Extracted

• • Target
    sora.mips
  • Size 28KB
  • SHA256 d9c52734e371cb3457be89df7ffe90e19c4d853f9ee965e5849954d2a1387cf4
  • MD5 922a674d6ca8e96d8faddad25ba31b35
  • SHA1 d05f40f3e4a4e3ee358c97abb9a80386b3749aa9
  • SHA512 4ffd284025a8593907fab863578bf6ba6f902408f10699288daa68872b4462222984d5fc34598dac52e159a9a6e792c12c913f4f5fab4cc1b394928e4f6198a4
  • SSDEEP 768:94ylAtv6pqLJM0RXaxGyUbXtheU/Sw92JgGlzDpbuR1J2:GMBqTRXa+Zhr/sVJuA
  • TLSH
    T10CD2E1B8670249D7CAAEA1B88DD50B263D60CFE2E1436C077594D9C7BB098AD3CA5DC1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (48449) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1