Extracted

• • Target
    sora.x86_64
  • Size 28KB
  • SHA256 73ab4a2ffece356b303b7248f78c62fddf80300cdeb7e219cd178e0f09fbb920
  • MD5 5f7b7f7580642fd20e8ac8fbf7899a57
  • SHA1 c206e8e7c00012ef965919ca79f1e3e504d93e2c
  • SHA512 f999f49cba2f27632623cdac459e55302e0eb4efeef58376a4952180fff4a7bc39bbb4cd4dac0101a55e41bf42806e315503957695681b25a123947c3b47a316
  • SSDEEP 768:G8hzpUjpj9Orfn14Ao0iviTL5D+CVRNx02k:GTt9OzWjp6Pl+CN5k
  • TLSH
    T13ED2D0C361AFFAB8D03351F50969D2EAF2557EB119D3172F548D30BE88BB8542B10B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (91107) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1