Extracted

• • Target
    sora.arm7.elf
  • Size 50KB
  • SHA256 f01716f11836bb776ad3ce6c12c829d55095555530fe9c2d582f839ed1b27025
  • MD5 86a4fac96e16f1987c70a361544d49f0
  • SHA1 fd06afc9e59d0cf6d4ba3858ceb018c0ca49e8c5
  • SHA512 de3d8cac95ab8bf2f1c0cb5b3d04944a9403b75ff55c6d9d5aeeea6ab5b3d8a3dda21f8758b967534367d7939a19d19da6e87758212fff57651367eac26b6156
  • SSDEEP 1536:D32NPB/QPYS60LopOzuUfoL1VJGtTzwjxQ5kxA6n:2p/QPYnpGfoL1VMzlkFn
  • TLSH
    T100330190CCF79723CA17383FA36805315DA54F3694FAB16B27345A4C66EB02231FAB52
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Contacts a large (163089) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1