Analysis
-
max time kernel
150s -
max time network
154s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
30-06-2024 06:53
General
-
Target
sora.mpsl.elf
-
Size
29KB
-
MD5
51d75490752ff6720566784cbb865bb4
-
SHA1
a9c7582e33a7533b0bb8f51bd1b64363aec8572c
-
SHA256
a9ef6557ac849b117330a96fa1a68f595f7f8706892047bd605750bf4e5c2fbb
-
SHA512
ed551a303f0f7c6bf349799d6cb07d3bf87d9c055797d8072af4a6c5d8d6bb4ba7ec6eb81593b6d24aae9454424c92587b5772b7d05fb90a14aa43c040de5969
-
SSDEEP
768:a1uUtLrVDsAp6tLIWmj3HfiM4o/6YGvVbWym/bs2JbsWU2:abDs06tURj5xXGvlKTs2g2
Malware Config
Extracted
Family
mirai
Botnet
SORA
Signatures
-
Contacts a large (48510) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
sora.mpsl.elfdescription ioc process File opened for modification /dev/misc/watchdog sora.mpsl.elf File opened for modification /dev/watchdog sora.mpsl.elf -
Changes its process name 1 IoCs
Processes:
sora.mpsl.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself map1d30oded1cjc3pj1 696 sora.mpsl.elf -
Reads runtime system information 20 IoCs
Reads data from /proc virtual filesystem.
Processes:
sora.mpsl.elfdescription ioc process File opened for reading /proc/688/exe sora.mpsl.elf File opened for reading /proc/704/exe sora.mpsl.elf File opened for reading /proc/793/exe sora.mpsl.elf File opened for reading /proc/479/exe sora.mpsl.elf File opened for reading /proc/675/exe sora.mpsl.elf File opened for reading /proc/689/exe sora.mpsl.elf File opened for reading /proc/764/exe sora.mpsl.elf File opened for reading /proc/772/exe sora.mpsl.elf File opened for reading /proc/775/exe sora.mpsl.elf File opened for reading /proc/465/exe sora.mpsl.elf File opened for reading /proc/700/exe sora.mpsl.elf File opened for reading /proc/512/exe sora.mpsl.elf File opened for reading /proc/727/exe sora.mpsl.elf File opened for reading /proc/697/exe sora.mpsl.elf File opened for reading /proc/693/exe sora.mpsl.elf File opened for reading /proc/694/exe sora.mpsl.elf File opened for reading /proc/695/exe sora.mpsl.elf File opened for reading /proc/709/exe sora.mpsl.elf File opened for reading /proc/760/exe sora.mpsl.elf File opened for reading /proc/511/exe sora.mpsl.elf
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/696-1-0x00400000-0x00455b00-memory.dmp