Linux Analysis Report sora.mips

Overview

General Information

Sample Name: sora.mips
Analysis ID: 513591
MD5: f541ee6ca94d92d5c8da35fce228bb46
SHA1: 46100ebb28ef32d9895277b26db0705cdb4a5729
SHA256: 119853ec87c7bc15674fa8beaf375979d963c5fd763d08a32ef555041e053d04
Infos:

Most interesting Screenshot:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill many processes (SIGKILL)
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: sora.mips Virustotal: Detection: 52% Perma Link
Source: sora.mips ReversingLabs: Detection: 55%

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38638
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 121.156.14.197:23 -> 192.168.2.23:36356
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 121.156.14.197:23 -> 192.168.2.23:36356
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38670
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57802
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57804
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57808
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57810
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57814
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38692
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57820
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57822
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57826
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57830
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.109.52.50:23 -> 192.168.2.23:57840
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38716
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38724
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 121.156.14.197:23 -> 192.168.2.23:36442
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 121.156.14.197:23 -> 192.168.2.23:36442
Source: Traffic Snort IDS: 492 INFO TELNET login failed 124.253.26.49:23 -> 192.168.2.23:45454
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38754
Source: Traffic Snort IDS: 492 INFO TELNET login failed 66.83.255.25:23 -> 192.168.2.23:34618
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38764
Source: Traffic Snort IDS: 492 INFO TELNET login failed 78.108.27.246:23 -> 192.168.2.23:34832
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38820
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38838
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 121.156.14.197:23 -> 192.168.2.23:36554
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 121.156.14.197:23 -> 192.168.2.23:36554
Source: Traffic Snort IDS: 492 INFO TELNET login failed 177.0.18.97:23 -> 192.168.2.23:38870
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 208.69.187.191:23 -> 192.168.2.23:36352
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 208.69.187.191:23 -> 192.168.2.23:36352
Source: Traffic Snort IDS: 716 INFO TELNET access 211.247.70.50:23 -> 192.168.2.23:44494
Source: Traffic Snort IDS: 492 INFO TELNET login failed 66.83.255.25:23 -> 192.168.2.23:34752
Source: Traffic Snort IDS: 716 INFO TELNET access 190.193.255.54:23 -> 192.168.2.23:35734
Source: Traffic Snort IDS: 716 INFO TELNET access 41.33.70.89:23 -> 192.168.2.23:52610
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 190.193.255.54:23 -> 192.168.2.23:35734
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 190.193.255.54:23 -> 192.168.2.23:35734
Source: Traffic Snort IDS: 2023448 ET TROJAN Possible Linux.Mirai Login Attempt (ubnt) 192.168.2.23:44354 -> 186.7.99.184:23
Source: Traffic Snort IDS: 716 INFO TELNET access 190.193.255.54:23 -> 192.168.2.23:35800
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 190.193.255.54:23 -> 192.168.2.23:35800
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 190.193.255.54:23 -> 192.168.2.23:35800
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:39692 -> 20.151.141.34:1312
Sample listens on a socket
Source: /tmp/sora.mips (PID: 5237) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/sora.mips (PID: 5237) Socket: 0.0.0.0::23 Jump to behavior
Source: /tmp/sora.mips (PID: 5237) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/sora.mips (PID: 5237) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/sora.mips (PID: 5237) Socket: 0.0.0.0::52869 Jump to behavior
Source: /tmp/sora.mips (PID: 5237) Socket: 0.0.0.0::37215 Jump to behavior
Source: /tmp/sora.mips (PID: 5243) Socket: 0.0.0.0::22 Jump to behavior
Source: /tmp/sora.mips (PID: 5243) Socket: 0.0.0.0::23 Jump to behavior
Source: /tmp/sora.mips (PID: 5243) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/sora.mips (PID: 5243) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/sora.mips (PID: 5243) Socket: 0.0.0.0::52869 Jump to behavior
Source: /tmp/sora.mips (PID: 5243) Socket: 0.0.0.0::37215 Jump to behavior
Source: /usr/sbin/sshd (PID: 5276) Socket: [::]::22 Jump to behavior
Source: /usr/sbin/sshd (PID: 5387) Socket: 0.0.0.0::22 Jump to behavior
Source: /usr/sbin/sshd (PID: 5387) Socket: [::]::22 Jump to behavior
Source: /usr/sbin/sshd (PID: 5391) Socket: 0.0.0.0::22 Jump to behavior
Source: /usr/sbin/sshd (PID: 5391) Socket: [::]::22 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 20.151.141.34
Source: unknown TCP traffic detected without corresponding DNS query: 92.125.81.222
Source: unknown TCP traffic detected without corresponding DNS query: 206.23.56.222
Source: unknown TCP traffic detected without corresponding DNS query: 81.250.245.60
Source: unknown TCP traffic detected without corresponding DNS query: 178.224.11.107
Source: unknown TCP traffic detected without corresponding DNS query: 152.177.176.172
Source: unknown TCP traffic detected without corresponding DNS query: 107.158.11.21
Source: unknown TCP traffic detected without corresponding DNS query: 218.56.128.93
Source: unknown TCP traffic detected without corresponding DNS query: 36.16.231.114
Source: unknown TCP traffic detected without corresponding DNS query: 252.125.147.157
Source: unknown TCP traffic detected without corresponding DNS query: 177.173.219.179
Source: unknown TCP traffic detected without corresponding DNS query: 113.230.45.131
Source: unknown TCP traffic detected without corresponding DNS query: 27.212.249.70
Source: unknown TCP traffic detected without corresponding DNS query: 23.26.195.206
Source: unknown TCP traffic detected without corresponding DNS query: 167.60.218.239
Source: unknown TCP traffic detected without corresponding DNS query: 170.103.202.249
Source: unknown TCP traffic detected without corresponding DNS query: 42.33.237.121
Source: unknown TCP traffic detected without corresponding DNS query: 125.216.198.116
Source: unknown TCP traffic detected without corresponding DNS query: 106.132.143.186
Source: unknown TCP traffic detected without corresponding DNS query: 46.66.157.206
Source: unknown TCP traffic detected without corresponding DNS query: 241.158.158.122
Source: unknown TCP traffic detected without corresponding DNS query: 88.230.66.254
Source: unknown TCP traffic detected without corresponding DNS query: 20.89.229.159
Source: unknown TCP traffic detected without corresponding DNS query: 168.255.195.10
Source: unknown TCP traffic detected without corresponding DNS query: 135.141.217.112
Source: unknown TCP traffic detected without corresponding DNS query: 124.86.186.137
Source: unknown TCP traffic detected without corresponding DNS query: 92.147.222.83
Source: unknown TCP traffic detected without corresponding DNS query: 122.238.207.126
Source: unknown TCP traffic detected without corresponding DNS query: 200.26.216.73
Source: unknown TCP traffic detected without corresponding DNS query: 41.20.159.169
Source: unknown TCP traffic detected without corresponding DNS query: 144.73.8.159
Source: unknown TCP traffic detected without corresponding DNS query: 223.54.253.28
Source: unknown TCP traffic detected without corresponding DNS query: 243.230.107.3
Source: unknown TCP traffic detected without corresponding DNS query: 250.44.241.30
Source: unknown TCP traffic detected without corresponding DNS query: 150.198.177.166
Source: unknown TCP traffic detected without corresponding DNS query: 119.123.69.154
Source: unknown TCP traffic detected without corresponding DNS query: 121.241.205.167
Source: unknown TCP traffic detected without corresponding DNS query: 249.135.121.55
Source: unknown TCP traffic detected without corresponding DNS query: 44.219.36.33
Source: unknown TCP traffic detected without corresponding DNS query: 139.22.168.95
Source: unknown TCP traffic detected without corresponding DNS query: 166.149.131.138
Source: unknown TCP traffic detected without corresponding DNS query: 62.195.100.65
Source: unknown TCP traffic detected without corresponding DNS query: 133.221.246.82
Source: unknown TCP traffic detected without corresponding DNS query: 199.11.56.87
Source: unknown TCP traffic detected without corresponding DNS query: 95.250.78.5
Source: unknown TCP traffic detected without corresponding DNS query: 217.139.56.209
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.178.190
Source: unknown TCP traffic detected without corresponding DNS query: 151.88.121.184
Source: unknown TCP traffic detected without corresponding DNS query: 95.178.152.69
Source: unknown TCP traffic detected without corresponding DNS query: 172.186.225.86

System Summary:

barindex
Sample tries to kill many processes (SIGKILL)
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5243, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2191, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2275, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5239, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5247, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5276, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5387, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5237, result: unknown Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5243, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2191, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2275, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5239, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5247, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5276, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5387, result: successful Jump to behavior
Source: /tmp/sora.mips (PID: 5237) SIGKILL sent: pid: 5237, result: unknown Jump to behavior
Source: classification engine Classification label: mal68.spre.troj.linMIPS@0/6@0/0
Source: sora.mips Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link

Persistence and Installation Behavior:

barindex
Enumerates processes within the "proc" file system
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/5387/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/910/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/912/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/912/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/912/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/912/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/912/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/5139/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/759/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/759/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/759/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/759/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/759/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/517/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/918/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/918/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/918/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/918/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/918/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/5033/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/5276/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/4465/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/761/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/761/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/761/exe Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/761/fd Jump to behavior
Source: /tmp/sora.mips (PID: 5237) File opened: /proc/761/fd Jump to behavior

Malware Analysis System Evasion:

barindex
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sora.mips (PID: 5235) Queries kernel information via 'uname': Jump to behavior
Source: sora.mips, 5237.1.00000000395f2dd2.000000003aa705ab.rw-.sdmp Binary or memory string: U1/usr/bin/vmtoolsdips/r10!/proc/2123/fd/70!/proc/1582/fd/103
Source: sora.mips, 5235.1.00000000351202ca.00000000395f2dd2.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: sora.mips, 5235.1.00000000351202ca.00000000395f2dd2.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: sora.mips, 5237.1.00000000395f2dd2.000000003aa705ab.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: sora.mips, 5237.1.00000000395f2dd2.000000003aa705ab.rw-.sdmp Binary or memory string: Uu-binfmt/mips/0!/proc/1642/fd/2!/proc/1900/fd/7/mips/pr1/proc/2079/fd/5/mips/0!/proc/1642/fd/3!/proc/1900/fd/6/mips/pr1/usr/bin/qemu-mipsps/0!/proc/1642/fd/4!/proc/1900/fd/5/mips/pr1/proc/2079/fd/6/mips/0!/proc/1642/fd/5!/proc/1900/fd/4/mips/pr1p
Source: sora.mips, 5235.1.0000000066980c05.000000007dcdc10d.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: sora.mips, 5235.1.0000000066980c05.000000007dcdc10d.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/sora.mipsSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.mips

Stealing of Sensitive Information:

barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality:

barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
71.107.202.139
 unknown United States
701 UUNETUS false
80.24.160.20
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
70.40.0.156
 unknown United States
42 WOODYNET-1US false
78.227.140.86
 unknown France
12322 PROXADFR false
67.57.110.53
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
91.174.80.19
 unknown France
12322 PROXADFR false
172.246.244.217
 unknown United States
18978 ENZUINC-US false
245.171.55.96
 unknown Reserved
unknown unknown false
63.148.160.73
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
142.245.30.182
 unknown Canada
19416 RBC-NYUS false
255.148.57.230
 unknown Reserved
unknown unknown false
111.6.69.190
 unknown China
24445 CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN false
31.137.239.105
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
34.229.108.227
 unknown United States
14618 AMAZON-AESUS false
24.64.127.6
 unknown Canada
6327 SHAWCA false
76.8.118.210
 unknown Canada
25636 ONTL-2002CA false
203.176.190.38
 unknown Pakistan
45195 CDCPAK-PKCDCHouse99-BBlockBPK false
41.193.111.37
 unknown South Africa
11845 Vox-TelecomZA false
59.109.98.212
 unknown China
18245 FOUNDERBNCNNICCN false
121.77.143.181
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
254.167.189.62
 unknown Reserved
unknown unknown false
241.15.185.185
 unknown Reserved
unknown unknown false
120.224.137.159
 unknown China
24444 CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany false
44.96.244.86
 unknown United States
7377 UCSDUS false
114.37.39.155
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
37.91.93.228
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
149.150.154.242
 unknown United States
2494 MUWNETMUWNETAutonomousSystemAT false
248.155.90.26
 unknown Reserved
unknown unknown false
31.31.135.149
 unknown Belgium
199095 CITYMESH-ASBE false
251.82.161.94
 unknown Reserved
unknown unknown false
167.238.223.149
 unknown United States
36092 CENTENEUS false
153.128.122.143
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
151.142.10.141
 unknown United States
10967 HOMEDEPOTNETUS false
158.73.140.99
 unknown United States
19050 TIC-DHHS-INTERIORUS false
64.28.69.73
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
106.128.236.235
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
140.210.162.31
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
216.81.240.141
 unknown United States
11320 LIGHTEDGE-AS-02US false
200.172.238.27
 unknown Brazil
4230 CLAROSABR false
95.121.137.238
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
17.160.100.84
 unknown United States
714 APPLE-ENGINEERINGUS false
164.183.202.166
 unknown United States
37717 EL-KhawarizmiTN false
240.85.62.5
 unknown Reserved
unknown unknown false
104.35.143.179
 unknown United States
20001 TWC-20001-PACWESTUS false
175.34.81.13
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
16.229.239.174
 unknown United States
unknown unknown false
86.90.140.115
 unknown Netherlands
1136 KPNKPNNationalEU false
43.112.78.251
 unknown Japan 4249 LILLY-ASUS false
255.123.99.53
 unknown Reserved
unknown unknown false
195.20.246.157
 unknown Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
36.132.101.91
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false
191.254.53.60
 unknown Brazil
27699 TELEFONICABRASILSABR false
45.124.201.45
 unknown Australia
134067 UNITI-AS-APUnitiWirelessPtyLtdAU false
163.40.82.221
 unknown United States
226 LOS-NETTOS-ASUS false
96.201.7.12
 unknown United States
7922 COMCAST-7922US false
189.181.178.68
 unknown Mexico
8151 UninetSAdeCVMX false
57.147.55.165
 unknown Belgium
2686 ATGS-MMD-ASUS false
92.233.183.89
 unknown United Kingdom
5089 NTLGB false
244.107.176.234
 unknown Reserved
unknown unknown false
246.55.8.155
 unknown Reserved
unknown unknown false
96.38.83.249
 unknown United States
20115 CHARTER-20115US false
120.1.84.157
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
60.6.178.183
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
172.74.68.185
 unknown United States
11426 TWC-11426-CAROLINASUS false
245.166.238.106
 unknown Reserved
unknown unknown false
112.251.95.212
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
210.110.112.139
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
169.164.169.125
 unknown United States
37611 AfrihostZA false
68.144.38.185
 unknown Canada
6327 SHAWCA false
12.69.103.16
 unknown United States
7018 ATT-INTERNET4US false
255.96.93.6
 unknown Reserved
unknown unknown false
136.254.214.173
 unknown United States
72 SCHLUMBERGER-ASUS false
219.69.54.175
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
90.142.192.22
 unknown Sweden
1257 TELE2EU false
99.215.192.252
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
167.134.52.44
 unknown Venezuela
10405 UPRR-ASN-01US false
189.194.242.73
 unknown Mexico
13999 MegaCableSAdeCVMX false
90.35.131.168
 unknown France
3215 FranceTelecom-OrangeFR false
205.182.104.37
 unknown United States
3356 LEVEL3US false
250.109.197.189
 unknown Reserved
unknown unknown false
157.204.30.231
 unknown United States
54216 GORE-NETWORKUS false
167.234.69.231
 unknown United States
3525 ALBERTSONSUS false
83.97.114.71
 unknown Germany
209854 SURFSHARKVG false
142.67.215.102
 unknown Canada
22636 NOVA-SCOTIA-POWERCA false
159.206.56.242
 unknown Canada
16793 DATA-TRONICSUS false
80.110.234.46
 unknown Austria
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
83.208.201.84
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
102.236.71.235
 unknown unknown
36926 CKL1-ASNKE false
65.1.40.107
 unknown United States
16509 AMAZON-02US false
172.116.65.63
 unknown United States
20001 TWC-20001-PACWESTUS false
151.158.166.126
 unknown unknown
205664 VATTENFALL-ABSE false
216.56.118.102
 unknown United States
2381 WISCNET1-ASUS false
67.211.159.82
 unknown United States
26161 TMEIC-AUS false
250.85.29.212
 unknown Reserved
unknown unknown false
13.176.170.242
 unknown United States
7018 ATT-INTERNET4US false
169.147.23.233
 unknown United States
11659 KUMCUS false
53.99.133.165
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
174.146.255.210
 unknown United States
10507 SPCSUS false
60.0.108.165
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
111.142.109.142
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false