Extracted

• • Target

    sora.mips.elf

  • Size

    28KB

  • MD5

    dc265141e7841a550dc18be503d5b842

  • SHA1

    89d933d1c184390f866a20b44bab4d53211c89c3

  • SHA256

    907e23967aa56e6810783d6bac29a42b0de74ac7b286e025dc58f6b73547c756

  • SHA512

    08c2360c09f2a1e46a5b89e44b9821e4afb1bf14c7b7af1644f4be1f0275aa18154fde97f5f9199cbdc89c99442ac825211e79c83aab646d2ef281978251e7c1

  • SSDEEP

    768:D4ylAtv6pqLJM0RXaxGyUbXtheU/SpJgGlzDpbuR1Jn:MMBqTRXa+Zhr/UVJuJ

  Score

  10^/10

  miraisorabotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (134770) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1