Extracted

• • Target
    sora.mips
  • Size 28KB
  • SHA256 64b70e287e2f7745b90e94f5b2fe48ddacfaeaa71b4b4db0168327bac9c461f6
  • MD5 85ba3eae05c2ce2e3e54e0e55a3fe4d5
  • SHA1 a76d7ee5f7a98694b799e6c1f13e6ab841dc8a31
  • SHA512 dbc4179bce6398533fbe8e05747d064452f3c9ff7432bae4dc68489af1eb30d3c6c15ebe24393ed780eea2fd85fd76e62ba3e35b09df89ad34273ed65dd1761b
  • SSDEEP 768:94ylAtv6pqLJM0RXaxGyUbXtheU/So92JgGlzDpbuR1Ji:GMBqTRXa+Zhr/8VJu4
  • TLSH
    T1CAD2E1786B0149D7CAAFA1788DD50B362D618FB3E1427C0766A4D9C3BB098AC3CB5DC1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (49085) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1