Extracted

• • Target
    sora.x86
  • Size 27KB
  • SHA256 0e1d15e29ccec3c49b646470a7a483f4cc5a533787c9e91ee8579be0115167fa
  • MD5 211c39ca1eec1cd38a9cdbfb80669e8c
  • SHA1 68a43009ccd4eb2989f9fbaaede5b09f7fef736e
  • SHA512 373b8f162fe33a1c40a33272fcadb1253e3aae6ee1c9f616348947f83c3c3641b49edd26eb32d6ae778be9fd0bf3a1514f4fb42b8793a76709755ebc2d85591c
  • SSDEEP 384:MRGW9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlgT:45+Kcrb9VDJe5FLTYTlPFnz/mRNX
  • TLSH
    T1EFC2D19394A98D06C862423B6E1F159B61242539134DFE2E373BEFDC63464B8A135DC7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (100734) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1