Analysis
-
max time kernel
125s -
max time network
156s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
-
submitted
08/12/2024, 13:11
General
-
Target
sora.mpsl.elf
-
Size
29KB
-
MD5
536f4baa0c96713a3b082e7a3a15dc20
-
SHA1
23dfa1f8cfebeb1ff99091625715488485a7c472
-
SHA256
a1abc569aeddad061736f46ac605dd04d6e0d45eb47b4157d50441bd9e97e9d0
-
SHA512
f5a1c7cfc629705c05eb67a918a6f82b9f66ca09ff443cbe19e5115d1f71acca1c5ad3f117f211dd7fba320afbe6a80e9f012488cc9a06dc084628aca6fd3ebc
-
SSDEEP
768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNSGrlJbUWUa:kbDs06t4BEub4sU/MbU5rlYa
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
SORA
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (40465) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Changes its process name 1 IoCs
-
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/sora.mpsl.elf/tmp/sora.mpsl.elf1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information