
File opened for modification	/dev/misc/watchdog	sora.arm.elf

description	ioc	process
File opened for reading	/proc/net/tcp	sora.arm.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	dn1f5gc14kaojim12kk	657	sora.arm.elf

description	ioc	process
File opened for reading	/proc/net/tcp	sora.arm.elf

Reads runtime system information 33 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

sora.arm.elf

description	ioc	process
File opened for reading	/proc/395/fd	sora.arm.elf
File opened for reading	/proc/457/fd	sora.arm.elf
File opened for reading	/proc/662/fd	sora.arm.elf
File opened for reading	/proc/667/fd	sora.arm.elf
File opened for reading	/proc/self/exe	sora.arm.elf
File opened for reading	/proc/288/fd	sora.arm.elf
File opened for reading	/proc/307/fd	sora.arm.elf
File opened for reading	/proc/330/fd	sora.arm.elf
File opened for reading	/proc/650/fd	sora.arm.elf
File opened for reading	/proc/665/fd	sora.arm.elf
File opened for reading	/proc/673/fd	sora.arm.elf
File opened for reading	/proc/695/fd	sora.arm.elf
File opened for reading	/proc/146/fd	sora.arm.elf
File opened for reading	/proc/222/fd	sora.arm.elf
File opened for reading	/proc/291/fd	sora.arm.elf
File opened for reading	/proc/781{1,1T	sora.arm.elf
File opened for reading	/proc/663/exe	sora.arm.elf
File opened for reading	/proc/292/fd	sora.arm.elf
File opened for reading	/proc/456/fd	sora.arm.elf
File opened for reading	/proc/1/fd	sora.arm.elf
File opened for reading	/proc/666/fd	sora.arm.elf
File opened for reading	/proc/660/fd	sora.arm.elf
File opened for reading	/proc/278/fd	sora.arm.elf
File opened for reading	/proc/318/fd	sora.arm.elf
File opened for reading	/proc/411/fd	sora.arm.elf
File opened for reading	/proc/663/fd	sora.arm.elf
File opened for reading	/proc/660/exe	sora.arm.elf
File opened for reading	/proc/309/fd	sora.arm.elf
File opened for reading	/proc/612/fd	sora.arm.elf
File opened for reading	/proc/696/fd	sora.arm.elf
File opened for reading	/proc/175/fd	sora.arm.elf
File opened for reading	/proc/277/fd	sora.arm.elf
File opened for reading	/proc/649/fd	sora.arm.elf

/tmp/sora.arm.elf
/tmp/sora.arm.elf
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:657

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/657-1-0x00008000-0x00021578-memory.dmp

Download