Extracted

• • Target
    sora.mpsl.elf
  • Size 29KB
  • SHA256 ede49f0f9c0ce3158c1b200ef49f9b2f431568aee58673015ade392bb998332f
  • MD5 0abc72dd7106d0d88e626007b5d38575
  • SHA1 0ccba3dab2c0ef2ed617a6fe85ea9eef022cfa8b
  • SHA512 280acae57e0d1970ea7916048ddcf8fccfecfd1f8e3a0874b6615c37440c8ffc6b4d12a2a010f9afe2bf53f1a362f4b51d30d8f218247433b180a3276f86ae25
  • SSDEEP 384:N8pVWMkRnVvjjYGTO8Q83EBvH3Ur9hnqu9v7yiriLI8dX4EXO1J3W+clPzRWGVCw:qeVv/e8fEBvH8nq+yiWI64aO1JmLVWk
  • TLSH
    T196D2E14F86B7E61EC9580D7CD6DC17A25A3C7180271D5F4C275B5CC2A81858BB372638
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (47763) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1