mirai | 4a18c7f6e74bc6f4a20f948c8b0555f4688c80740a5eb9d3388fc8930ac65432

Analysis

max time kernel
0s
max time network
6s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
15-02-2025 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sora.mips.elf
Size

28KB
MD5

fa9b6c7c37b9749884b432b1cfcd447c
SHA1

1ddf712db6bf2948950b7fd884766a1a5d2b4294
SHA256

4a18c7f6e74bc6f4a20f948c8b0555f4688c80740a5eb9d3388fc8930ac65432
SHA512

2f8f653f60de4a0562e524fb9993175a46b946e1fe476f3e180558baa0462f5725549c6587ad1b264df98cee8438adfab8bab7014ef423ff7a554ee59e9ef806
SSDEEP

768:fxMWBhAHuLeVIGt5B2LlUqw6Xrw0RE9JYPEJgGlzDpbuR1JW:fxdBGuLeBUlZ7w0S9WP8VJu8

Score

10^/10

mirai sora botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	sora.mips.elf
File opened for modification	/dev/misc/watchdog	sora.mips.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	e1p4mk21e3nf2iaahnf	698	sora.mips.elf

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
698	sora.mips.elf

/tmp/sora.mips.elf
/tmp/sora.mips.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- System Network Configuration Discovery
PID:698

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads