Extracted

• • Target
    sora.mpsl.elf
  • Size 29KB
  • SHA256 d2fb1489eb4aa374a78fd3a2d96ca211976e0d84742e3c90864e2b5eb1c65f83
  • MD5 76491b4b6f9cb650670d47e7679ca30e
  • SHA1 d8ae4bec69d390cfea3aae40e8b9a51269f9fc76
  • SHA512 68b826432747ca19d3aab79463f7d93d9f68ce0d0d518b330074e1940783d8fe7ff10f4d9172bfa0508fed5e2f70fe5367d8b4524a9f8bc6a688255b6eb17bd6
  • SSDEEP 384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjabRWGVCz0Nvs:8MYHb62x4ahQ3CfdwLjXWd
  • TLSH
    T195D2D0AEE57542C9FD4D5C3E808C3FA10E19E581231BDB9667128C4D5B32C1BF66E4B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (48556) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1