Extracted

• • Target
    sora.x86.elf
  • Size 27KB
  • SHA256 73c67a176d337a809555043d4189bbeea8d753d5770b7cb759243ebfcf718333
  • MD5 48a75246a298154cfabd98406cd7fff2
  • SHA1 c01df32efea6960bdb1fdca9143ec9da32992b73
  • SHA512 493a5ac160d936e4500d6ef02b6d1f299d1fb2e455b81fa904957414f07bc8286e690f7ca1aca508478154210fcdc5e2b95735a46432435faea17c03309f125c
  • SSDEEP 768:X5+Kcrb9VDJef5Q2PdHuzb8HoEPboQHf5J:0lrb9vehrpEOoE8QH/
  • TLSH
    T18EC2D1A285FACA17C863437D1828157351685C55E30DEE3D1B2BEEDC53884E62BBAC93
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (101764) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1