Extracted

• • Target
    sora.x86.elf
  • Size 58KB
  • SHA256 279f00a0c21d82b034c633a5b247a50b9f2b2921416d48e5aafc07c42fe31d9d
  • MD5 56ca49e06b73e51e15db5d911f7ab471
  • SHA1 7a35470fcda0b048e0212e6e7deed1340d923064
  • SHA512 5fd4084ed7892ba1fe42958f30c920c435ea55ddce7b438516b6bcae5fa2d22f959e71b8a1ece25681992ee565441cad1ab4eb02371548f9cf93d4f3913696bb
  • SSDEEP 1536:MOssuiundFq4ZthwLi/pXUfx0WbEoPRdQZl7dDFfG:xzuXndFq4ZthB/VUfOW4oPnQj7dhO
  • TLSH
    T1FE434AC4B183FAF1DC05017C307AEB326E37F0B6613AED9BD7E455B36855206960AA9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (89697) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1