Extracted

• • Target
    sora.x86_64
  • Size 27KB
  • SHA256 ae1241f4a4787c0362285f91657c4f91722345c78bd8b986f8f5e88d6db6083c
  • MD5 15da4479bd5fae49280d4b4e8c946338
  • SHA1 f402f5d3c007333da289b4c00522d469832444fc
  • SHA512 6c5b8eea41e8b97a2638437ee4b69b72edcc3c1c54acef657ba8ea39047d8578e3c495af5db2d81ae94124a98dc6dd7c36290b30c95954baa0c8db57407efce1
  • SSDEEP 384:Ms79WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcF:X5+Kcrb9VDJef5Q2PdHuzb8HoEPbR9s/
  • TLSH
    T155C2E2E285F6C607D863437D19381563A1585C58E34DDE3D1B2B9ADC138C4E72A7AC83
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (89138) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1