Extracted

• • Target
    sora.x86.elf
  • Size 27KB
  • SHA256 a804ec4400e8da43e2d7e0a3429a3b85abff41f383a9d07041c5730492f8bce1
  • MD5 03bcd0dfe8eb604d3db8cf929415e883
  • SHA1 00140df8601bf15f6530103fbbc626f74ed74f48
  • SHA512 1fbeaa3c1a8f93de9da3a31bba31bdbc582a54049ed385d963464666ba5043fb3311e7bae4a45ae74713b48c4dc34dcbeac80aabd2aaf84091c3cee93b4fb33b
  • SSDEEP 384:MRGW9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlFe:45+Kcrb9VDJe5FLTYTlPFnz/rANb
  • TLSH
    T194C2D19394A9CD06C862423B6E1F159B61242439134DFE2E373FEFEC62464B8A235DC3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (102970) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1