mirai | 4e116b164dbf33287b6d2e2a79ecbca47d7103f131d2356c8caad498c792d225

Analysis

max time kernel
0s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
08/10/2026, 12:34

Target
sora.arm6.elf
Size 32KB
Sample261008-prw8psxtes
SHA256 4e116b164dbf33287b6d2e2a79ecbca47d7103f131d2356c8caad498c792d225
MD5 8cd3d0ab4ebe84138534d02071b10435
SHA1 62901c7c77a67e712f0db55492e795b347bc6407
SHA512 3d13f9f11823d547bbe27af0a67114b8bd034d990a30bc304815da591bcd7a84d0cd33b33de2ba69e14aa219ee1a69595eb977ff0f28427cae4e922cf462e12e
SSDEEP 768:koiWiO031vpAPbrVWZK3XVGxm9Xl9q3UEL5IG:korm1vpALgUJ4LB
TLSH
T1EAE2F293D3726092DD786AF2F96989CF2BBD4B6CC17B30B31A0557242D9A0431E3C893
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Botnet

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai ARM payload 1 IoCs

resource	yara_rule
behavioral1/memory/780-1-0x00008000-0x0002db18-memory.dmp	family_mirai_arm

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	sora.arm6.elf

/tmp/sora.arm6.elf
/tmp/sora.arm6.elf
1⤵
- Reads runtime system information
PID:780