Extracted

• • Target
    sora.mips.elf
  • Size 28KB
  • SHA256 b03defa5c10a3ae6cb90860ec25a2bf171a93e0bf95699b95f2e47d2804eb119
  • MD5 dc9a8855999d87817b27bc4b8930ff57
  • SHA1 668ad94c62c09ca91d1e55c2870f60c422f11779
  • SHA512 ffa198112b84e14eef505e0715bd6e09d4da1b9202bcf16530acd069bd2c2ca9d5d107c2d44f95a641b06250da0a7ecc24d3331f952d9dc20a87055b6eb86378
  • SSDEEP 768:U4ylAtv6pqLJM0RXaxGyUbXtheU/ShLJgGlzDpbuR1JH:HMBqTRXa+Zhr/4VJuV
  • TLSH
    T1D2D2D1B86B0149D7CA6FA1745DE10B262D608FB2E1437C0B6694D9D7BF0A86C3CE5DC0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (48639) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1