Extracted

• • Target

    sora.mips.elf

  • Size

    42KB

  • MD5

    20941cccec35b168a8158c69c062048e

  • SHA1

    166752ba695b226ca7b9a27c0f06dae69f88464d

  • SHA256

    09eeacc3bbe53aa5ff7dd53cf58287614079038156e63fcb5985e40a08367752

  • SHA512

    4e5593a62b31dec40001c50d2cf8360afb94ed64af983c9265af04e10e636d4520d67ad768ef35d6ff33144617ab2b6fc1a392d06e85ab3cfe7fdeef534e490a

  • SSDEEP

    768:558rMTrTtN+pnJwGJ8cD/doKBb4Gy8gDP0FtCk+ATM5vJgGlzDpbuR1JRK6aMl6:OMnTLgbJLoKWxbnfVJu+O6

  Score

  10^/10

  miraisorabotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (88669) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1