Extracted

• • Target
    sora.mpsl.elf
  • Size 29KB
  • SHA256 a35003ae5a44da7d727f6c0ab6eb1454d4bea21c22e98ba64dae7af3136582c5
  • MD5 028a8d9dfadb54472dd7f78932d783cd
  • SHA1 612ecb72a8aaaeec0310cd44e4ed796f729e7e06
  • SHA512 99bc66afb87a79e97ac9a6bb173bd8aa07fc485a7177014127492c168aaaa9f50461040fac3e66464006af19d5e9bc918704b7f0795bbbc97e20aeecdf1e29af
  • SSDEEP 384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjQprbRWGVCz0Nvr:8MYHb62x4ahQ3CfdwLjjrWq
  • TLSH
    T123D2D06EE5B442C5FD8D5C3E808C3FA10E59E581231BDB9267228D4E5B32C5BF16A4B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (48484) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1