Extracted

• • Target

    sora.mpsl.elf

  • Size

    29KB

  • MD5

    03b5fa5f1e96c217bed3a9fca8608cf6

  • SHA1

    3cbc19ee9b976229d0eeaa407a9713e8d5a90ce2

  • SHA256

    18fa959a348c7d2b631e8a60d857cdf52c519e95a18673df361f38574e9d1f7c

  • SHA512

    ae3476787fc87acbe12012e48c2411450b4ac4a34c5aa866e6160a4b5f7ba82bda86b52fca0edac9124182260dee87bdaa7f2b0f0142e6383c06c909c6f64741

  • SSDEEP

    384:i8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjOpJOYr8MCRWGVCz0n:HMYHb62x4ahQ3CfdwLjBOs87Ww

  Score

  10^/10

  miraisorabotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (135709) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1