Extracted

• • Target
    sora.x86.elf
  • Size 58KB
  • SHA256 feb4dda27d64c947d307ac225bf278bf304169a50b3eae2eeb4e4583ba9f39e2
  • MD5 a510cc1b65e439a8e848aca3f2e5f8c5
  • SHA1 807bd4d43d86cd3670a33b2f9fbc1e2cb6fa0046
  • SHA512 d984c8cb12c14baee970b0216d4ceaf5b0a68892b084631f05d064b8660bd73cdc2d3190e6efe17a169ff503b8e4008bdd1023d640dae5dfa83eaac25c6b6a88
  • SSDEEP 1536:MOssuiundFq4ZthwLi/pXUfx0WbsoPMdQZl7dDFfG:xzuXndFq4ZthB/VUfOWooPEQj7dhO
  • TLSH
    T1B7434AC4B183FAF1DC05017C307AEB325E33F0B6613AED9BD7E455736855606960AA9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (102688) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1